🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-44748 (CVSS 9.9) - SAP NetWeaver ABAP/ABAP平台： 认证用户可绕过签名验证，发送恶意XML导致远程代码执行。利用条件：需拥有正常用户权限，但无需高权限。
• CVE-2026-27671 (CVSS 9.8) - SAP NetWeaver ABAP/ABAP平台： 未认证攻击者可通过伪造RFC协议请求，无需任何凭证即可远程执行代码。利用条件：网络可达，复杂度低。
• CVE-2026-48039 - Meta Ads MCP (Critical)： 未认证HTTP工具执行漏洞，可导致Operator Meta访问令牌泄露。利用条件：可访问服务的网络路径。
• CVE-2026-48062 - CodeIgniter4 (Critical)： 文件上传验证绕过，可上传恶意PHP文件（如shell.php）并执行。利用条件：攻击者可上传文件至受影响站点。
• CVE-2025-6254 (CVSS 9.8) - WordPress Doctreat Core插件： 权限提升漏洞，允许未经授权用户注册为管理员。利用条件：任何能访问WordPress注册页面的人。

📈 威胁趋势

• 远程代码执行 (RCE) / 命令注入： 今日最突出，包括SAP NetWeaver (CVE-2026-44748, CVE-2026-27671)、CodeIgniter4文件上传 (CVE-2026-48062) 及多个Chrome沙箱逃逸漏洞 (CVE-2026-11651等)。
• 权限提升： WordPress Doctreat Core插件 (CVE-2025-6254) 允许低权限用户直接升为管理员，威胁极高。
• 信息泄露： Meta Ads MCP (CVE-2026-48039) 泄露敏感访问令牌；Element Call (CVE-2026-48007) 泄露用户完整浏览URL至分析服务器。
• 认证/授权绕过： Traefik (CVE-2026-48020) 利用路径规范化可绕过路由级认证；Go REST API模板 (CVE-2026-48031) 存在硬编码JWT密钥。
• 内存破坏: Google Chrome (CVE-2026-11671等) 利用后释放、整数溢出漏洞威胁明显，可导致沙箱逃逸。

🛡️ 缓解建议

• SAP系统紧急修补： 立即检查并应用SAP NetWeaver及ABAP平台的安全补丁，针对CVE-2026-44748与CVE-2026-27671进行修复，限制RFC接口的访问。
• 更新Web应用与组件： 将CodeIgniter4框架升级至最新版以修复文件上传绕过；更新WordPress Doctreat Core插件至1.6.9以上版本；升级Go REST API模板项目以替换硬编码密钥。
• 立即升级浏览器： 确认所有用户使用的Google Chrome浏览器版本升级至149.0.7827.103或更高，以修复多个严重的沙箱逃逸漏洞。
• 加强服务配置与监控： 检查Traefix反向代理配置，避免在StripPrefix中间件后直接暴露私有路由；审计Element Call和Meta Ads MCP的数据发送配置，避免敏感信息外泄。

🚨 CISA-KEV（1 条）

Unknown (1 条)

• CVE-2026-10520 - Ivanti Sentry OS Command Injection Vulnerability CVE-2026-10520
  CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability 产品: Ivanti Sentry 描述: Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS…

🐙 GitHub-Advisory（56 条）

Critical (4 条)

• CVE-2026-48039 - Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access CVE-2026-48039Critical 3.1
  # Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository |…
• CVE-2026-48062 - CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` CVE-2026-48062Critical
  Impact The `ext_in` upload validation rule checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an…
• CVE-2026-48031 - Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery CVE-2026-48031Critical
  ## Vulnerability: CWE-798 — Hardcoded JWT Secret + Broken Mitigation Affected Component - `github.com/dhax/go-base` — Go REST API boilerplate…
• CVE-2026-48063 - Baileys has message upsert / hist sync spoofing and app state corruption when us CVE-2026-48063Critical
  Impact Any baileys session under the latest version (< 7.0.0-rc12, and < 6.7.22) can be sent a malicious payload via the placeholderResendMessage and trigger a…

High (26 条)

• CVE-2026-47781 - PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing CVE-2026-47781High
  ## Summary PDM automatically loads project-local plugin paths from `.pdm-plugins` during `Core` initialization. Because this path is added via…
• CVE-2026-48006 - Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggr CVE-2026-48006High
  Impact The RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate…
• CVE-2026-48007 - Element Call reports full URLs of visited pages to analytics server CVE-2026-48007High
  Impact Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the…
• CVE-2026-48020 - Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization CVE-2026-48020High
  ## Summary There is a high severity vulnerability in Traefik's `StripPrefix` middleware that allows an unauthenticated attacker to bypass route-level…
• CVE-2026-48054 - OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundr CVE-2026-48054High
  ## Summary The OpenZeppelin Contracts Wizard generated Hardhat (`test/test.ts`) and Foundry (`test/<Name>.t.sol`) example test files that interpolated…
• CVE-2026-48069 - @grpc/grpc-js: An incoming malformed compressed message can cause a client or se CVE-2026-48069High
  Impact An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js…
• CVE-2026-48068 - @grpc/grpc-js: A malformed request can cause a server crash CVE-2026-48068High
  Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. Patches The…
• CVE-2026-48050 - Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and CVE-2026-48050High
  Summary Arc registers Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/api/server.go`, and `/debug/pprof` is added to…
• CVE-2026-48059 - Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Lea CVE-2026-48059High
  Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing…
• CVE-2026-48089 - DevGuard has improper authorization on public assets CVE-2026-48089High
  Impact On a DevGuard API instance with one or more **public assets**, any authenticated user — including users from a different organization with no membership…
• CVE-2026-48099 - WsgiDAV encoded dot segments can escape filesystem share roots CVE-2026-48099High
  Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a…
• CVE-2026-11401 - AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance CVE-2026-11401High
  Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. An issue in Aurora PostgreSQL using the AWS Go Wrapper waa…
• CVE-2026-48110 - Russh SSH message fields were decoded through allocation-first parsers before fi CVE-2026-48110High
  # SSH message fields were decoded through allocation-first parsers before field-specific bounds Summary Several `russh` client and server message handlers…
• CVE-2025-27511 - GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection CVE-2025-27511High
  ## Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE). ## Impact If GeoServer has DB2…
• CVE-2026-48109 - MessagePack's LZ4 decompression may fail with AccessViolationException after de CVE-2026-48109High
  Impact A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes `Lz4Block` and `Lz4BlockArray`. The decoder…
• CVE-2026-48032 - @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple O CVE-2026-48032High
  **Affected:** `@hulumi/policies` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-697 (Incorrect Comparison)** #### Summary AWS IAM trust…
• CVE-2026-48033 - @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name CVE-2026-48033High
  **Affected:** `@hulumi/policies` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-693 (Protection Mechanism Failure)** #### Summary Pulumi gives…
• CVE-2026-48034 - @hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a CVE-2026-48034High
  **Affected:** `@hulumi/policies` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-284 (Improper Access Control)** #### Summary HULUMI-H1 forbids…
• CVE-2026-48035 - @hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently w CVE-2026-48035High
  **Affected:** `@hulumi/baseline` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-1059 (Insufficient Technical Documentation / Behavioral…
• CVE-2026-48036 - @hulumi/drift: Drift classifier fails open on adapter errors and over-promotes M CVE-2026-48036High
  **Affected:** `@hulumi/drift` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-755 (Improper Handling of Exceptional Conditions)** #### Summary…
• CVE-2026-49396 - Nezha has cross-site GET request that can trigger stored cron commands on a vict CVE-2026-49396High
  Summary The dashboard exposes the cron manual-trigger action as an authenticated `GET /api/v1/cron/:id/manual` endpoint. Dashboard JWTs are sent in the…
• CVE-2025-53114 - Acknowledgement extension out of memory CVE-2025-53114High
  Impact Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to…
• CVE-2026-47253 - Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Dir CVE-2026-47253High
  # Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion | Field | Value | | ---------------- | ----- | | Repository |…
• CVE-2026-47701 - OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arb CVE-2026-47701High
  ## Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator (TargetAllocator) Companion: Prometheus Operator API…
• CVE-2026-48060 - Litestar has HTML Injection Through its CSRF Token CVE-2026-48060High
  # Overview Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross…
• CVE-2026-47764 - PDM wheel installation leads to Path Traversal via overridden write_to_fs CVE-2026-47764High
  InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe…

Medium (25 条)

• CVE-2026-49397 - Nezha's private services (`EnableShowInService: false`) are enumerable via per-s CVE-2026-49397Medium 3.1
  # Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data **CWE**: CWE-285 (Improper…
• CVE-2026-49214 - guzzlehttp/psr7 has CRLF Injection via URI Host Component CVE-2026-49214Medium
  ## Impact `guzzlehttp/psr7` did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. The issue requires a PSR-7 request…
• CVE-2026-48998 - guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation CVE-2026-48998Medium
  ## Impact `guzzlehttp/psr7` improperly interpreted malformed `Host` header values when constructing request URIs from inbound request data. This issue concerns…
• CVE-2026-53723 - guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injectio CVE-2026-53723Medium
  Impact `guzzlehttp/guzzle-services` does not safely serialize scalar XML element values containing the CDATA terminator `]]>`. The XML request serializer…
• CVE-2026-47780 - free5GC UDR has improper `ueId` validation in EE subscription handlers that allo CVE-2026-47780Medium
  Summary The free5GC UDR accepts arbitrary non-3GPP ueId values in the EE subscription creation and query flows because the regular expression used for…
• CVE-2026-48022 - @hapi/wreck: Sensitive credential headers leak across cross-port and cross-schem CVE-2026-48022Medium
  Impact Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin redirect, but the origin check compares…
• CVE-2026-48038 - joi has an uncaught RangeError on deeply nested input through recursive `link()` CVE-2026-48038Medium
  Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. The blast radius depends…
• CVE-2026-48040 - netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Dire CVE-2026-48040Medium
  The netty-incubator-codec-ohttp library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses…

…另有 17 条 Medium 级漏洞（已省略）

Low (1 条)

• CVE-2026-48051 - Papra HTTP redirect bypass can lead to SSRF via webhook delivery system CVE-2026-48051Low
  Summary Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP…

🛡️ NVD-Latest（99 条）

Critical (13 条)

• CVE-2026-44748 SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated CVE-2026-44748Critical 9.9
  CVE-2026-44748 CVSS:9.9 SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid…
• CVE-2025-6254 The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in CVE-2025-6254Critical 9.8
  CVE-2025-6254 CVSS:9.8 The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to…
• CVE-2026-27671 Due to improper RFC protocol validation in the SAP Kernel used by the Applicatio CVE-2026-27671Critical 9.8
  CVE-2026-27671 CVSS:9.8 Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an…
• CVE-2026-11697 Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0 CVE-2026-11697Critical 9.6
  CVE-2026-11697 CVSS:9.6 Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially…
• CVE-2026-11671 Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a CVE-2026-11671Critical 9.6
  CVE-2026-11671 CVSS:9.6 Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape…
• CVE-2026-11659 Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed CVE-2026-11659Critical 9.6
  CVE-2026-11659 CVSS:9.6 Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox…
• CVE-2026-11654 Use after free in CameraCapture in Google Chrome on Mac prior to 149.0.7827.103 CVE-2026-11654Critical 9.6
  CVE-2026-11654 CVSS:9.6 Use after free in CameraCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially perform a…
• CVE-2026-11651 Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a rem CVE-2026-11651Critical 9.6
  CVE-2026-11651 CVSS:9.6 Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox…
• CVE-2026-11638 Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a re CVE-2026-11638Critical 9.6
  CVE-2026-11638 CVSS:9.6 Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape…
• CVE-2026-11634 Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 al CVE-2026-11634Critical 9.6
  CVE-2026-11634 CVSS:9.6 Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially perform a…
• CVE-2026-45328 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In vers CVE-2026-45328Critical 9.3
  CVE-2026-45328 CVSS:9.3 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes…
• CVE-2026-9067 The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not CVE-2026-9067Critical 9.1
  CVE-2026-9067 CVSS:9.1 The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload…
• CVE-2026-40128 SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated CVE-2026-40128Critical 9.0
  CVE-2026-40128 CVSS:9.0 SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that…

High (86 条)

• CVE-2026-8071 The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does no CVE-2026-8071High 8.8
  CVE-2026-8071 CVSS:8.8 The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode…
• CVE-2026-11699 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allo CVE-2026-11699High 8.8
  CVE-2026-11699 CVSS:8.8 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap…
• CVE-2026-11698 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allo CVE-2026-11698High 8.8
  CVE-2026-11698 CVSS:8.8 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap…
• CVE-2026-11688 Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 all CVE-2026-11688High 8.8
  CVE-2026-11688 CVSS:8.8 Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside…
• CVE-2026-11687 Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a CVE-2026-11687High 8.8
  CVE-2026-11687 CVSS:8.8 Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption…
• CVE-2026-11683 Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a r CVE-2026-11683High 8.8
  CVE-2026-11683 CVSS:8.8 Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a…
• CVE-2026-11681 Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowe CVE-2026-11681High 8.8
  CVE-2026-11681 CVSS:8.8 Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap…
• CVE-2026-11680 Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allo CVE-2026-11680High 8.8
  CVE-2026-11680 CVSS:8.8 Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside…
• CVE-2026-11674 Use after free in Guest View in Google Chrome prior to 149.0.7827.103 allowed a CVE-2026-11674High 8.8
  CVE-2026-11674 CVSS:8.8 Use after free in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a…
• CVE-2026-11673 Use after free in InterestGroups in Google Chrome prior to 149.0.7827.103 allowe CVE-2026-11673High 8.8
  CVE-2026-11673 CVSS:8.8 Use after free in InterestGroups in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a…
• CVE-2026-11670 Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote CVE-2026-11670High 8.8
  CVE-2026-11670 CVSS:8.8 Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via…
• CVE-2026-11664 Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a re CVE-2026-11664High 8.8
  CVE-2026-11664 CVSS:8.8 Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption…
• CVE-2026-11662 Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a re CVE-2026-11662High 8.8
  CVE-2026-11662 CVSS:8.8 Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a…
• CVE-2026-11657 Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allow CVE-2026-11657High 8.8
  CVE-2026-11657 CVSS:8.8 Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a…
• CVE-2026-11650 Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote a CVE-2026-11650High 8.8
  CVE-2026-11650 CVSS:8.8 Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via…
• CVE-2026-11649 Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote a CVE-2026-11649High 8.8
  CVE-2026-11649 CVSS:8.8 Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via…
• CVE-2026-11648 Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.103 CVE-2026-11648High 8.8
  CVE-2026-11648 CVSS:8.8 Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap…
• CVE-2026-11646 Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allow CVE-2026-11646High 8.8
  CVE-2026-11646 CVSS:8.8 Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a…
• CVE-2026-11645 Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allo CVE-2026-11645High 8.8
  CVE-2026-11645 CVSS:8.8 Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside…
• CVE-2026-11637 Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed CVE-2026-11637High 8.8
  CVE-2026-11637 CVSS:8.8 Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a…
• CVE-2026-11633 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allo CVE-2026-11633High 8.8
  CVE-2026-11633 CVSS:8.8 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a…
• CVE-2026-11630 Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a CVE-2026-11630High 8.8
  CVE-2026-11630 CVSS:8.8 Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption…
• CVE-2026-11629 Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remot CVE-2026-11629High 8.8
  CVE-2026-11629 CVSS:8.8 Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a…
• CVE-2026-3326 The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a CVE-2026-3326High 8.6
  CVE-2026-3326 CVSS:8.6 The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX…
• CVE-2026-46491 SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of CVE-2026-46491High 8.6
  CVE-2026-46491 CVSS:8.6 SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3,…
• CVE-2026-24067 Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.sl CVE-2026-24067High 8.4
  CVE-2026-24067 CVSS:8.4 Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which…
• CVE-2026-24066 Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.sl CVE-2026-24066High 8.4
  CVE-2026-24066 CVSS:8.4 Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which…
• CVE-2026-11700 Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a rem CVE-2026-11700High 8.3
  CVE-2026-11700 CVSS:8.3 Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process…
• CVE-2026-11692 Use after free in Read Anything in Google Chrome prior to 149.0.7827.103 allowed CVE-2026-11692High 8.3
  CVE-2026-11692 CVSS:8.3 Use after free in Read Anything in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-11682 Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7 CVE-2026-11682High 8.3
  CVE-2026-11682 CVSS:8.3 Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised…
• CVE-2026-11679 Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.103 all CVE-2026-11679High 8.3
  CVE-2026-11679 CVSS:8.3 Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-11677 Race in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote CVE-2026-11677High 8.3
  CVE-2026-11677 CVSS:8.3 Race in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to…
• CVE-2026-11676 Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and CVE-2026-11676High 8.3
  CVE-2026-11676 CVSS:8.3 Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149.0.7827.103 allowed a remote…
• CVE-2026-11672 Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 CVE-2026-11672High 8.3
  CVE-2026-11672 CVSS:8.3 Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the…
• CVE-2026-11663 Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote CVE-2026-11663High 8.3
  CVE-2026-11663 CVSS:8.3 Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to…
• CVE-2026-11661 Use after free in Views in Google Chrome on Windows prior to 149.0.7827.103 allo CVE-2026-11661High 8.3
  CVE-2026-11661 CVSS:8.3 Use after free in Views in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-11660 Insufficient validation of untrusted input in New Tab Page in Google Chrome prio CVE-2026-11660High 8.3
  CVE-2026-11660 CVSS:8.3 Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had…
• CVE-2026-11656 Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed CVE-2026-11656High 8.3
  CVE-2026-11656 CVSS:8.3 Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed an attacker who convinced a user to install a…
• CVE-2026-11655 Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowe CVE-2026-11655High 8.3
  CVE-2026-11655 CVSS:8.3 Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-11652 Use after free in Extensions in Google Chrome prior to 149.0.7827.103 allowed a CVE-2026-11652High 8.3
  CVE-2026-11652 CVSS:8.3 Use after free in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-11647 Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 a CVE-2026-11647High 8.3
  CVE-2026-11647 CVSS:8.3 Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the…
• CVE-2026-11642 Use after free in Web Apps in Google Chrome prior to 149.0.7827.103 allowed a re CVE-2026-11642High 8.3
  CVE-2026-11642 CVSS:8.3 Use after free in Web Apps in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process…
• CVE-2026-11640 Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a re CVE-2026-11640High 8.3
  CVE-2026-11640 CVSS:8.3 Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process…
• CVE-2026-11635 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allo CVE-2026-11635High 8.3
  CVE-2026-11635 CVSS:8.3 Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-11631 Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allow CVE-2026-11631High 8.3
  CVE-2026-11631 CVSS:8.3 Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-53673 BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in CVE-2026-53673High 8.1
  CVE-2026-53673 CVSS:8.1 BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated…
• CVE-2026-41732 JsonPulsarHeaderMapper matched type headers against trusted packages using a pre CVE-2026-41732High 8.1
  CVE-2026-41732 CVSS:8.1 JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly…
• CVE-2026-41731 JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type h CVE-2026-41731High 8.1
  CVE-2026-41731 CVSS:8.1 JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check,…
• CVE-2026-41729 Spring Data REST is vulnerable to SpEL expression injection through map-typed pr CVE-2026-41729High 8.1
  CVE-2026-41729 CVSS:8.1 Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch…
• CVE-2026-41717 Spring Data MongoDB contains a SpEL (Spring Expression Language) expression inje CVE-2026-41717High 8.1
  CVE-2026-41717 CVSS:8.1 Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter…
• CVE-2026-11693 Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 CVE-2026-11693High 8.1
  CVE-2026-11693 CVSS:8.1 Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the…
• CVE-2026-11689 Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.782 CVE-2026-11689High 8.1
  CVE-2026-11689 CVSS:8.1 Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the…
• CVE-2026-11643 Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remot CVE-2026-11643High 8.1
  CVE-2026-11643 CVSS:8.1 Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via malicious…
• CVE-2026-46517 LMDeploy is a toolkit for compressing, deploying, and serving large language mod CVE-2026-46517High 7.8
  CVE-2026-46517 CVSS:7.8 LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded…
• CVE-2026-46432 LMDeploy is a toolkit for compressing, deploying, and serving large language mod CVE-2026-46432High 7.8
  CVE-2026-46432 CVSS:7.8 LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is…
• CVE-2026-8795 A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifa CVE-2026-8795High 7.8
  CVE-2026-8795 CVSS:7.8 A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The…
• CVE-2026-46518 OpenEMR is a free and open source electronic health records and medical practice CVE-2026-46518High 7.7
  CVE-2026-46518 CVSS:7.7 OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a…
• CVE-2026-41003 An attacker able to influence values in RelyingPartyRegistration may be able to CVE-2026-41003High 7.6
  CVE-2026-41003 CVSS:7.6 An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring…
• CVE-2025-71330 image-size through 2.0.2 contains a denial of service vulnerability that allows CVE-2025-71330High 7.5
  CVE-2025-71330 CVSS:7.5 image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event…
• CVE-2025-71329 image-size through 2.0.2 contains a denial of service vulnerability that allows CVE-2025-71329High 7.5
  CVE-2025-71329 CVSS:7.5 image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event…
• CVE-2026-3018 The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection v CVE-2026-3018High 7.5
  CVE-2026-3018 CVSS:7.5 The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up…
• CVE-2026-45541 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In vers CVE-2026-45541High 7.5
  CVE-2026-45541 CVSS:7.5 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a…
• CVE-2026-46545 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the CVE-2026-46545High 7.5
  CVE-2026-46545 CVSS:7.5 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0,…
• CVE-2026-46541 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the CVE-2026-46541High 7.5
  CVE-2026-46541 CVSS:7.5 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0,…
• CVE-2026-44716 Pipecat is an open-source Python framework for building real-time voice and mult CVE-2026-44716High 7.5
  CVE-2026-44716 CVSS:7.5 Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to…
• CVE-2026-41728 Spring Data REST's JSON Patch (application/json-patch+json) implementation does CVE-2026-41728High 7.5
  CVE-2026-41728 CVSS:7.5 Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path…
• CVE-2026-41716 Spring Data's internal property-lookup cache accepts and permanently retains att CVE-2026-41716High 7.5
  CVE-2026-41716 CVSS:7.5 Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap…
• CVE-2026-41695 Spring Data Commons applications may be vulnerable to denial of service through CVE-2026-41695High 7.5
  CVE-2026-41695 CVSS:7.5 Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property…
• CVE-2026-40988 An application using spring-security-saml2-service-provider and the REDIRECT bin CVE-2026-40988High 7.5
  CVE-2026-40988 CVSS:7.5 An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to…
• CVE-2026-11694 Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed CVE-2026-11694High 7.5
  CVE-2026-11694 CVSS:7.5 Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer…
• CVE-2026-11690 Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.782 CVE-2026-11690High 7.5
  CVE-2026-11690 CVSS:7.5 Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the…
• CVE-2026-11667 Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a CVE-2026-11667High 7.5
  CVE-2026-11667 CVSS:7.5 Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the GPU process to…
• CVE-2026-11644 Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowe CVE-2026-11644High 7.5
  CVE-2026-11644 CVSS:7.5 Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who convinced a user to install a…
• CVE-2026-11641 Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 CVE-2026-11641High 7.5
  CVE-2026-11641 CVSS:7.5 Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to…
• CVE-2026-11639 Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 al CVE-2026-11639High 7.5
  CVE-2026-11639 CVSS:7.5 Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a…
• CVE-2026-11636 Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 a CVE-2026-11636High 7.5
  CVE-2026-11636 CVSS:7.5 Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage…
• CVE-2026-11632 Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a re CVE-2026-11632High 7.5
  CVE-2026-11632 CVSS:7.5 Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in…
• CVE-2026-11837 A local privilege escalation vulnerability was found in the ansible.posix author CVE-2026-11837High 7.3
  CVE-2026-11837 CVSS:7.3 A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses…
• CVE-2026-40993 An attacker with write permissions to the database table managed by JdbcAssertin CVE-2026-40993High 7.3
  CVE-2026-40993 CVSS:7.3 An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository…
• CVE-2026-11618 A vulnerability was determined in DTStack Taier up to 1.4.0. The affected elemen CVE-2026-11618High 7.3
  CVE-2026-11618 CVSS:7.3 A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file…
• CVE-2026-7556 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros CVE-2026-7556High 7.2
  CVE-2026-7556 CVSS:7.2 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up…
• CVE-2026-49069 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti CVE-2026-49069High 7.1
  CVE-2026-49069 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected…
• CVE-2026-45542 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In vers CVE-2026-45542High 7.1
  CVE-2026-45542 CVSS:7.1 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer…
• CVE-2026-45329 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In vers CVE-2026-45329High 7.1
  CVE-2026-45329 CVSS:7.1 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service…
• CVE-2026-53674 BuddyPress 14.4.0 contains a regular expression injection vulnerability in the a CVE-2026-53674High 7.1
  CVE-2026-53674 CVSS:7.1 BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username…
• CVE-2026-44751 Application server ABAP does not perform necessary authorization checks for an a CVE-2026-44751High 7.1
  CVE-2026-44751 CVSS:7.1 Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a…

⚔️ Sploitus（44 条）

Unknown (44 条)

• RISC-V-In-Proactive-computer-Security-PCS exploit
  RISC-V-In-Proactive-computer-Security-PCS exploit
• RISC-V-In-Proactive-computer-Security-PCS- exploit
  RISC-V-In-Proactive-computer-Security-PCS- exploit

…另有 42 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-12 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV