🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-47668 / DbGate (Critical)： 未认证远程代码执行。攻击者无需凭证即可通过 /runners/start 接口的 functionName 参数注入恶意代码，直接控制服务器。
• CVE-2026-47669 / DbGate (Critical)： Zip Slip 任意文件写入。利用恶意 ZIP 包中的 ../ 路径遍历，攻击者可覆盖系统关键文件，进而实现远程代码执行。
• CVE-2026-4104 / TeknoPass (CVSS 9.8)： SQL注入漏洞。攻击者可通过用户可控的SQL主键绕过授权，实现数据泄露或进一步渗透。
• CVE-2026-41283 / OpenStack Mistral (CVSS 9.9)： 任意远程代码执行。暴露的API端点允许攻击者执行代码，窃取服务凭证，威胁云基础设施安全。

📈 威胁趋势

• 远程代码执行 (RCE)： 威胁最严重。DbGate 系列漏洞 (CVE-2026-47668/670) 及 OpenStack Mistral 均允许“无/低权限”执行任意命令，攻击面广，危害极高。
• 权限提升与绕过： Shopper 组件 (CVE-2026-47744) 与 Acer 设备固件 (CVE-2026-50211) 暴露了严重的授权缺陷，可导致攻击者获取管理员或更高权限。
• 信息泄露与注入： 攻击者利用 SQL注入 (CVE-2026-4104)、路径遍历 (CVE-2026-47731) 或硬编码密钥 (CVE-2026-49191) 窃取敏感数据，为后续攻击铺路。
• 历史漏洞复燃： 今日披露大量 2019 年的高危漏洞（如 MobaXterm、WordPress插件），表明大量老旧系统仍未修复，成为攻击者的“活靶子”。

🛡️ 缓解建议

• 立即封禁/升级 DbGate： 针对 CVE-2026-47668/669/670，应立即禁用 /runners/start 和 /runners/load-reader 接口，或升级至官方已修复版本。
• 加固关键云平台： 检查 OpenStack Mistral (CVE-2026-41283) 的API是否对外暴露，并确保已应用最新安全更新；立即审查并轮换所有服务凭证。
• 排查与修复历史遗留漏洞： 针对MobaXterm、WordPress插件等2019年老漏洞，应立即扫描内部资产并进行版本升级或停用，避免被重新利用。
• 强化输入验证： 对所有基于用户输入的路径、SQL查询和代码参数实施严格的过滤与白名单机制，防止 SQL注入及路径遍历攻击。

🚨 CISA-KEV（1 条）

Unknown (1 条)

• CVE-2026-28318 - SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability CVE-2026-28318
  CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability 产品: SolarWinds Serv-U 描述: SolarWinds Serv-U contains an uncontrolled resource…

💣 Exploit-DB-RSS（1 条）

Unknown (1 条)

• [webapps] WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection
  # Exploit Title: WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection # Google Dork: N/A # Date: 2026-06-02 # Exploit Author: cardosource #…

🐙 GitHub-Advisory（90 条）

Critical (6 条)

• CVE-2026-47668 - DbGate: Unauthenticated Remote Code Execution via JSON Script Runner CVE-2026-47668Critical
  Summary DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script…
• CVE-2026-47669 - DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE CVE-2026-47669Critical
  The `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output…
• CVE-2026-47670 - Authenticated Remote Code Execution via loadReader functionName code injection i CVE-2026-47670Critical
  Summary DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by…
• CVE-2026-47731 - NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append CVE-2026-47731Critical
  ## 1. Summary The Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating packet capture “handlers.” Because the…
• CVE-2026-47744 - Shopper: Authorization bypass and RBAC privilege escalation in team settings CVE-2026-47744Critical
  ## Impact Two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system: - `Settings/Team/Index`…
• GHSA-8whc-2wmv-ww35 - WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Meta Critical
  # Unauthenticated Stored DOM XSS via `page_title` Broadcast in AVideo YPTSocket Plugin ## Summary A stored DOM Cross-Site Scripting vulnerability (CWE-79) in…

High (29 条)

