首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 4649 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-10572 | HIGH | 8.8 | 2026-10-19 | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially e | IBM MQ Operator, IBM MQ Advanced contain | 受影响版本 ≤ 10.0.0.0-r4，请升级到修复版本。 |
| CVE-2025-7043 | MEDIUM | 5.4 | 2026-10-19 | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh tok | WSO2 WSO2 API Manager, WSO2 WSO2 Univers | 受影响版本 < 1.1.5.4，请升级到修复版本。 |
| CVE-2025-7203 | MEDIUM | 4.9 | 2026-10-19 | The Management Console and product files expose sensitive data, including remote log serve | WSO2 WSO2 Universal Gateway, WSO2 WSO2 T | 受影响版本 < 1.3.83.7，请升级到修复版本。 |
| CVE-2026-103038 | 待定 | 待定 | 2026-10-19 | PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Hos | StreamSoft PingTools Network Utilities | 请参考厂商官方公告并升级修复。官方说明：https://fluidattacks.com/advisories/yand |
| CVE-2026-107082 | HIGH | 8.8 | 2026-10-19 | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff us | n/a | 请参考厂商官方公告并升级修复。官方说明：https://github.com/Primandito/CVE-2026-1 |
| CVE-2026-107083 | CRITICAL | 9.8 | 2026-10-19 | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQ | n/a | 请参考厂商官方公告并升级修复。官方说明：https://github.com/Primandito/CVE-2026-1 |
| CVE-2024-4412 | LOW | 2.7 | 2026-10-19 | The software accepts user-supplied data without sufficient validation, allowing for the in | WSO2 WSO2 Enterprise Integrator, WSO2 WS | 受影响版本 < 1.2.23.4，请升级到修复版本。 |
| CVE-2025-10149 | HIGH | 8.2 | 2026-10-19 | The SCIM endpoint does not sufficiently validate authorization for federated users when pe | WSO2 WSO2 Identity Server as Key Manager | 受影响版本 < 1.5.46.47，请升级到修复版本。 |
| CVE-2025-13173 | MEDIUM | 6.5 | 2026-10-19 | Tokens associated with user sessions are not revoked when the corresponding user session i | WSO2 WSO2 API Control Plane, WSO2 WSO2 U | 受影响版本 < 7.0.385.3，请升级到修复版本。 |
| CVE-2025-13591 | MEDIUM | 5.3 | 2026-10-19 | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system r | WSO2 WSO2 Identity Server, WSO2 WSO2 Car | 受影响版本 < 1.0.30.5，请升级到修复版本。 |
| CVE-2025-6623 | MEDIUM | 4.3 | 2026-10-19 | The carbon console accepts user-supplied XML input without sufficiently encoding potential | WSO2 WSO2 API Manager, WSO2 WSO2 Univers | 受影响版本 < 5.3.20.1，请升级到修复版本。 |
| CVE-2026-112368 | HIGH | 7.5 | 2026-10-19 | An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver ma | MongoDB Inc. PHP Driver | 受影响版本 < 2.5.5，请升级到修复版本。 |
| CVE-2026-12254 | 待定 | 待定 | 2026-10-19 | Netskope is notified about a potential gap in its agent (NSClient) where a system with Net | Netskope Inc. Netskope Client | 受影响版本 < 142，请升级到修复版本。 |
| CVE-2026-77225 | 待定 | 待定 | 2026-10-19 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | ||
| CVE-2026-77227 | 待定 | 待定 | 2026-10-19 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | ||
| CVE-2026-77228 | 待定 | 待定 | 2026-10-19 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | ||
| CVE-2026-112366 | HIGH | 7.5 | 2026-10-19 | Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that | micromatch picomatch | 受影响版本 ≤ 4.0.7，请升级到修复版本。 |
| CVE-2026-112306 | HIGH | 7.2 | 2026-10-19 | NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerab | nocobase | 受影响版本 ≤ 2.2.28，请升级到修复版本。 |
| CVE-2026-112307 | HIGH | 7.3 | 2026-10-19 | sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers t | andialbrecht sqlparse | 受影响版本 ≤ 0.6.0，请升级到修复版本。 |
| CVE-2026-112308 | HIGH | 7.4 | 2026-10-19 | crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in Selen | crewAIInc crewai-tools | 受影响版本 ≤ 1.15.28，请升级到修复版本。 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。