🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-45697 (Formie) - 服务端模板注入漏洞。未认证用户可通过提交特制数据至Hidden字段触发Twig模板引擎解析，导致Craft CMS站点被完全接管。利用条件低，危害极高。
• GHSA-wx9m-wx4f-4cmg (mistralai PyPI) - 供应链投毒攻击。PyPI上的mistralai包2.4.6版本包含恶意dropper，在Linux系统上导入时执行。由于攻击者已成功上传恶意包，影响范围可能涉及直接或间接依赖该包的开发环境与生产系统。
• CVE-2026-45327 (TinyIce) - 未授权访问。TinyIce的WebRTC推流端点缺少身份验证，攻击者可未授权注入视频流，进而实现直播内容篡改或植入恶意视频。
• CVE-2026-45363 (ruby-jwt) - 认证绕过。使用空密钥('')验证HMAC时，攻击者可以伪造任意JWT令牌，绕过身份验证。此问题影响所有使用空密钥选项的Ruby JWT库用户。

📈 威胁趋势

• 远程代码执行 (RCE) / 命令注入: 今日有7个Critical级漏洞属于此类，涵盖CPAN、PyPI、WordPress插件、GitBucket及jsonpickle等组件。攻击链成熟，利用公开的EXP即可构成严重威胁。
• 认证绕过 / 权限提升: 涉及ruby-jwt的空密钥HMAC绕过、TinyIce的WebRTC端点未授权、GitBucket弱令牌生成以及CAPTCHA验证绕过。攻击者可通过网络请求直接突破系统防线。
• 拒绝服务 (DoS): 集中在multiparty包上，包含原型污染导致的未捕获异常、畸形编码导致的解码崩溃以及正则表达式回溯（ReDoS）。均只需发送特定构造的HTTP请求即可导致服务瘫痪。
• 供应链安全 / 信息泄露: mistralai投毒事件凸显了软件供应链的持续风险。同时，Crypt::OpenSSL::PKCS12中嵌入NULL的密码截断问题可导致证书保护失效，属于严重的信息泄露/权限提升类型。

🛡️ 缓解建议

• 立即升级受影响组件: 请运维和安全团队优先升级Formie插件 (CVE-2026-45697)、ruby-jwt、multiparty、@tmlmobilidade/utils及Crypt::OpenSSL::PKCS12 (Perl包) 至修复版本。对于mistralai，应立即从环境中卸载有问题的2.4.6版本，并回退至2.4.5或更高安全版本。
• 阻断受影响端点与陈旧系统: 针对TinyIce和已废弃的、存有历史漏洞 (如CVE-2018-25332 GitBucket、ACL Analytics) 的系统，建议立即添加防火墙规则或WAF策略，限制外部对相关端点的访问，直至完成版本升级。
• 强化密钥与认证机制: 检查所有使用JWT的服务，确保不会使用空字符串或弱密码作为HMAC密钥；审查WebRTC、文件上传等接口的认证与授权逻辑，确保所有敏感操作均需经过身份验证。

🐙 GitHub-Advisory（50 条）

Critical (2 条)

• CVE-2026-45697 - Formie: Pre-authenticated server-side template injection in Hidden fields CVE-2026-45697Critical
  Impact - Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission…
• GHSA-wx9m-wx4f-4cmg - Malicious dropper in mistralai 2.4.6 PyPI package Critical
  The `mistralai` PyPI package version `2.4.6` contains a malicious dropper that executes on import on Linux. No `v2.4.6` tag, commit, or release workflow run…

High (22 条)

• CVE-2026-45327 - TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized st CVE-2026-45327High 3.1
  ## Title Missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection in TinyIce ## Ecosystem / Package - **Ecosystem:** `Go` (or…
• CVE-2026-45325 - @tmlmobilidade/utils has prototype pollution in its setValueAtPath CVE-2026-45325High
  Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath(). Patches A fix is available in versions 20260509.0340.15 and up.
• CVE-2026-45363 - ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351 CVE-2026-45363High
  `JWT.decode(token, '', true, algorithm: 'HS256')` accepts an attacker-forged token. `OpenSSL::HMAC.digest('SHA256', '', payload)` returns a valid digest under…
• CVE-2026-8161 - multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exceptio CVE-2026-8161High
  Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a field…
• CVE-2026-8162 - multiparty vulnerable to Denial of Service via Uncaught Exception in filename* p CVE-2026-8162High
  Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a…
• CVE-2026-8159 - multiparty vulnerable to ReDoS via filename parsing CVE-2026-8159High
  Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the `Content-Disposition` filename…
• CVE-2026-45707 - n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials wh CVE-2026-45707High
  ## Summary When `ENABLE_MULTI_TENANT=true`, the HTTP transport documents that the target n8n instance is selected per-request from `x-n8n-url` / `x-n8n-key`…
• CVE-2026-45716 - Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Withou CVE-2026-45716High
  ## Summary The `POST /api/global/users/onboard` endpoint is protected by `workspaceBuilderOrAdmin` middleware, allowing any user with builder permissions to…
• CVE-2026-41567 - Docker: `PUT /containers/{id}/archive` executes container binary on the host CVE-2026-41567High
  ## Summary When a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with daemon (host root) privileges. ##…
• CVE-2026-45727 - CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloaks CVE-2026-45727High
  The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile…
• CVE-2026-42306 - Docker: Race condition in docker cp allows bind mount redirection to host path CVE-2026-42306High
  ## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially…
• CVE-2026-32687 - Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3` CVE-2026-32687High
  Summary SQL injection in `Postgrex.Notifications.listen/3`: the `channel` argument is interpolated straight into `LISTEN "..."` / `UNLISTEN "..."` without…
• CVE-2026-45678 - OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed CVE-2026-45678High
  Summary The Postgres protocol parser assumes `BIND` message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can…
• CVE-2026-32175 - Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability CVE-2026-32175High
  ## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This…
• CVE-2026-42899 - Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vuln CVE-2026-42899High
  ## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This…
• CVE-2026-35433 - Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnera CVE-2026-35433High
  ## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This…
• CVE-2026-45685 - OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire mess CVE-2026-45685High
  Summary Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the…
• CVE-2026-45686 - OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash CVE-2026-45686High
  Summary A remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing…
• CVE-2026-45553 - NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_te CVE-2026-45553High
  Summary `ui.restructured_text()` renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application…
• CVE-2026-45367 - HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP CVE-2026-45367High
  ## Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions…
• CVE-2026-46520 - ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images CVE-2026-46520High
  When reading multiple images with different dimensions an out of bounds heap write can occur.
• CVE-2026-46522 - ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion CVE-2026-46522High
  Due to a missing check in the MIFF decoder a crafted file could cause an infinite loop resulting in CPU exhaustion.

Medium (22 条)

• CVE-2026-45701 - Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens CVE-2026-45701Medium
  Impact The password reset tokenand API key generation uses a weak cryptographical hash algorithm. Patches Fixed in 2.6.23 and 3.0.6 version. Workarounds Patch…
• CVE-2026-45718 - Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing CVE-2026-45718Medium
  ## Summary The row action trigger endpoint (`POST /api/tables/:sourceId/actions/:actionId/trigger`) fails to validate that the user-supplied `rowId` is within…
• CVE-2026-45719 - Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 V CVE-2026-45719Medium
  # Security Advisory: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API **Affected Software:** Budibase **Affected Component:**…
• CVE-2026-45359 - ImageMagick: Out-of-Bounds Read in connected components when the user supplies a CVE-2026-45359Medium
  An invalid `connected-components:keep-top` value could result in a heap buffer over-read when performing the connected components operation.
• CVE-2026-45358 - ImageMagick: Out-of-Bounds Read of a single byte in meta encoder CVE-2026-45358Medium
  An of by one in the meta encoder could result in an out of bounds read of a single byte in the meta encoder.
• CVE-2026-41568 - Docker: Race condition in docker cp allows creation of arbitrary empty files on CVE-2026-41568Medium
  ## Summary A race condition during `docker cp` mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the…
• CVE-2026-45031 - ImageMagick: Policy Bypass in PSD decoder CVE-2026-45031Medium
  Due to a missing check in the PSD decoder it would be possible to bypass the `list-length` resource policy when decoding a PSD image. Other security limits…
• CVE-2026-45676 - OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF CVE-2026-45676Medium
  Summary OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference…

