首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 46014 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-59168 | MEDIUM | 6.2 | 2026-09-21 | Dasel is a command-line tool and library for querying, modifying, and transforming data st | TomWright dasel | 请参考厂商官方公告并升级修复。官方说明：https://github.com/TomWright/dasel/commi |
| CVE-2026-58504 | MEDIUM | 6.1 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2 | jgraph drawio | 请参考厂商官方公告并升级修复。官方说明：https://github.com/jgraph/drawio/commit/ |
| CVE-2026-17051 | MEDIUM | 6 | 2026-09-21 | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an i | zephyrproject zephyr | 受影响版本 < 4.4.2，请升级到修复版本。 |
| CVE-2026-17050 | MEDIUM | 5.7 | 2026-09-21 | The experimental USB host stack allocates a per-device configuration-descriptor buffer, ud | zephyrproject zephyr | 受影响版本 < 4.4.2，请升级到修复版本。 |
| CVE-2026-88978 | MEDIUM | 4.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows | hatchet-dev hatchet | 请参考厂商官方公告并升级修复。官方说明：https://github.com/hatchet-dev/hatchet/c |
| CVE-2026-85751 | CRITICAL | 9.8 | 2026-09-21 | Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06 | Mailu, Mailu helm-charts | 请参考厂商官方公告并升级修复。官方说明：https://github.com/Mailu/Mailu/commit/df |
| CVE-2026-84298 | LOW | 3.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows | hatchet-dev hatchet | 请参考厂商官方公告并升级修复。官方说明：https://github.com/hatchet-dev/hatchet/c |
| CVE-2026-82412 | HIGH | 8.8 | 2026-09-21 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vul | ntop ntopng | 请参考厂商官方公告并升级修复。官方说明：https://github.com/ntop/ntopng/commit/0d |
| CVE-2026-77166 | LOW | 2.4 | 2026-09-21 | The emoji field in the page emoji update endpoint does not properly validate user input. B | Nextcloud Collectives | 受影响版本 ≤ 3.5.0，请升级到修复版本。 |
| CVE-2026-77165 | MEDIUM | 6.5 | 2026-09-21 | File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files pe | Nextcloud Server | 受影响版本 ≤ 34.0.0，请升级到修复版本。 |
| CVE-2026-63342 | MEDIUM | 6.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows | hatchet-dev hatchet | 请参考厂商官方公告并升级修复。官方说明：https://github.com/hatchet-dev/hatchet/c |
| CVE-2026-61687 | HIGH | 7.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows | hatchet-dev hatchet | 请参考厂商官方公告并升级修复。官方说明：https://github.com/hatchet-dev/hatchet/c |
| CVE-2026-61681 | MEDIUM | 4.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows | hatchet-dev hatchet | 请参考厂商官方公告并升级修复。官方说明：https://github.com/hatchet-dev/hatchet/c |
| CVE-2026-55563 | 待定 | 待定 | 2026-09-21 | Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .gith | feast-dev feast | 请参考厂商官方公告并升级修复。官方说明：https://github.com/feast-dev/feast/commi |
| CVE-2026-53940 | HIGH | 8.8 | 2026-09-21 | Conda is a system-level binary package and environment manager that runs on major operatin | conda | 请参考厂商官方公告并升级修复。官方说明：https://github.com/conda/conda/commit/39 |
| CVE-2026-36472 | MEDIUM | 5.2 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of t | n/a | 请参考厂商官方公告并升级修复。官方说明：https://github.com/CuteNews/cutenews-2.0 |
| CVE-2026-36471 | 待定 | 待定 | 2026-09-21 | Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNe | n/a | 请参考厂商官方公告并升级修复。官方说明：https://github.com/CuteNews/cutenews-2.0 |
| CVE-2026-36470 | MEDIUM | 5.8 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of th | n/a | 请参考厂商官方公告并升级修复。官方说明：https://github.com/CuteNews/cutenews-2.0 |
| CVE-2026-36469 | 待定 | 待定 | 2026-09-21 | CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media | n/a | 请参考厂商官方公告并升级修复。官方说明：https://github.com/CuteNews/cutenews-2.0 |
| CVE-2026-36468 | MEDIUM | 6.1 | 2026-09-21 | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated | n/a | 请参考厂商官方公告并升级修复。官方说明：https://github.com/CuteNews/cutenews-2.0 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。