首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 45534 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-87031 | 待定 | 待定 | 2026-09-16 | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0 | Concrete CMS | 受影响版本 ≤ 9.5.3，请升级到修复版本。 |
| CVE-2026-87028 | 待定 | 待定 | 2026-09-16 | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the cu | Concrete CMS | 受影响版本 ≤ 9.5.3，请升级到修复版本。 |
| CVE-2026-86359 | HIGH | 8.5 | 2026-09-16 | Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permission | Dell Repository Manager | 受影响版本 < 3.5.2 or later，请升级到修复版本。 |
| CVE-2026-86358 | MEDIUM | 6.5 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer O | Dell Update Package Framework | 受影响版本 < 26.07.03 or later，请升级到修复版本。 |
| CVE-2026-85756 | HIGH | 7.5 | 2026-09-16 | SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places call | sshnet SSH.NET | 请参考厂商官方公告并升级修复。官方说明：https://github.com/sshnet/SSH.NET/commit |
| CVE-2026-85732 | MEDIUM | 4.7 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function | oras-project oras-go | 请参考厂商官方公告并升级修复。官方说明：https://github.com/oras-project/oras-go/ |
| CVE-2026-85731 | HIGH | 8.8 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store ext | oras-project oras-go | 请参考厂商官方公告并升级修复。官方说明：https://github.com/oras-project/oras-go/ |
| CVE-2026-85386 | 待定 | 待定 | 2026-09-16 | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a publi | Concrete CMS | 受影响版本 ≤ 9.5.3，请升级到修复版本。 |
| CVE-2026-85385 | 待定 | 待定 | 2026-09-16 | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and | Concrete CMS | 受影响版本 ≤ 9.5.3，请升级到修复版本。 |
| CVE-2026-84993 | MEDIUM | 6.5 | 2026-09-16 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity M | mikro-orm | 请参考厂商官方公告并升级修复。官方说明：https://github.com/mikro-orm/mikro-orm/c |
| CVE-2026-76420 | CRITICAL | 9 | 2026-09-16 | A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) conn | Cisco Cisco Secure Firewall Management C | 请参考厂商官方公告并升级修复。官方说明：https://sec.cloudapps.cisco.com/security |
| CVE-2026-71182 | LOW | 3 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resol | Dell Update Package Framework | 受影响版本 < 26.07.03 or later，请升级到修复版本。 |
| CVE-2026-71181 | LOW | 3 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resol | Dell Update Package Framework | 受影响版本 < 26.07.03 or later，请升级到修复版本。 |
| CVE-2026-71180 | HIGH | 8.2 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Va | Dell Update Package Framework | 受影响版本 < 26.07.03 or later，请升级到修复版本。 |
| CVE-2026-71179 | HIGH | 7.3 | 2026-09-16 | Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutraliza | Dell Update Package Framework | 受影响版本 < 26.07.03 or later，请升级到修复版本。 |
| CVE-2026-69200 | LOW | 3.7 | 2026-09-16 | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-cli | node-opcua | 请参考厂商官方公告并升级修复。官方说明：https://github.com/node-opcua/node-opcua |
| CVE-2026-68904 | HIGH | 7 | 2026-09-16 | node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170. | node-opcua | 请参考厂商官方公告并升级修复。官方说明：https://github.com/node-opcua/node-opcua |
| CVE-2026-59974 | HIGH | 7.8 | 2026-09-16 | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and | stanfordnlp stanza | 请参考厂商官方公告并升级修复。官方说明：https://github.com/stanfordnlp/stanza/co |
| CVE-2026-59944 | MEDIUM | 6.1 | 2026-09-16 | Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3. | composer | 请参考厂商官方公告并升级修复。官方说明：https://github.com/composer/composer/com |
| CVE-2026-57173 | MEDIUM | 6.5 | 2026-09-16 | vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the in | vllm-project vllm | 请参考厂商官方公告并升级修复。官方说明：https://github.com/vllm-project/vllm/com |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。