• CVE-2026-45726 - Omni: Reader-level users can retrieve imported cluster CA keys via ResourceServi CVE-2026-45726High
  ## Summary Omni supports importing standalone Talos clusters. During this process, an ImportedClusterSecrets resource is created, which contains the full CA…
• CVE-2026-47249 - Klever-Go KVM: Hash-array amplification in P2P resolver request handling CVE-2026-47249High
  Summary A connected peer can send a compressed `RequestDataType_HashArrayType` direct request that is only `442` bytes on the wire but expands into `200000`…
• CVE-2026-47261 - wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restric CVE-2026-47261High
  ## Summary In `wasmtime-wasi`, when a filesystem preopen is given `DirPerms::all()` and `FilePerms::READ` without `FilePerms::WRITE`, this wasmtime-wasi…
• CVE-2026-47383 - NocoDB: Stored Cross-Site Scripting via Row Comments CVE-2026-47383High
  Summary An authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form…
• CVE-2026-47387 - NocoDB: Stored Cross-Site Scripting via Form View Redirect URL CVE-2026-47387High
  Summary The shared form-view submit handler in NocoDB writes the form's `redirect_url` to `window.location.href` after a same-host check that does not validate…
• CVE-2026-47419 - praisonai-platform: Agent endpoints accept any agent_id without workspace owners CVE-2026-47419High
  ## Summary **Type:** Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate…
• CVE-2026-47684 - Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpP CVE-2026-47684High
  Summary: The private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF…
• CVE-2026-48017 - DbGate: Remote Code Execution via functionName injection in loadReader endpoint CVE-2026-48017High
  Summary The `POST /runners/load-reader` endpoint in DbGate accepts a `functionName` parameter that is directly interpolated into a JavaScript code template…
• GHSA-hf2g-6j7h-98wg - klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driv High
  Summary `networkMessenger.directMessageHandler` in `network/p2p/libp2p/netMessenger.go` spawns a fresh goroutine for every incoming direct message before the…
• GHSA-w4c6-7r69-w7j9 - klever-go: REST API slow-header connection exhaustion via Gin Engine.Run High
  Summary The Klever seednode REST API starts a Gin engine with `Engine.Run(restAPIInterface)`. In Gin v1.9.1, `Engine.Run` calls Go's default…
• GHSA-rm5c-5x2p-48wr - Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go CVE-2026-46403CVE-2026-44697High
  ## Summary Every transaction gossiped on the klever-go P2P network is decoded and validated synchronously inside the libp2p pubsub topic-validator callback.…
• GHSA-wx3m-whqv-xv47 - skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file dis High
  ## Impact `skillctl` 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attacker to: 1. **Exfiltrate arbitrary files…
• CVE-2026-47760 - TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass throu CVE-2026-47760High
  Impact TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested <svg>…
• CVE-2026-47759 - TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixe CVE-2026-47759High
  Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious…
• CVE-2026-47762 - TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comment CVE-2026-47762High
  Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is…
• CVE-2026-47761 - TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-ob CVE-2026-47761High
  Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted `data-mce-*` attributes, which are executed when…
• CVE-2026-47743 - Shopper: Multiple data integrity and disclosure issues in admin Livewire compone CVE-2026-47743High
  ## Impact Three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS: - **IDOR via unlocked…
• CVE-2026-24425 - Twig: Possible sandbox bypass when using a source policy CVE-2026-24425High
  # Description When using the sandbox with a `SourcePolicyInterface`, Twig does not always apply the sandbox restriction that forbids non-`Closure` callbacks…
• CVE-2026-47732 - Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coer CVE-2026-47732High
  Description `SandboxNodeVisitor` enforces `SecurityPolicy::checkMethodAllowed()` for implicit `__toString()` calls by wrapping selected AST nodes in…
• CVE-2026-44486 - Axios: Proxy-Authorization header leaks to redirect target when proxy is re-eval CVE-2026-44486High
  Summary Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated…
• CVE-2026-44487 - Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS CVE-2026-44487High
  ## Summary Axios’s Node.js HTTP adapter may forward a `Proxy-Authorization` header to a redirected origin during specific proxy-to-direct redirect flows. This…
• CVE-2026-44488 - Allocation of Resources Without Limits or Throttling in Axios CVE-2026-44488High
  ## Summary Axios versions `1.7.0` through `1.15.x` did not enforce configured request and response size limits when requests were sent with the `fetch`…
• CVE-2026-44496 - Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVE-2026-44496High
  ## Summary Axios versions before `0.32.0` on the `0.x` line and before `1.16.0` on the `1.x` line build a regular expression from the configured XSRF cookie…
• CVE-2026-45337 - Better Auth: Device authorization approve and deny accept any authenticated sess CVE-2026-45337High
  Am I affected? You are affected if all of the following are true: - You use `better-auth` at a version `>= 1.6.0, < 1.6.11`. - The `deviceAuthorization` plugin…
• CVE-2026-45730 - Nuclio: Missing authorization on project write paths allows any authenticated us CVE-2026-45730High
  This vulnerability exists in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass…
• CVE-2026-34077 - React Router vulnerable to Denial of Service via reflected user input in single CVE-2026-34077High
  A DoS vulnerability exists in the React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework), as well as Remix v2.9.0+ with [Single…
• GHSA-74m6-4hjp-7226 - Klever-Go P2P MultiDataInterceptor leaks global throttler slots on malformed com High
  ## Publisher note **Fixed in `v1.7.17`.** Operators running `< v1.7.17` should upgrade. The decompression-error path in…
• CVE-2026-47696 - WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment e CVE-2026-47696High
  Summary `plugin/AuthorizeNet/processPayment.json.php` credits the logged-in user's wallet based only on the attacker-controlled `amount` POST parameter. The…
• CVE-2026-49279 - WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket CVE-2026-49279High
  # AVideo: Stored XSS via `autoEvalCodeOnHTML` in MessageSQLite WebSocket Handler ## Summary AVideo has a stored XSS vulnerability in the WebSocket messaging…