…另有 14 条 Medium 级漏洞（已省略）

Low (4 条)

• CVE-2026-2728 - LibreNMS: Cross-Site Scripting in ShowConfigController CVE-2026-2728Low
  Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the RANCID Integration settings. The application…
• GHSA-9m6v-8fxc-4r44 - Sulu: Used API Keys may be available via Admin API Low
  Impact The users endpoint controller exposes a project's apiKey field to the logged-in user, provided they have permission for that endpoint. This only has…
• GHSA-jgg6-4rpr-wfh7 - Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/m Low
  Mistral npm `@mistralai/mistralai`, `@mistralai/mistralai-azure`, `@mistralai/mistralai-gcp` were compromised by a supply chain attack related to the [TanStack…

…另有 1 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（65 条）

Critical (8 条)

• CVE-2026-8721 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with e CVE-2026-8721Critical 9.8
  CVE-2026-8721 CVSS:9.8 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are…
• CVE-2026-8507 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) w CVE-2026-8507Critical 9.8
  CVE-2026-8507 CVSS:9.8 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB…
• CVE-2018-25335 WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerabili CVE-2018-25335Critical 9.8
  CVE-2018-25335 CVSS:9.8 WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload…
• CVE-2018-25332 GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability CVE-2018-25332Critical 9.8
  CVE-2018-25332 CVSS:9.8 GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by…
• CVE-2018-25320 ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code executi CVE-2018-25320Critical 9.8
  CVE-2018-25320 CVSS:9.8 ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute…
• CVE-2021-47952 python jsonpickle 2.0.0 contains a remote code execution vulnerability that allo CVE-2021-47952Critical 9.8
  CVE-2021-47952 CVSS:9.8 python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by…
• CVE-2020-37239 libbabl 0.1.62 contains a broken double free detection vulnerability that allows CVE-2020-37239Critical 9.8
  CVE-2020-37239 CVSS:9.8 libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting…
• CVE-2020-37228 iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulner CVE-2020-37228Critical 9.8
  CVE-2020-37228 CVSS:9.8 iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication…

High (57 条)

• CVE-2026-3220 The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin CVE-2026-3220High 8.8
  CVE-2026-3220 CVSS:8.8 The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before…
• CVE-2026-8776 A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affe CVE-2026-8776High 8.8
  CVE-2026-8776 CVSS:8.8 A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file…
• CVE-2026-8775 A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2 CVE-2026-8775High 8.8
  CVE-2026-8775 CVSS:8.8 A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the…
• CVE-2026-8719 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre CVE-2026-8719High 8.8
  CVE-2026-8719 CVSS:8.8 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version…
• CVE-2021-47979 WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vu CVE-2021-47979High 8.8
  CVE-2021-47979 CVSS:8.8 WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to…
• CVE-2021-47976 TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that al CVE-2021-47976High 8.8
  CVE-2021-47976 CVSS:8.8 TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP…
• CVE-2020-37227 HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that CVE-2020-37227High 8.8
  CVE-2020-37227 CVSS:8.8 HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file…
• CVE-2026-6379 The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly san CVE-2026-6379High 8.6
  CVE-2026-6379 CVSS:8.6 The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL…
• CVE-2018-25328 VX Search 10.6.18 contains a local buffer overflow vulnerability that allows att CVE-2018-25328High 8.4
  CVE-2018-25328 CVSS:8.4 VX Search 10.6.18 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by…
• CVE-2018-25323 Allok AVI DivX MPEG to DVD Converter 2.6.1217 contains a structured exception ha CVE-2018-25323High 8.4
  CVE-2018-25323 CVSS:8.4 Allok AVI DivX MPEG to DVD Converter 2.6.1217 contains a structured exception handler buffer overflow vulnerability that allows local…
• CVE-2018-25322 Allok Fast AVI MPEG Splitter 1.2 contains a stack based buffer overflow vulnerab CVE-2018-25322High 8.4
  CVE-2018-25322 CVSS:8.4 Allok Fast AVI MPEG Splitter 1.2 contains a stack based buffer overflow vulnerability that allows local attackers to execute arbitrary…
• CVE-2026-46720 Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The CVE-2026-46720High 8.2
  CVE-2026-46720 CVSS:8.2 Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and set values were not checked for…
• CVE-2018-25339 Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows CVE-2018-25339High 8.2
  CVE-2018-25339 CVSS:8.2 Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database…
• CVE-2018-25338 Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that CVE-2018-25338High 8.2
  CVE-2018-25338 CVSS:8.2 Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database…
• CVE-2018-25333 Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulner CVE-2018-25333High 8.2
  CVE-2018-25333 CVSS:8.2 Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to…
• CVE-2018-25330 Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL CVE-2018-25330High 8.2
  CVE-2018-25330 CVSS:8.2 Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to…
• CVE-2026-46728 Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification by CVE-2026-46728High 8.2
  CVE-2026-46728 CVSS:8.2 Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. 产品:
• CVE-2021-47956 EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows un CVE-2021-47956High 8.2
  CVE-2021-47956 CVSS:8.2 EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries…
• CVE-2021-47954 LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticate CVE-2021-47954High 8.2
  CVE-2021-47954 CVSS:8.2 LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting…
• CVE-2020-37244 Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows u CVE-2020-37244High 8.2
  CVE-2020-37244 CVSS:8.2 Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL…
• CVE-2020-37243 Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'si CVE-2020-37243High 8.2
  CVE-2020-37243 CVSS:8.2 Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers…
• CVE-2020-37242 Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allo CVE-2020-37242High 8.2
  CVE-2020-37242 CVSS:8.2 Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL…
• CVE-2026-8657 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype P CVE-2026-8657High 8.2
  CVE-2026-8657 CVSS:8.2 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and…
• CVE-2021-47974 VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Sea CVE-2021-47974High 7.8
  CVE-2021-47974 CVSS:7.8 VX Search 13.5.28 contains an unquoted service path vulnerability in both VX Search Server and VX Search Enterprise services that…
• CVE-2020-37247 Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteServi CVE-2020-37247High 7.8
  CVE-2020-37247 CVSS:7.8 Kite 4.2.0.1 U1 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to…
• CVE-2020-37232 Advanced System Care Service 13.0.0.157 contains an unquoted service path vulner CVE-2020-37232High 7.8
  CVE-2020-37232 CVSS:7.8 Advanced System Care Service 13.0.0.157 contains an unquoted service path vulnerability in the AdvancedSystemCareService13 service…
• CVE-2020-37231 Privacy Drive 3.17.0 contains an unquoted service path vulnerability in the pdsv CVE-2020-37231High 7.8
  CVE-2020-37231 CVSS:7.8 Privacy Drive 3.17.0 contains an unquoted service path vulnerability in the pdsvc.exe service binary that allows local attackers to…
• CVE-2020-37230 Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in t CVE-2020-37230High 7.8
  CVE-2020-37230 CVSS:7.8 Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local…
• CVE-2020-37229 OKI sPSV Port Manager 1.0.41 contains an unquoted service path vulnerability in CVE-2020-37229High 7.8
  CVE-2020-37229 CVSS:7.8 OKI sPSV Port Manager 1.0.41 contains an unquoted service path vulnerability in the sPSVOpLclSrv service that allows local attackers to…
