首页 / 漏洞情报库
🛡️ 漏洞情报库（CVE 查询与修复方法）
每日采集 NVD / CISA / 微软等主流漏洞源的 CVE 信息，含漏洞说明、受影响产品、修复方法（补丁/升级版本）。支持按 CVE 号、关键词、风险等级、是否在野、发布时间筛选。
📌 最近漏洞情报周报（每周一篇）
共 44077 条漏洞
| CVE | 等级 | CVSS | 发布时间 | 说明 | 受影响 | 修复方法 |
|---|---|---|---|---|---|---|
| CVE-2026-108185 | HIGH | 7.4 | 2026-10-13 | Improper certificate validation in the My Notes feature of certain Zoom Clients may allow | Zoom Communications Zoom Clients | 请参考厂商官方公告并升级修复。官方说明：https://www.zoom.com/en/trust/security-b |
| CVE-2026-108184 | HIGH | 7.4 | 2026-10-13 | Improper certificate validation in certain Zoom Clients for Windows may allow an unauthent | Zoom Communications Zoom Clients | 请参考厂商官方公告并升级修复。官方说明：https://www.zoom.com/en/trust/security-b |
| CVE-2026-107918 | MEDIUM | 4.5 | 2026-10-13 | Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 rout | NETGEAR R7300DST | 受影响版本 ≤ V1 1.0.0.74，请升级到修复版本。 |
| CVE-2026-107917 | MEDIUM | 4.5 | 2026-10-13 | Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 ro | NETGEAR R7300DST | 受影响版本 ≤ V1.0.0.74，请升级到修复版本。 |
| CVE-2026-107460 | 待定 | 待定 | 2026-10-13 | Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache | Apache Software Foundation Apache Fesod | 请参考厂商官方公告并升级修复。官方说明：https://cve.org/CVERecord?id=CVE-2026-49 |
| CVE-2026-106108 | 待定 | 待定 | 2026-10-13 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. From | quasarframework quasar, @quasar app-vite | 请参考厂商官方公告并升级修复。官方说明：https://github.com/quasarframework/quasa |
| CVE-2026-104192 | CRITICAL | 9.6 | 2026-10-13 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40 | dragonflydb dragonfly | 请参考厂商官方公告并升级修复。官方说明：https://github.com/dragonflydb/dragonfly |
| CVE-2026-103028 | MEDIUM | 4.3 | 2026-10-13 | SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an | drakkan sftpgo | 请参考厂商官方公告并升级修复。官方说明：https://github.com/drakkan/sftpgo/commit |
| CVE-2026-102603 | 待定 | 待定 | 2026-10-13 | Gotify server is a simple server for sending and receiving messages in real-time per WebSo | gotify server | 请参考厂商官方公告并升级修复。官方说明：https://github.com/gotify/server/commit/ |
| CVE-2026-102342 | MEDIUM | 5.4 | 2026-10-13 | ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3 | rust-ammonia ammonia | 请参考厂商官方公告并升级修复。官方说明：https://github.com/rust-ammonia/ammonia/ |
| CVE-2026-102250 | 待定 | 待定 | 2026-10-13 | CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could al | Schneider Electric Sage RTU 1410, Schnei | 请参考厂商官方公告并升级修复。官方说明：https://download.schneider-electric.com/ |
| CVE-2024-34319 | MEDIUM | 6.5 | 2026-10-13 | A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v20 | n/a | 请参考厂商官方公告并升级修复。官方说明：https://prophoenix.com/law-rms/ |
| CVE-2026-95680 | HIGH | 8 | 2026-10-13 | IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to byp | IBM WebSphere Application Server | 请参考厂商官方公告并升级修复。官方说明：https://www.ibm.com/support/pages/node/7 |
| CVE-2026-93907 | HIGH | 8.1 | 2026-10-13 | IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass auth | IBM WebSphere Application Server | 请参考厂商官方公告并升级修复。官方说明：https://www.ibm.com/support/pages/node/7 |
| CVE-2026-93347 | MEDIUM | 4.9 | 2026-10-13 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_fil | Wazuh wazuh-manager | 受影响版本 < 4.14.8，请升级到修复版本。 |
| CVE-2026-93346 | MEDIUM | 5.3 | 2026-10-13 | Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allo | Wazuh wazuh-manager | 受影响版本 < 4.14.8，请升级到修复版本。 |
| CVE-2026-77362 | MEDIUM | 4.3 | 2026-10-13 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. | The-40-Thieves obsidian-tc | 请参考厂商官方公告并升级修复。官方说明：https://github.com/The-40-Thieves/obsidi |
| CVE-2026-77361 | MEDIUM | 4.7 | 2026-10-13 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. | The-40-Thieves obsidian-tc | 请参考厂商官方公告并升级修复。官方说明：https://github.com/The-40-Thieves/obsidi |
| CVE-2026-74047 | MEDIUM | 6.5 | 2026-10-13 | Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allow | Wazuh wazuh-manager | 受影响版本 < 4.14.8，请升级到修复版本。 |
| CVE-2026-74045 | HIGH | 7.1 | 2026-10-13 | Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() wh | Wazuh wazuh-manager | 受影响版本 < 4.14.8，请升级到修复版本。 |
💡 说明：数据源为 NVD、CISA（在野利用)、微软等官方公开情报，每日自动采集。中文源 CNNVD/CNVD 受官方接口限制暂未接入，描述以英文原版为准，可点击 CVE 号查看详情与官方参考链接。修复方法含补丁/升级版本线索，具体请以厂商官方公告为准。