Medium (48 条)

• CVE-2026-47250 - MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer CVE-2026-47250Medium
  Summary The `kubectl_generic` tool in `mcp-server-kubernetes` passes user-supplied flags directly to kubectl without any allowlist, enabling a **privilege…
• CVE-2026-47279 - NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints CVE-2026-47279Medium
  Summary The public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so…
• CVE-2026-47375 - NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` CVE-2026-47375Medium
  Summary An authenticated user with `columnAdd` permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional…
• CVE-2026-47376 - NocoDB: Reflected Cross-Site Scripting via Password Reset Token CVE-2026-47376Medium
  Summary The password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS `<%= %>`…
• CVE-2026-47377 - NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin CVE-2026-47377Medium
  Summary The client-side `hashRedirect` plugin called `window.location.replace()` on a path extracted from the URL hash fragment after only checking…
• CVE-2026-47378 - NocoDB: Hidden Column Exposure in Public Shared View Endpoints CVE-2026-47378Medium
  Summary Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for…
• CVE-2026-47379 - NocoDB: Plaintext Password Comparison in Shared Views CVE-2026-47379Medium
  Summary The shared-view password check fell back to strict-equality (`===`) comparison for legacy plaintext passwords, leaking the password's length and…
• CVE-2026-47381 - NocoDB: Cross-Workspace Integration Use in Connection Test CVE-2026-47381Medium
  Summary A user in one workspace could exercise another workspace's integration through the `testConnection` endpoint by supplying its ID, because the…

…另有 40 条 Medium 级漏洞（已省略）

Low (7 条)

• CVE-2026-47380 - NocoDB: User Enumeration via Sign-In Timing CVE-2026-47380Low
  Summary Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash…
• CVE-2026-47388 - NocoDB: Missing Ownership Check in MCP Attachment Read CVE-2026-47388Low
  Summary A low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other…
• CVE-2026-47715 - Bugsink: Issue event views can show an event from another project if its UUID is CVE-2026-47715Low
  Description Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to…

…另有 4 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（48 条）

Critical (13 条)