• CVE-2026-6381 The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a paramete CVE-2026-6381High 7.5
  CVE-2026-6381 CVSS:7.5 The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated…
• CVE-2018-25329 WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerabili CVE-2018-25329High 7.5
  CVE-2018-25329 CVSS:7.5 WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read…
• CVE-2018-25326 Google Drive for WordPress 2.2 contains a path traversal vulnerability that allo CVE-2018-25326High 7.5
  CVE-2018-25326 CVSS:7.5 Google Drive for WordPress 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by…
• CVE-2018-25325 Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allo CVE-2018-25325High 7.5
  CVE-2018-25325 CVSS:7.5 Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by…
• CVE-2021-47977 WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains CVE-2021-47977High 7.5
  CVE-2021-47977 CVSS:7.5 WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows…
• CVE-2021-47973 Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows CVE-2021-47973High 7.5
  CVE-2021-47973 CVSS:7.5 Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting…
• CVE-2021-47972 Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability th CVE-2021-47972High 7.5
  CVE-2021-47972 CVSS:7.5 Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the application by…
• CVE-2021-47971 My Notes Safe 5.3 contains a denial of service vulnerability that allows attacke CVE-2021-47971High 7.5
  CVE-2021-47971 CVSS:7.5 My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long…
• CVE-2021-47970 Macaron Notes 5.5 contains a denial of service vulnerability that allows attacke CVE-2021-47970High 7.5
  CVE-2021-47970 CVSS:7.5 Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by creating notes with…
• CVE-2021-47969 Color Notes 1.4 contains a denial of service vulnerability that allows attackers CVE-2021-47969High 7.5
  CVE-2021-47969 CVSS:7.5 Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long…
• CVE-2021-47942 Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerabi CVE-2021-47942High 7.5
  CVE-2021-47942 CVSS:7.5 Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read…
• CVE-2020-37245 Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in CVE-2020-37245High 7.5
  CVE-2020-37245 CVSS:7.5 Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access…
• CVE-2026-8785 A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Af CVE-2026-8785High 7.3
  CVE-2026-8785 CVSS:7.3 A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function…
• CVE-2026-8771 A security flaw has been discovered in linlinjava litemall up to 1.8.0. This imp CVE-2026-8771High 7.3
  CVE-2026-8771 CVSS:7.3 A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file…
• CVE-2026-8768 A vulnerability was found in vercel ai up to 3.0.97. The affected element is the CVE-2026-8768High 7.3
  CVE-2026-8768 CVSS:7.3 A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file…
• CVE-2026-8759 A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an un CVE-2026-8759High 7.3
  CVE-2026-8759 CVSS:7.3 A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file…
• CVE-2026-8758 A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This CVE-2026-8758High 7.3
  CVE-2026-8758 CVSS:7.3 A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file…
• CVE-2026-8757 A vulnerability was found in adenhq hive up to 0.11.0. This affects the function CVE-2026-8757High 7.3
  CVE-2026-8757 CVSS:7.3 A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file…
• CVE-2026-8756 A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d CVE-2026-8756High 7.3
  CVE-2026-8756 CVSS:7.3 A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the…
• CVE-2026-8755 A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548d CVE-2026-8755High 7.3
  CVE-2026-8755 CVSS:7.3 A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function…
• CVE-2026-8751 A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the CVE-2026-8751High 7.3
  CVE-2026-8751 CVSS:7.3 A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file…
• CVE-2026-8734 A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this is CVE-2026-8734High 7.3
  CVE-2026-8734 CVSS:7.3 A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable…
• CVE-2026-8725 A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected ele CVE-2026-8725High 7.3
  CVE-2026-8725 CVSS:7.3 A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file…
• CVE-2026-8764 A security vulnerability has been detected in H3C Magic B3 up to 100R002. This a CVE-2026-8764High 7.2
  CVE-2026-8764 CVSS:7.2 A security vulnerability has been detected in H3C Magic B3 up to 100R002. This affects the function UpdateWanParams of the file…
• CVE-2021-47975 WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that CVE-2021-47975High 7.2
  CVE-2021-47975 CVSS:7.2 WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious…
• CVE-2026-6495 The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a CVE-2026-6495High 7.1
  CVE-2026-6495 CVSS:7.1 The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page,…
• CVE-2018-25319 Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that all CVE-2018-25319High 7.1
  CVE-2018-25319 CVSS:7.1 Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database…
• CVE-2021-47980 Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authent CVE-2021-47980High 7.1
  CVE-2021-47980 CVSS:7.1 Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by…

⚔️ Sploitus（85 条）

Unknown (85 条)

• Exploit for CVE-2026-5203 exploit CVE-2026-5203
  Exploit for CVE-2026-5203 exploit
• Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel exploit
  Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel exploit

…另有 83 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-05-19 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV