漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 15,219 份 · 本页赏金 $7,200
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- CVE-2026-92389: TFTP direction confusioncurl · 其他弱点 · 2026-10-14 · CVE-2026-92389无赏金低危
- Uncaught RecursionError crash in translation-finder (deep directory tree DoS)Weblate · 拒绝服务 · 2026-10-14无赏金低危
- CVE-2026-92388: FTP wildcard write callback mixupcurl · 其他弱点 · 2026-10-14 · CVE-2026-92388无赏金低危
- CVE-2026-92387: never-ending loop via server response omissioncurl · 其他弱点 · 2026-10-14 · CVE-2026-92387无赏金低危
- CVE-2026-92386: server-set cookie aborts cookie jar loadcurl · 其他弱点 · 2026-10-14 · CVE-2026-92386无赏金低危
- TELNET control and environment data bypass HTTPS-proxy TLScurl · 业务逻辑 · 2026-09-19无赏金未评级
- Socket API drops expired timeouts for transfers queued behind a connection limitcurl · 业务逻辑 · 2026-09-18无赏金未评级
- IMAP custom FETCH literals can spoof tagged responses and desynchronize reused connectionscurl · 其他弱点 · 2026-10-15无赏金未评级
- Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████Essity · 错误配置 · 2026-09-18无赏金高危
- TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTIONcurl · 身份认证 · 2026-09-14 · CVE-2016-5419无赏金低危
- One Strict-Transport-Security response header empties the victim's entire HSTS store, silently,curl · 密码学缺陷 · 2026-10-15 · CVE-2023-23914无赏金低危
- TLS certificate hostname bypass when the host loosely resolves to an IP addressNode.js · 密码学缺陷 · 2026-10-23 · CVE-2026-106069无赏金中危
- HackerOne Code sends live password-reset tokens to Segment in automatic page eventsHackerOne · 身份认证 · 2026-09-24$200低危
- A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disableMozilla · 身份认证 · 2026-10-26$4,000中危
- A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_optionBasecamp · 访问控制 · 2026-10-30无赏金中危
- Permission Model filesystem over-grant via wildcard radix lookupNode.js · 访问控制 · 2026-10-27 · CVE-2026-106071无赏金低危
- Full Admin Takeover of R3 Limited's JFrog Artifactory - 292 Users, Corda Enterprise & CBDC Supply Chain CompromisedR3 · 身份认证 · 2026-10-08 · CVE-2026-82329无赏金高危
- Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary MarkdownRuby on Rails · 跨站脚本 · 2026-09-12无赏金低危
- HTTP Digest nonce reused across an https→http scheme change on the same handlecurl · 其他弱点 · 2026-09-08无赏金低危
- CVE-2026-86415: auto client cert connection reuse mixupcurl · 其他弱点 · 2026-10-14 · CVE-2026-86415无赏金低危
- Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert passcurl · 注入与走私 · 2026-09-08无赏金低危
- CVE-2026-86414: leaking host credentials to HTTP proxycurl · 信息泄露 · 2026-10-14 · CVE-2026-86414无赏金低危
- CVE-2026-86413: Negotiate credentials sent to redirected origincurl · 开放重定向 · 2026-10-14 · CVE-2026-86413无赏金未评级
- CVE-2026-87866: wolfSSL public-key pinning bypasscurl · 密码学缺陷 · 2026-10-14 · CVE-2026-87866无赏金低危
- Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTMLMozilla · 跨站脚本 · 2026-10-14$3,000中危