首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 44850 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-79322 | HIGH | 8.6 | 2026-09-09 | SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magen | n/a | |
| CVE-2026-61907 | MEDIUM | 4.3 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination- | cyrusimap Cyrus IMAP | 受影响版本 < 3.12.4，请升级到修复版本。 |
| CVE-2026-54694 | CRITICAL | 9.6 | 2026-09-09 | SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independe | NationalSecurityAgency skills-service | |
| CVE-2026-52482 | 待定 | 待定 | 2026-09-09 | An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obta | n/a | |
| CVE-2026-39020 | MEDIUM | 5.5 | 2026-09-09 | An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a cra | n/a | |
| CVE-2025-51619 | MEDIUM | 5.5 | 2026-09-09 | A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows loc | n/a | |
| CVE-2026-8044 | 待定 | 待定 | 2026-09-09 | CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | Schneider Electric EcoStruxure™ IT Data | |
| CVE-2026-87930 | HIGH | 8.1 | 2026-09-09 | MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class rest | MaxSite MaxSite CMS | 受影响版本 ≤ 109.6，请升级到修复版本。 |
| CVE-2026-87929 | CRITICAL | 9.8 | 2026-09-09 | MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/con | MaxSite MaxSite CMS | 受影响版本 ≤ 109.6，请升级到修复版本。 |
| CVE-2026-87928 | MEDIUM | 5.4 | 2026-09-09 | MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in th | MaxSite MaxSite CMS | 受影响版本 ≤ 109.6，请升级到修复版本。 |
| CVE-2026-87927 | HIGH | 8.2 | 2026-09-09 | MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and re | MaxSite MaxSite CMS | 受影响版本 ≤ 109.6，请升级到修复版本。 |
| CVE-2026-87876 | LOW | 3 | 2026-09-09 | Two case-insensitive comparisons on request-derived usernames outside the main authorizati | Red Hat Red Hat Enterprise Linux 10, Red | |
| CVE-2026-87875 | MEDIUM | 4.3 | 2026-09-09 | The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and | Red Hat Red Hat Enterprise Linux 10, Red | |
| CVE-2026-87874 | HIGH | 8.1 | 2026-09-09 | A flaw was found in the memcached cache plugin of the community.general Ansible collection | Red Hat Red Hat Ceph Storage 5, Red Hat | |
| CVE-2026-87872 | MEDIUM | 6.8 | 2026-09-09 | A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general | Red Hat Red Hat Ceph Storage 5, Red Hat | |
| CVE-2026-87853 | HIGH | 7.5 | 2026-09-09 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() functi | Red Hat Red Hat Enterprise Linux 10, Red | |
| CVE-2026-85788 | MEDIUM | 5.5 | 2026-09-09 | Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awsla | AWS AWS Labs MySQL MCP Server | 受影响版本 ≤ 1.0.21，请升级到修复版本。 |
| CVE-2026-80925 | 待定 | 待定 | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_p | Linux | 受影响版本 ≤ *，请升级到修复版本。 |
| CVE-2026-80924 | HIGH | 7.5 | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kf | Linux | 受影响版本 ≤ *，请升级到修复版本。 |
| CVE-2026-80923 | 待定 | 待定 | 2026-09-09 | In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unr | Linux | 受影响版本 ≤ *，请升级到修复版本。 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。