漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 790 份 · 本页赏金 $4,150 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- CVE-2026-115529: Schannel TLS auto client session resumptioncurl · 身份认证 · 2026-10-26 · CVE-2026-115529无赏金低危
- CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Authcurl · 身份认证 · 2026-10-20 · CVE-2026-3784无赏金低危
- curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status linecurl · 身份认证 · 2026-10-19无赏金中危
- CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated contentWordPress · 身份认证 · 2026-10-30无赏金低危
- A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disableMozilla · 身份认证 · 2026-10-26$4,000中危
- Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain CompromisedR3 · 身份认证 · 2026-10-08 · CVE-2026-82329无赏金高危
- Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhookBasecamp · 身份认证 · 2026-10-30无赏金中危
- CVE-2026-87861: cross-origin reuse of a Negotiate connectioncurl · 身份认证 · 2026-10-14 · CVE-2026-87861无赏金低危
- launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp APIBasecamp · 身份认证 · 2026-10-30无赏金中危
- ACL cache collision lets a role inherit privileges from a same-named socket userMariaDB · 身份认证 · 2026-09-07 · CVE-2026-107822无赏金低危
- Authentication Bypass via XML Signature Wrapping in SAML SSORocket.Chat · 身份认证 · 2026-07-27 · CVE-2026-58066无赏金高危
- HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificatesNode.js · 身份认证 · 2026-07-29 · CVE-2026-56850无赏金低危
- Trailing-Dot Hostname in Redirect Silently Strips Client Certificate and Auth Credentialscurl · 身份认证 · 2026-06-10 · CVE-2022-27774无赏金低危
- SOCKS5 no-auth accepted despite username/password-only authenticationcurl · 身份认证 · 2026-06-09无赏金低危
- CVE-2026-8927: env-set cross-proxy Digest auth state leakcurl · 身份认证 · 2026-06-24 · CVE-2026-7168无赏金低危
- iOS Brave Playlist "Open in Private Tab" bypasses FaceID requirement for Private TabsBrave Software · 身份认证 · 2026-05-28无赏金低危
- POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)CoinMate.io · 身份认证 · 2026-05-20无赏金低危
- Session ID reuse allowing XML‑RPC API authentication bypassRevive Adserver · 身份认证 · 2026-06-03 · CVE-2026-34917无赏金低危
- Negotiate Authentication Premature on Connection Reusecurl · 身份认证 · 2026-04-29无赏金中危
- Cross-room signaling injection enabling unauthorized force-muteNextcloud · 身份认证 · 2026-10-21 · CVE-2026-45266无赏金低危
- PIN bypass in PassCodeActivity via back buttonNextcloud · 身份认证 · 2026-06-07 · CVE-2026-45153$150低危
- Wallet RPC Restricted-Mode Policy BypassMonero · 身份认证 · 2026-08-17无赏金中危
- Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded fileRocket.Chat · 身份认证 · 2026-06-16 · CVE-2026-48929无赏金中危
- Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin ActionsMonero · 身份认证 · 2026-08-17无赏金中危
- Connection Reuse Ignores OAuth Bearer Token Mismatchcurl · 身份认证 · 2026-03-10 · CVE-2022-22576无赏金低危
第 1 / 32 页下一页 →