🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-45695 (Kopia)： 备份工具Kopia的HTTP服务在未设置密码时，攻击者可通过构造恶意的SFTP存储配置，触发SSH ProxyCommand注入，实现远程代码执行（RCE）。利用条件：服务以--without-password参数启动且暴露于网络。
• CVE-2026-46339 (9router)： 路由器软件9router的两个未认证API端点可被组合利用，允许网络邻近的攻击者在无需任何凭据的前提下，以进程权限执行任意操作系统命令，风险极高。
• CVE-2026-42822 (Azure Local)： Microsoft Azure Local在断网操作模式下存在身份验证缺陷（CVSS 10.0），远程攻击者可直接利用该漏洞提升权限，影响Azure本地部署环境的隔离安全边界。
• CVE-2026-45697 (Formie)： Craft CMS的Formie插件中，隐藏字段在未认证情况下允许用户提交经过特殊构造的Twig模板，导致服务端模板注入，可直接造成网站被完全控制。
• 恶意软件供应链攻击： @beproduct/nestjs-auth（npm）及mistralai（PyPI）包被植入恶意代码，前者传播Mini Shai-Hulud后门，后者包含Linux平台执行恶意载荷的dropper。利用条件：开发者无意识安装并导入受污染版本。

📈 威胁趋势

• 远程代码执行（RCE）占比最高： 今日漏洞中超70%为RCE，包括Kopia注入、9router未认证RCE、Dokploy命令注入、WebdriverIO命令注入及多项Python反序列化漏洞（如SGLangs、redshift-driver）。攻击面涵盖备份软件、云服务、AI框架及测试工具。
• 未认证/权限绕过风险突出： 半数以上关键漏洞无需身份验证即可利用（如Azure Local权限提升、MCP Gateway鉴权旁路、Formie模板注入），表明系统默认安全配置缺失或身份验证机制存在设计缺陷。
• 供应链投毒与依赖劫持： 针对npm和PyPI生态的恶意包投递事件仍为高频威胁，攻击者利用令牌泄露或社会工程学手段发布后门版本，可一劳永逸地渗透下游用户。
• 协议及库底层漏洞： 如lwIP SNMP组件堆溢出（CVE-2026-8836）和Amazone Redshift Driver中的eval()不安全调用，表明基础网络协议和驱动库的陈旧代码仍持续暴露严重风险。

🛡️ 缓解建议

• 立即修复与应用加固： 升级Kopia至最新版并强制启用HTTP密码认证；为9router、SGLangs、TinyIce等暴露服务添加网络访问控制或前置反向代理认证；立即停用Dokploy 0.26.6及更早版本。
• 清理并审计依赖项： 检查项目是否使用了@beproduct/nestjs-auth（0.1.2-0.1.19）或mistralai==2.4.6，如存在应立即清除并回滚至官方安全版本，同时轮换所有可能暴露的凭据和密钥。
• 强化默认安全配置： 对于所有公开的API端点，必须启用强身份验证；审查MCP网关及Azure Local的鉴权逻辑，确保签名校验（如PKCS#7）完整执行；禁用不必要的“无密码”或“自定义逻辑处理器”等危险选项。
• 限制高危函数与序列化使用： 在代码中禁用eval()、pickle.loads()及dill.loads()对不可信数据的直接调用；为所有用户输入（包括隐藏字段）实施严格的上下文转义，避免模板引擎与解释器未授权执行。

🐙 GitHub-Advisory（100 条）

Critical (7 条)

• CVE-2026-45695 - Kopia: RCE via SSH ProxyCommand Injection CVE-2026-45695Critical
  ## Summary Kopia's HTTP server, when started with `--without-password `, accepts unauthenticated requests to `/api/v1/repo/exists`. The handler forwards an…
• CVE-2026-46339 - 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin CVE-2026-46339Critical
  ## Summary 9router exposes two unauthenticated API endpoints that, when chained together, allow any network-adjacent attacker to execute arbitrary OS commands…
• GHSA-g53w-w6mj-hrpp - MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated Critical
  ## Summary The MCP router (ext_proc) exposes an `initialize`-method code path that, when a request carries an `mcp-init-host` header, bypasses the gateway JWT…
• CVE-2026-46354 - Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated CVE-2026-46354Critical
  ## Summary `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself.…
• CVE-2026-46412 - Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulu CVE-2026-46412Critical
  ## Summary Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of…
• CVE-2026-45697 - Formie: Pre-authenticated server-side template injection in Hidden fields CVE-2026-45697Critical
  Impact - Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission…
• GHSA-wx9m-wx4f-4cmg - Malicious dropper in mistralai 2.4.6 PyPI package Critical
  The `mistralai` PyPI package version `2.4.6` contains a malicious dropper that executes on import on Linux. No `v2.4.6` tag, commit, or release workflow run…

High (42 条)

• CVE-2026-45327 - TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized st CVE-2026-45327High 3.1
  ## Title Missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection in TinyIce ## Ecosystem / Package - **Ecosystem:** `Go` (or…
• CVE-2026-45713 - Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA an CVE-2026-45713High
  Summary The Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere…
• CVE-2026-45738 - Argo CD: Stored XSS in application link annotations enables developer-to-admin p CVE-2026-45738High
  Summary A user with **application write access (developer role)** can set `link.argocd.argoproj.io/*` annotations on any ArgoCD Application. These annotation…
• CVE-2026-45793 - Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs CVE-2026-45793High
  Summary Composer leaks the full contents of tokens configured as GitHub OAuth tokens if they do not match Composer's expected format for such tokens to stderr.…
• GHSA-hc3c-63hc-2r9f - libcrux: Potential Panic on Overlong Ciphertext Buffer High
  An application that passes in a ciphertext buffer of length greater than `ptxt.len() + TAG_LEN` to `libcrux_chacha20poly1305::encrypt` or…
• GHSA-fhvh-vw7h-9xf3 - libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case High
  The AVX2 implementation of ML-DSA verification incorrectly implemented the `use_hint` function, mishandling an edge case that should lead to signature…
• CVE-2026-46426 - Budibase: Unrestricted Upload of File with Dangerous Type CVE-2026-46426High
  Summary The file upload endpoint `POST /api/attachments/process` does not enforce active-content restrictions for authenticated users. The checks for dangerous…
• CVE-2026-39803 - Bandit: Unauthenticated one-shot DoS via `Transfer-Encoding: chunked` CVE-2026-39803High
  Summary Bandit's HTTP/1 chunked-body reader silently drops the request size cap that the application configures (e.g. `Plug.Parsers`' default 8 MB `length:`)…
• CVE-2026-39806 - Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decode CVE-2026-39806High
  Summary A worker-pinning denial of service in Bandit's HTTP/1 chunked transfer decoder. Any unauthenticated client that sends a `Transfer-Encoding: chunked`…
• CVE-2026-45799 - Wire: skipGroup() missing negative-length check allows 10-byte payload to crash CVE-2026-45799High
  # CVE-2026-45799 ## Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a…
• CVE-2026-45805 - PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — CVE-2026-45805High
  Summary The MCP module's `ReplServer` binds to all interfaces (`0.0.0.0:4403`) and exposes a `/execute` endpoint that runs arbitrary code with zero…
• CVE-2026-45783 - @libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion o CVE-2026-45783High
  Summary An unauthenticated remote peer can exhaust the disk storage of any `@libp2p/kad-dht` node running in server mode by sending an unbounded stream of…
• CVE-2026-46377 - Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in CVE-2026-46377High
  Summary `dasel`'s selector lexer panics with an index-out-of-range error when tokenizing a quoted string that ends with a trailing backslash (e.g., `"\` or…
• CVE-2026-46378 - Dasel: Denial of service in dasel selector lexer due to infinite loop on untermi CVE-2026-46378High
  Summary `dasel`'s selector lexer enters a non-terminating loop when tokenizing an unterminated regex pattern such as `r/abc`. A 2-byte input (`r/`) is…
• CVE-2026-46372 - SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl CVE-2026-46372High
  ## Resolution SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we expect users to use the application in a…
• CVE-2026-46373 - SQLFluff: Recursive Stack Overflow in Parser CVE-2026-46373High
  Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive…
• CVE-2026-46374 - SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser CVE-2026-46374High
  Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using…
• GHSA-7hgr-7h44-33w2 - CamoFox MCP: Unauthenticated HTTP MCP browser-control surface High
  # Unauthenticated HTTP MCP browser-control surface in `camofox-mcp` ## Summary `camofox-mcp` exposed a Streamable HTTP MCP endpoint at `/mcp` with rate…
• CVE-2026-46410 - FileBrowser Quantum: unauthenticated user share share info CVE-2026-46410High
  Impact Some sensitive info -- such as source and path can get exposed. Patches Update to the latest version Workarounds no
• CVE-2026-46415 - Caddy Defender trusted proxy client IP bypass CVE-2026-46415High
  Impact Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to…