• CVE-2026-41283 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the CVE-2026-41283Critical 9.9
  CVE-2026-41283 CVSS:9.9 OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code…
• CVE-2019-25741 Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buff CVE-2019-25741Critical 9.8
  CVE-2019-25741 CVSS:9.8 Mobatek MobaXterm 12.1 contains a structured exception handling (SEH) based buffer overflow vulnerability in the username field of…
• CVE-2019-25738 WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vuln CVE-2019-25738Critical 9.8
  CVE-2019-25738 CVSS:9.8 WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to…
• CVE-2019-25729 PDF Signer 3.0 contains a server-side template injection vulnerability that allo CVE-2019-25729Critical 9.8
  CVE-2019-25729 CVSS:9.8 PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code…
• CVE-2019-25727 WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulner CVE-2019-25727Critical 9.8
  CVE-2019-25727 CVSS:9.8 WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to…
• CVE-2026-4104 Authorization bypass through User-Controlled SQL primary key vulnerability in Ak CVE-2026-4104Critical 9.8
  CVE-2026-4104 CVSS:9.8 Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co.…
• CVE-2026-50211 Leftover engineering diagnostics and factory-level diagnostic software remain ex CVE-2026-50211Critical 9.8
  CVE-2026-50211 CVSS:9.8 Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write…
• CVE-2026-49191 The production build of the M3WebServer hard-codes its backend API keys, which c CVE-2026-49191Critical 9.8
  CVE-2026-49191 CVSS:9.8 The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling…
• CVE-2026-49188 The ai_cmd utility executes with full root permissions. It pipes socket inputs d CVE-2026-49188Critical 9.8
  CVE-2026-49188 CVSS:9.8 The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated…
• CVE-2026-49186 The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). CVE-2026-49186Critical 9.8
  CVE-2026-49186 CVSS:9.8 The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard…
• CVE-2026-49185 The FieldX MDM adb messaging topic passes unverified payloads directly into Runt CVE-2026-49185Critical 9.8
  CVE-2026-49185 CVSS:9.8 The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection. 产品:…
• CVE-2026-10840 A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-roleb CVE-2026-10840Critical 9.6
  CVE-2026-10840 CVSS:9.6 A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the…
• CVE-2026-50208 High-risk TrustAllCerts routines disable standard TLS certificate validation. Co CVE-2026-50208Critical 9.4
  CVE-2026-50208 CVSS:9.4 High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a…

High (35 条)

• CVE-2026-49194 The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standa CVE-2026-49194High 8.8
  CVE-2026-49194 CVSS:8.8 The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an…
• CVE-2026-49190 The system fails to evaluate instructional permissions over multiple internal op CVE-2026-49190High 8.8
  CVE-2026-49190 CVSS:8.8 The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized…
• CVE-2026-41860 CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redir CVE-2026-41860High 8.8
  CVE-2026-41860 CVSS:8.8 CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM.…
• CVE-2026-49202 Internal multimedia session archives are accessible without authentication, exac CVE-2026-49202High 8.6
  CVE-2026-49202 CVSS:8.6 Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS)…
• CVE-2019-25736 LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows CVE-2019-25736High 8.4
  CVE-2019-25736 CVSS:8.4 LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying…
• CVE-2019-25735 AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling tha CVE-2019-25735High 8.4
  CVE-2019-25735 CVSS:8.4 AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers to overwrite structured exception…
• CVE-2019-25733 NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow CVE-2019-25733High 8.4
  CVE-2019-25733 CVSS:8.4 NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute…
• CVE-2026-49203 Crucial management API endpoints for cellular eSIM allocation do not validate ca CVE-2026-49203High 8.3
  CVE-2026-49203 CVSS:8.3 Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be…
• CVE-2019-25745 WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL inject CVE-2019-25745High 8.2
  CVE-2019-25745 CVSS:8.2 WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers…
• CVE-2019-25732 PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthe CVE-2019-25732High 8.2
  CVE-2019-25732 CVSS:8.2 PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by…
• CVE-2019-25730 Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthent CVE-2019-25730High 8.2
  CVE-2019-25730 CVSS:8.2 Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by…
• CVE-2019-25728 Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenti CVE-2019-25728High 8.2
  CVE-2019-25728 CVSS:8.2 Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by…
• CVE-2019-25726 All in One Video Downloader 1.2 contains an SQL injection vulnerability that all CVE-2019-25726High 8.2
  CVE-2019-25726 CVSS:8.2 All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL…
• CVE-2026-50205 System log files output unencrypted SMTP server authentication passwords alongsi CVE-2026-50205High 8.2
  CVE-2026-50205 CVSS:8.2 System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.…
• CVE-2026-41010 ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job CVE-2026-41010High 8.2
  CVE-2026-41010 CVSS:8.2 ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz")…
• CVE-2026-41011 PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join CVE-2026-41011High 8.2
  CVE-2026-41011 CVSS:8.2 PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name =…
• CVE-2025-59874 HCL Hive Telco Observability is affected by  a Required directives missing from CVE-2025-59874High 8.1
  CVE-2025-59874 CVSS:8.1 HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the…
• CVE-2026-50209 Broadcast events allow malicious software to rewrite the device's default Mobile CVE-2026-50209High 7.8
  CVE-2026-50209 CVSS:7.8 Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint address, shifting…
• CVE-2026-50207 The system Binder boundary accepts unverified pass-through AT commands, giving l CVE-2026-50207High 7.8
  CVE-2026-50207 CVSS:7.8 The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or…
• CVE-2026-49189 Unchecked public access permissions on a core Broadcast Receiver allow unauthori CVE-2026-49189High 7.8
  CVE-2026-49189 CVSS:7.8 Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative…
• CVE-2026-41859 A network man-in-the-middle between nats-sync and the BOSH director can steal th CVE-2026-41859High 7.8
  CVE-2026-41859 CVSS:7.8 A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client…
• CVE-2026-49771 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti CVE-2026-49771High 7.6
  CVE-2026-49771 CVSS:7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web…
• CVE-2025-46638 Dell BSAFE SSL-J contains an allocation of resources without limits or throttlin CVE-2025-46638High 7.5
  CVE-2025-46638 CVSS:7.5 Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An unauthenticated remote attacker…
• CVE-2026-50213 The account validation endpoint /v1/User/validate returns comprehensive user pro CVE-2026-50213High 7.5
  CVE-2026-50213 CVSS:7.5 The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating…
• CVE-2026-50210 The device encrypts data using AES-CBC with static zero-filled Initialization Ve CVE-2026-50210High 7.5
  CVE-2026-50210 CVSS:7.5 The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks…
• CVE-2026-49193 Overly permissive configuration settings on cloud storage containers expose acti CVE-2026-49193High 7.5
  CVE-2026-49193 CVSS:7.5 Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet. 产品:…
• CVE-2026-49187 The hard-coded APK resource files never expire, and the shared scepter leads to CVE-2026-49187High 7.5
  CVE-2026-49187 CVSS:7.5 The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse. 产品: acer…
• CVE-2026-8829 HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_e CVE-2026-8829High 7.5
  CVE-2026-8829 CVSS:7.5 HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing…
• CVE-2026-41858 Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPasswo CVE-2026-41858High 7.5
  CVE-2026-41858 CVSS:7.5 Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows…
• CVE-2026-10737 The SP Project & Document Manager plugin for WordPress is vulnerable to unauthor CVE-2026-10737High 7.5
  CVE-2026-10737 CVSS:7.5 The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the…
• CVE-2019-25737 Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability t CVE-2019-25737High 7.2
  CVE-2019-25737 CVSS:7.2 Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject…
• CVE-2019-25731 Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allo CVE-2019-25731High 7.2
  CVE-2019-25731 CVSS:7.2 Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious…
• CVE-2026-10843 A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM polici CVE-2026-10843High 7.2
  CVE-2026-10843 CVSS:7.2 A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with…
• CVE-2026-3820 There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-21 CVE-2026-3820High 7.2
  CVE-2026-3820 CVSS:7.2 There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator…
• CVE-2025-52612 HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vul CVE-2025-52612High 7.1
  CVE-2025-52612 CVSS:7.1 HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting…

⚔️ Sploitus（60 条）

Unknown (60 条)

• Exploit for Deserialization of Untrusted Data in Facebook React exploit
  Exploit for Deserialization of Untrusted Data in Facebook React exploit
• Exploit for CVE-2024-34070 exploit CVE-2024-34070
  Exploit for CVE-2024-34070 exploit

…另有 58 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-06 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV