首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 45696 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-13684 | CRITICAL | 9.8 | 2026-09-18 | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation M | Synology DiskStation Manager (DSM) | 受影响版本 < 7.2.1，请升级到修复版本。 |
| CVE-2026-13683 | LOW | 2.7 | 2026-09-18 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vu | Synology DiskStation Manager (DSM) | 受影响版本 < 7.2.1，请升级到修复版本。 |
| CVE-2026-13673 | HIGH | 8.8 | 2026-09-18 | An incorrect permission assignment for critical resource vulnerability in LDAP API in Syno | Synology DiskStation Manager (DSM) | 受影响版本 < 7.2.1，请升级到修复版本。 |
| CVE-2026-13666 | LOW | 3.5 | 2026-09-18 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing A | Synology DiskStation Manager (DSM) | 受影响版本 < 7.2.1，请升级到修复版本。 |
| CVE-2026-13639 | CRITICAL | 9.8 | 2026-09-18 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) | Synology DiskStation Manager (DSM) | 受影响版本 < 7.2.1，请升级到修复版本。 |
| CVE-2026-13635 | MEDIUM | 5.3 | 2026-09-18 | An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStati | Synology DiskStation Manager (DSM) | 受影响版本 < 7.2.1，请升级到修复版本。 |
| CVE-2026-13623 | MEDIUM | 4.8 | 2026-09-18 | An improper neutralization of input during web page generation ('Cross-site Scripting') vu | Synology DiskStation Manager (DSM) | 受影响版本 < 7.2.1，请升级到修复版本。 |
| CVE-2025-13533 | MEDIUM | 4.4 | 2026-09-18 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scrip | wipeoutmedia CSS & JavaScript Toolbox | 受影响版本 ≤ 12.0.6，请升级到修复版本。 |
| CVE-2026-93494 | HIGH | 7.5 | 2026-09-18 | A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit | Red Hat Red Hat build of Apache Camel fo | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-93493 | MEDIUM | 5.9 | 2026-09-18 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can expl | Red Hat Red Hat build of Apache Camel fo | 请参考厂商官方公告并升级修复。官方说明：https://access.redhat.com/security/cve/C |
| CVE-2026-92622 | MEDIUM | 6.4 | 2026-09-18 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting | wpchill Strong Testimonials | 受影响版本 ≤ 3.3.8，请升级到修复版本。 |
| CVE-2026-92554 | MEDIUM | 6.1 | 2026-09-18 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordP | devitemsllc ShopLentor – All-in-One WooC | 受影响版本 ≤ 3.5.1，请升级到修复版本。 |
| CVE-2026-92249 | MEDIUM | 6.1 | 2026-09-18 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scr | qodeinteractive Qi Addons For Elementor | 受影响版本 ≤ 1.11，请升级到修复版本。 |
| CVE-2026-90981 | MEDIUM | 6.1 | 2026-09-18 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to | satollo Newsletter – Send awesome emails | 受影响版本 ≤ 9.3.8，请升级到修复版本。 |
| CVE-2026-89059 | HIGH | 7.5 | 2026-09-18 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image req | Red Hat, Red Hat Red Hat build of Apache | 受影响版本 < 7.0.5.Final，请升级到修复版本。 |
| CVE-2026-89058 | HIGH | 7.4 | 2026-09-18 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("* | Red Hat, Red Hat Red Hat build of Apache | 受影响版本 < 7.0.5.Final，请升级到修复版本。 |
| CVE-2026-85705 | HIGH | 7.5 | 2026-09-18 | The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'lati | AyeCode Ltd Location Manager | 受影响版本 ≤ 2.3.38，请升级到修复版本。 |
| CVE-2026-85652 | MEDIUM | 6.5 | 2026-09-18 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnera | 10web Photo Gallery by 10Web – Mobile-Fr | 受影响版本 ≤ 1.8.44，请升级到修复版本。 |
| CVE-2026-75961 | MEDIUM | 4.9 | 2026-09-18 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to | webaways NEX-Forms – Ultimate Forms Plug | 受影响版本 ≤ 9.3.0，请升级到修复版本。 |
| CVE-2026-75157 | 待定 | 待定 | 2026-09-18 | Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permis | Apache Software Foundation Apache Airflo | 受影响版本 < 3.3.2，请升级到修复版本。 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。