首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 41768 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-77926 | HIGH | 8.8 | 2026-10-20 | Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non- | apconw Aix-DB | 受影响版本 ≤ 1.2.4，请升级到修复版本。 |
| CVE-2026-75128 | CRITICAL | 9.8 | 2026-10-20 | Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes an | chatchat-space Langchain-Chatchat | 受影响版本 ≤ 0.3.1.3，请升级到修复版本。 |
| CVE-2026-65396 | MEDIUM | 5.5 | 2026-10-20 | A buffer overflow was addressed with improved size validation. This issue is fixed in macO | Apple macOS | 受影响版本 < 27，请升级到修复版本。 |
| CVE-2026-65379 | MEDIUM | 5.5 | 2026-10-20 | The issue was addressed with improved handling of secure input state. This issue is fixed | Apple macOS | 受影响版本 < 27，请升级到修复版本。 |
| CVE-2026-65372 | MEDIUM | 4.7 | 2026-10-20 | A race condition was addressed with additional validation. This issue is fixed in macOS Go | Apple macOS | 受影响版本 < 27，请升级到修复版本。 |
| CVE-2026-65356 | MEDIUM | 5.5 | 2026-10-20 | An access issue was addressed with improved access controls. This issue is fixed in macOS | Apple macOS | 受影响版本 < 27，请升级到修复版本。 |
| CVE-2026-28854 | 待定 | 待定 | 2026-10-20 | The issue was addressed with additional app bundle integrity checks. This issue is fixed i | Apple macOS | 受影响版本 < 27，请升级到修复版本。 |
| CVE-2026-28853 | HIGH | 7.8 | 2026-10-20 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, m | Apple macOS | 受影响版本 < 26.7，请升级到修复版本。 |
| CVE-2026-28850 | MEDIUM | 5.5 | 2026-10-20 | An authorization issue was addressed with improved state management. This issue is fixed i | Apple visionOS | 受影响版本 < 27，请升级到修复版本。 |
| CVE-2026-109444 | HIGH | 8.8 | 2026-10-20 | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows | Tracer-Cloud opensre | 受影响版本 ≤ 0.1.2026.10.19，请升级到修复版本。 |
| CVE-2026-109443 | HIGH | 8.8 | 2026-10-20 | JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authen | jd-opensource JoySafeter | 受影响版本 ≤ 1.0.0，请升级到修复版本。 |
| CVE-2026-109442 | CRITICAL | 9.8 | 2026-10-20 | piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgent | cas-bigdatalab piflow | 受影响版本 ≤ 2.0.1，请升级到修复版本。 |
| CVE-2026-109441 | MEDIUM | 5.8 | 2026-10-20 | LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all | ginlix-ai LangAlpha | 受影响版本 ≤ 2026.09.07，请升级到修复版本。 |
| CVE-2026-109440 | HIGH | 8.1 | 2026-10-20 | LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allo | ginlix-ai LangAlpha | 受影响版本 ≤ 2026.09.07，请升级到修复版本。 |
| CVE-2026-109395 | CRITICAL | 9.1 | 2026-10-20 | Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in th | ning compress-lzf | 受影响版本 < 1.2.0，请升级到修复版本。 |
| CVE-2026-105298 | 待定 | 待定 | 2026-10-20 | Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differ | Cloudflare https://github.com/cloudflare | 受影响版本 < 0.9.0，请升级到修复版本。 |
| CVE-2026-105297 | HIGH | 7.5 | 2026-10-20 | Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limit | Cloudflare https://github.com/cloudflare | 受影响版本 < 0.8.1，请升级到修复版本。 |
| CVE-2026-8355 | MEDIUM | 5.4 | 2026-10-20 | IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Fo | IBM ContextForge MCP Gateway | 受影响版本 ≤ 1.0.5，请升级到修复版本。 |
| CVE-2026-112373 | MEDIUM | 6.5 | 2026-10-20 | A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts th | H3C Magic NX15 | 请参考厂商官方公告并升级修复。官方说明：https://github.com/XxingGoD/H3C-NX15-R01 |
| CVE-2026-109126 | HIGH | 8.8 | 2026-10-20 | IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance coul | IBM Verify Identity Access, IBM Security | 请参考厂商官方公告并升级修复。官方说明：https://www.ibm.com/support/pages/node/7 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。