• CVE-2026-46417 - @angular/platform-server: SSRF via Hostname Hijacking CVE-2026-46417High
  Impact A Server-Side Request Forgery (SSRF) vulnerability exists in `@angular/platform-server`. The issue stems from how the server-side rendering (SSR) engine…
• CVE-2026-45325 - @tmlmobilidade/utils has prototype pollution in its setValueAtPath CVE-2026-45325High
  Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath(). Patches A fix is available in versions 20260509.0340.15 and up.
• CVE-2026-45363 - ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351 CVE-2026-45363High
  `JWT.decode(token, '', true, algorithm: 'HS256')` accepts an attacker-forged token. `OpenSSL::HMAC.digest('SHA256', '', payload)` returns a valid digest under…
• CVE-2026-8161 - multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exceptio CVE-2026-8161High
  Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a field…
• CVE-2026-8162 - multiparty vulnerable to Denial of Service via Uncaught Exception in filename* p CVE-2026-8162High
  Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a…
• CVE-2026-8159 - multiparty vulnerable to ReDoS via filename parsing CVE-2026-8159High
  Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the `Content-Disposition` filename…
• CVE-2026-45707 - n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials wh CVE-2026-45707High
  ## Summary When `ENABLE_MULTI_TENANT=true`, the HTTP transport documents that the target n8n instance is selected per-request from `x-n8n-url` / `x-n8n-key`…
• CVE-2026-45716 - Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Withou CVE-2026-45716High
  ## Summary The `POST /api/global/users/onboard` endpoint is protected by `workspaceBuilderOrAdmin` middleware, allowing any user with builder permissions to…
• CVE-2026-41567 - Docker: `PUT /containers/{id}/archive` executes container binary on the host CVE-2026-41567High
  ## Summary When a user uploads a compressed archive into a container, a malicious image can execute arbitrary code with daemon (host root) privileges. ##…
• CVE-2026-45727 - CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloaks CVE-2026-45727High
  The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile…
• CVE-2026-42306 - Docker: Race condition in docker cp allows bind mount redirection to host path CVE-2026-42306High
  ## Summary A race condition during `docker cp` mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially…
• CVE-2026-32687 - Postgrex: Channel-name SQL injection in `Postgrex.Notifications.listen/3` CVE-2026-32687High
  Summary SQL injection in `Postgrex.Notifications.listen/3`: the `channel` argument is interpolated straight into `LISTEN "..."` / `UNLISTEN "..."` without…
• CVE-2026-45678 - OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed CVE-2026-45678High
  Summary The Postgres protocol parser assumes `BIND` message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can…
• CVE-2026-32175 - Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability CVE-2026-32175High
  ## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This…
• CVE-2026-42899 - Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vuln CVE-2026-42899High
  ## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This…
• CVE-2026-35433 - Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnera CVE-2026-35433High
  ## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This…
• CVE-2026-45685 - OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire mess CVE-2026-45685High
  Summary Malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the…
• CVE-2026-45686 - OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash CVE-2026-45686High
  Summary A remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing…
• CVE-2026-45553 - NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_te CVE-2026-45553High
  Summary `ui.restructured_text()` renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application…
• CVE-2026-45367 - HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP CVE-2026-45367High
  ## Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions…
• CVE-2026-46520 - ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images CVE-2026-46520High
  When reading multiple images with different dimensions an out of bounds heap write can occur.
• CVE-2026-46522 - ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion CVE-2026-46522High
  Due to a missing check in the MIFF decoder a crafted file could cause an infinite loop resulting in CPU exhaustion.

Medium (43 条)

• CVE-2026-45737 - Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive an CVE-2026-45737Medium
  Summary The original fix for [GHSA-3v3m-wc6v-x4x3](https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3) is incomplete. argocd app diff…
• GHSA-2vx9-7wpg-88jq - n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions Medium
  ## Impact The `ExecuteWorkflow` node's `localFile` source option read workflow files from disk without applying checks enforced by other file-reading nodes. An…
• GHSA-3875-8gcx-7v46 - n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass Medium
  ## Impact The `POST /rest/dynamic-node-parameters/options` endpoint allowed any authenticated user to cause the n8n server to issue HTTP requests including…
• GHSA-4gph-2hhr-5mwg - Envoy AI Proxy - MCP Message Smuggling Vulnerability Medium
  Envoy AI Gateway was found to be affected by a protocol parser differential vulnerability due to improper implementation of the JSON-RPC 2.0 specification.…
• CVE-2026-45740 - protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion CVE-2026-45740Medium
  ## Summary protobufjs could recurse without a depth limit while expanding nested JSON descriptors through `Root.fromJSON()` and `Namespace.addJSON()`. A…
• CVE-2026-46337 - AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/ima CVE-2026-46337Medium
  Summary The endpoint requires **no authentication**. An unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can…
• CVE-2026-46424 - Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revo CVE-2026-46424Medium
  ## Summary The public API role unassignment endpoint (`POST /api/public/v1/roles/unassign`) updates user documents in CouchDB but does not invalidate the…
• CVE-2026-46341 - Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apif CVE-2026-46341Medium
  Summary The `fetch-apify-docs` tool validates URLs against a domain allowlist using `String.startsWith()` instead of proper URL hostname comparison. This…

…另有 35 条 Medium 级漏洞（已省略）

Low (8 条)

• CVE-2026-45739 - Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs CVE-2026-45739Low
  ## Summary Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a…
• CVE-2026-45803 - GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape se CVE-2026-45803Low
  Summary A security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow…
• CVE-2026-45772 - Turbo: Unexpected local code execution during Yarn Berry detection CVE-2026-45772Low
  Impact Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain malicious Yarn configuration. In affected…

…另有 5 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（40 条）

Critical (10 条)

• CVE-2026-42822 Improper authentication in Azure Local Disconnected Operations allows an unautho CVE-2026-42822Critical 10.0
  CVE-2026-42822 CVSS:10.0 Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.…
• CVE-2026-27130 Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 a CVE-2026-27130Critical 9.9
  CVE-2026-27130 CVSS:9.9 Dokploy is a free, self-hostable Platform as a Service (PaaS). Versions 0.26.6 and below have OS command injection through the appName…
• CVE-2026-8838 Unsafe use of Python's eval() on server-received data in the vector_in() functio CVE-2026-8838Critical 9.8
  CVE-2026-8838 CVSS:9.8 Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows…
• CVE-2026-25244 WebdriverIO is a test automation framework for unit, e2e and component testing u CVE-2026-25244Critical 9.8
  CVE-2026-25244 CVSS:9.8 WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions…
• CVE-2026-8836 A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_par CVE-2026-8836Critical 9.8
  CVE-2026-8836 CVSS:9.8 A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of…
• CVE-2026-7304 SGLangs multimodal generation runtime is vulnerable to unauthenticated remote co CVE-2026-7304Critical 9.8
  CVE-2026-7304 CVSS:9.8 SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor…
• CVE-2026-7301 SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 CVE-2026-7301Critical 9.8
  CVE-2026-7301 CVSS:9.8 SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls…
• CVE-2026-45230 DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /a CVE-2026-45230Critical 9.1
  CVE-2026-45230 CVSS:9.1 DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array…
• CVE-2023-24215 Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware CVE-2023-24215Critical 9.1
  CVE-2023-24215 CVSS:9.1 Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain…
• CVE-2026-7302 SGLangs multimodal generation runtime is vulnerable to an unauthenticated path t CVE-2026-7302Critical 9.1
  CVE-2026-7302 CVSS:9.1 SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write…

High (30 条)

• CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability CVE-2026-45495High 8.8
  CVE-2026-45495 CVSS:8.8 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 产品: microsoft edge_chromium
• CVE-2026-41085 Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalat CVE-2026-41085High 8.8
  CVE-2026-41085 CVSS:8.8 Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user…
• CVE-2025-57282 ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. CVE-2025-57282High 8.8
  CVE-2025-57282 CVSS:8.8 ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. 产品:
• CVE-2026-7498 Improper neutralization of input during web page generation ('cross-site scripti CVE-2026-7498High 8.8
  CVE-2026-7498 CVSS:8.8 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Information Technology…
• CVE-2026-3220 The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin CVE-2026-3220High 8.8
  CVE-2026-3220 CVSS:8.8 The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before…
• CVE-2026-8776 A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affe CVE-2026-8776High 8.8
  CVE-2026-8776 CVSS:8.8 A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file…
• CVE-2026-8775 A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2 CVE-2026-8775High 8.8
  CVE-2026-8775 CVSS:8.8 A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the…
• CVE-2026-6346 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail CVE-2026-6346High 8.7
  CVE-2026-6346 CVSS:8.7 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before…
• CVE-2026-6379 The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly san CVE-2026-6379High 8.6
  CVE-2026-6379 CVSS:8.6 The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL…
• CVE-2026-22810 Joplin is an open source note-taking and to-do application that organises notes CVE-2026-22810High 8.2
  CVE-2026-22810 CVSS:8.2 Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7…
• CVE-2026-8851 SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Acc CVE-2026-8851High 8.1
  CVE-2026-8851 CVSS:8.1 SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows…
• CVE-2026-47092 Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injecti CVE-2026-47092High 7.8
  CVE-2026-47092 CVSS:7.8 Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute…
• CVE-2026-41948 Dify version 1.14.1 and prior contain a path traversal vulnerability that allows CVE-2026-41948High 7.7
  CVE-2026-41948 CVSS:7.7 Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated users to manipulate requests forwarded…
• CVE-2026-6347 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail CVE-2026-6347High 7.6
  CVE-2026-6347 CVSS:7.6 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the…
• CVE-2026-29963 HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper val CVE-2026-29963High 7.5
  CVE-2026-29963 CVSS:7.5 HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php…
• CVE-2026-29962 HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability c CVE-2026-29962High 7.5
  CVE-2026-29962 CVSS:7.5 HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths.…
• CVE-2025-56352 In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the br CVE-2025-56352High 7.5
  CVE-2025-56352 CVSS:7.5 In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations during CONNECT…
• CVE-2026-39079 An issue in prestashop upsshipping all versions through at least 2.4.0 allows a CVE-2026-39079High 7.5
  CVE-2026-39079 CVSS:7.5 An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the…
• CVE-2026-42009 A flaw was found in gnutls. A remote attacker could exploit an issue in the Data CVE-2026-42009High 7.5
  CVE-2026-42009 CVSS:7.5 A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering…
• CVE-2026-6381 The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a paramete CVE-2026-6381High 7.5
  CVE-2026-6381 CVSS:7.5 The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated…
• CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature CVE-2026-45245High 7.4
  CVE-2026-45245 CVSS:7.4 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic…
• CVE-2026-41947 Dify version 1.14.1 and prior contains an authorization bypass vulnerability tha CVE-2026-41947High 7.4
  CVE-2026-41947 CVSS:7.4 Dify version 1.14.1 and prior contains an authorization bypass vulnerability that allows authenticated editor users to set and enable…
• CVE-2026-26462 Offline Hospital Management System 5.3.0 allows remote code execution due to an CVE-2026-26462High 7.3
  CVE-2026-26462 CVSS:7.3 Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The…
• CVE-2026-8788 Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. T CVE-2026-8788High 7.3
  CVE-2026-8788 CVSS:7.3 Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were not checked for…
• CVE-2026-8785 A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Af CVE-2026-8785High 7.3
  CVE-2026-8785 CVSS:7.3 A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function…
• CVE-2026-8771 A security flaw has been discovered in linlinjava litemall up to 1.8.0. This imp CVE-2026-8771High 7.3
  CVE-2026-8771 CVSS:7.3 A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file…
• CVE-2026-27891 FacturaScripts is an open source accounting and invoicing software. Versions 202 CVE-2026-27891High 7.2
  CVE-2026-27891 CVSS:7.2 FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the…
• CVE-2026-45242 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/sum CVE-2026-45242High 7.1
  CVE-2026-45242 CVSS:7.1 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated…
• CVE-2026-6495 The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a CVE-2026-6495High 7.1
  CVE-2026-6495 CVSS:7.1 The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page,…
• CVE-2026-4137 In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` fun CVE-2026-4137High 7.0
  CVE-2026-4137 CVSS:7.0 In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary…

⚔️ Sploitus（60 条）

Unknown (60 条)

• eip-search exploit
  eip-search exploit
• eip-mcp exploit
  eip-mcp exploit

…另有 58 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-05-20 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV