🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-47208 / CVE-2026-47140 / CVE-2026-47137 / CVE-2026-47131 (CVSS 10.0)： vm2沙箱模块存在多个致命逃逸漏洞。攻击者可在受沙箱保护的JavaScript代码中编写恶意代码，直接逃逸出沙箱并执行任意系统命令。利用条件低，影响使用 vm2 ≥3.11.4 之前版本的Node.js应用。
• CVE-2026-49261 (CVSS 10.0)： MariaDB服务器高危漏洞。启用 wsrep_notify_cmd 功能后，特定条件下允许攻击者利用该命令机制执行任意命令。影响 10.6/10.11/11.4/11.8等多个版本系列。
• CVE-2026-48150 (Critical)： Budibase低代码平台权限提升漏洞。攻击者如果拥有工作区范围内的构建者角色，可通过精心构造的API请求，利用 /api/public/v1/roles/assign 端点将自身权限提升至全局管理员。横向扩展攻击面大。
• CVE-2026-47370 / CVE-2026-47369 (CVSS 9.9)： 多个UniFi OS设备存在命令注入与权限提升漏洞。已具备网络访问和低权限的攻击者可利用输入验证缺陷执行命令或提权至更高权限，严重威胁Ubiquiti设备安全。

📈 威胁趋势

• 沙箱逃逸 / 远程代码执行 (RCE)： 今日威胁核心。vm2 集中爆发4个CVSS 10.0的沙箱逃逸漏洞，攻击者可执行任意代码；MariaDB也因配置命令注入存在RCE风险。此类漏洞可直接导致服务器被完全控制。
• 权限提升： 多款低代码与基础设施平台存在权限绕过。Budibase的工作区角色提升至全局管理员，Appsmith存在超级用户创建竞争条件(User级权限提升)，UniFi OS亦存在提权漏洞。
• 信息泄露与SSRF： Budibase连续出现SSRF (未拦截内网请求) 和REST数据源凭据泄露风险；GeoServer管理员可将明文密码写入任意文件；Appsmith密码重置功能存在基于Origin头的校验绕过，可能导致用户账户接管。
• 认证绕过： Budibase webhook schema接口授权缺失，允许未认证用户更新已认证端点的请求体schema，可能引发后续攻击。

🛡️ 缓解建议

• 紧急更新vm2库： 所有使用 vm2 ≤3.11.3 的Node.js应用应立即升级至3.11.4或更高版本。如无法立即升级，应隔离运行沙箱代码的服务，并评估是否可替代为其他沙箱方案。
• 修复关键数据库与底层平台： 立即停止在公共网络上使用受影响版本的MariaDB (尤其是启用 wsrep_notify_cmd 的实例)，并升级至对应修复版本。同时检查并更新所有Ubiquiti UniFi设备固件。
• 审计低代码平台配置： 对 Budibase 和 Appsmith 实例进行紧急安全检查：禁用不必要的builder角色、修复webhook权限、更新SSRF防护白名单及凭据存储逻辑。确保密码重置功能仅接受可信域名。
• 限制网络暴露与最小权限原则： 严格控制对管理面板和API端点的网络访问，尤其是 /api/public/* 和涉及数据库、容器的管理端点。对任何具备低级访问权限的账户实施强化监控。

🚨 CISA-KEV（1 条）

Unknown (1 条)

• CVE-2026-35273 - Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability CVE-2026-35273
  CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability 产品: Oracle PeopleSoft Enterprise…

🐙 GitHub-Advisory（50 条）

Critical (1 条)

• CVE-2026-48150 - Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/ CVE-2026-48150Critical
  ## Summary `/api/public/v1/roles/assign` is guarded by the `builderOrAdmin` middleware, which passes any user who is a builder for the app id in the…

High (19 条)

• GHSA-9wcp-79g5-5c3c - Appsmith Super User Creation Race Condition Allows Multiple Instance Administrat High 3.1
  ## Summary The `/api/v1/users/super` endpoint enforces a restriction that only one super user (Instance Administrator) can be created during initial setup.…
• CVE-2026-53999 - Radius Controller May Delete a Container Resource via an Injected Deployment Ann CVE-2026-53999High 3.1
  # Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) ## Summary A configuration-validation issue…
• CVE-2026-48146 - Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protect CVE-2026-48146High
  Summary The OAuth2 token fetch function in `packages/server/src/sdk/workspace/oauth2/utils.ts` (line 59) uses raw `fetch(config.url)` with **no SSRF…
• CVE-2025-52465 - GeoServer has an arbitrary file write vulnerability in its Master Password Dump CVE-2025-52465High
  Summary A vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master…
• CVE-2026-48151 - Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mu CVE-2026-48151High
  The webhook schema-building endpoint is registered under `builderRoutes`, but the generic authorization middleware skips authorization for all paths matching…
• CVE-2026-48152 - Budibase: Basic app users can exfiltrate stored REST datasource auth by rewritin CVE-2026-48152High
  Summary Budibase stores external REST datasource credentials server-side and documents that database credentials are applied server-side and are not exposed in…
• GHSA-j9gf-vw2f-9hrw - Appsmith: Configuration-dependent origin validation bypass in password reset and High
  Summary A configuration-dependent origin validation bypass was identified in Appsmith’s password reset and email verification flows on current `release`. Both…
• CVE-2026-49742 - TYPO3 CMS has Broken Access Control in its Media Module CVE-2026-49742High
  Problem Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media…
• CVE-2026-47346 - TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-47346High
  Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., `.FORM.YAML`) to bypass the Form…
• CVE-2026-49741 - TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework CVE-2026-49741High
  Problem Backend users with write access to the `form_definition` database table were able to directly create, update, or delete form definition records via…
• GHSA-36hh-v3qg-5jq4 - PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` High
  PyO3 0.24.0 added optimized implementations of `Iterator::nth` and `DoubleEndedIterator::nth_back` for the `BoundListIterator` and `BoundTupleIterator` types.…
• CVE-2026-47343 - TYPO3 CMS: Destructive Actions on File Mount Folders CVE-2026-47343High
  Problem Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an…
• CVE-2026-11607 - TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-11607High
  Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without…
• GHSA-gv7w-rqvm-qjhr - esbuild: Missing binary integrity verification in Deno module enables remote cod High
  Summary The esbuild Deno module (`lib/deno/mod.ts`) downloads native binary executables from an npm registry and writes them to disk with executable…
• CVE-2026-54097 - File Browser: Cross-user unauthorized share-link deletion via unbounded prefix m CVE-2026-54097High
  Summary A low-privileged authenticated user of filebrowser (with `create` + `delete` permissions in their own isolated scope) can silently destroy share-link…
• CVE-2026-54096 - File Browser: Improper Access Control Occurs via Pre-Created Public Share for a CVE-2026-54096High
  Summary This is similar vulnrability of **`CVE-2026-0035`**, which was fixed in Android `MediaProvider` with **high** severity. In the original Java issue,…
• CVE-2026-54092 - File Browser has a DoS Vulnerability via Public Login API CVE-2026-54092High
  Summary Unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing,…
• CVE-2026-54091 - File Browser has incorrect access control for public directory shares via rule p CVE-2026-54091High
  Summary File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and then evaluate descendant paths against the…
• CVE-2026-54090 - File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter In CVE-2026-54090High
  > [!NOTE] > **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations**. To exploit this…

Medium (24 条)

• CVE-2026-28975 - NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Le CVE-2026-28975Medium
  Impact When `NIOHTTPRequestDecompressor` is configured with `.ratio(N)`, the decompression limit is enforced using the `Content-Length` header value from the…
• CVE-2026-48128 - Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step CVE-2026-48128Medium
  Summary The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller…
• CVE-2025-58175 - GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Enti CVE-2025-58175Medium
  Summary A GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). Details This…
• CVE-2026-48147 - Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String CVE-2026-48147Medium
  Summary The `buildMatcherRegex()` / `matches()` functions in `packages/backend-core/src/middleware/matchers.ts` share the same structural root cause as the…
• CVE-2026-48148 - Budibase: Unvalidated VectorDB Host Parameter Enables SSRF CVE-2026-48148Medium
  Summary The VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames,…
• CVE-2026-48154 - gorest InMemorySecret2FA race condition allows process crash via concurrent map CVE-2026-48154Medium
  ## Vulnerability: CWE-362 — Concurrent Map Access Race Condition in InMemorySecret2FA **CWE:** CWE-362 (Concurrent Execution using Shared Resource with…
• CVE-2026-48155 - pypdf: Possible large memory usage for large offsets for layout mode text CVE-2026-48155Medium
  Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large…
• CVE-2026-48156 - pypdf: Possible long runtimes for zero-only width values in cross-reference stre CVE-2026-48156Medium
  Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and…

…另有 16 条 Medium 级漏洞（已省略）

Low (6 条)

• CVE-2026-28898 - SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo CVE-2026-28898Low
  swift-nio-http2's HTTP/2-to-HTTP/1.1 codec (`HTTP2FramePayloadToHTTP1ServerCodec` / `HTTP2ToHTTP1ServerCodec`) did not validate pseudo-header values for…
• GHSA-6vgg-xhvh-38ff - nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: Low
  `internal/api/mobile_bundle.go:62-66` sets only `Content-Type: application/yaml`. The Web-UI sibling at `internal/web/handlers.go:1316-1321` sets…
• CVE-2026-49854 - Tornado has out-of-bounds memory access via C extension CVE-2026-49854Low
  Summary Tornado's optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes…

…另有 3 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（79 条）

Critical (22 条)

• CVE-2026-47208 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffe CVE-2026-47208Critical 10.0
  CVE-2026-47208 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows…
• CVE-2026-47140 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM bl CVE-2026-47140Critical 10.0
  CVE-2026-47140 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as…
• CVE-2026-47137 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix f CVE-2026-47137Critical 10.0
  CVE-2026-47137 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a…
• CVE-2026-47131 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combin CVE-2026-47131Critical 10.0
  CVE-2026-47131 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer,…
• CVE-2026-49261 MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 th CVE-2026-49261Critical 10.0
  CVE-2026-49261 CVSS:10.0 MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1…
• CVE-2026-47370 A malicious actor with access to the network and low privileges could exploit an CVE-2026-47370Critical 9.9
  CVE-2026-47370 CVSS:9.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in…
• CVE-2026-47369 A malicious actor with access to the network and low privileges could exploit an CVE-2026-47369Critical 9.9
  CVE-2026-47369 CVSS:9.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in…
• CVE-2026-47367 A malicious actor with access to the network and low privileges could exploit an CVE-2026-47367Critical 9.9
  CVE-2026-47367 CVSS:9.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID…
• CVE-2026-47365 Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in c CVE-2026-47365Critical 9.9
  CVE-2026-47365 CVSS:9.9 Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to…
• CVE-2026-11839 Unrestricted upload of file with dangerous type vulnerability in Başarsoft Infor CVE-2026-11839Critical 9.9
  CVE-2026-11839 CVSS:9.9 Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web…
• CVE-2026-6853 Improper restriction of excessive authentication attempts vulnerability in Başbe CVE-2026-6853Critical 9.8
  CVE-2026-6853 CVSS:9.8 Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd.…
• CVE-2026-54133 jmespath.php allows users to use JMESPath, software for declaratively specifying CVE-2026-54133Critical 9.8
  CVE-2026-54133 CVSS:9.8 jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP…
• CVE-2026-53787 Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthent CVE-2026-53787Critical 9.8
  CVE-2026-53787 CVSS:9.8 Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows…
• CVE-2026-47210 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox CVE-2026-47210Critical 9.8
  CVE-2026-47210 CVSS:9.8 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code…
• CVE-2026-10557 The Yarbo Android and iOS applications contain hard-coded MQTT broker credential CVE-2026-10557Critical 9.8
  CVE-2026-10557 CVSS:9.8 The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices.…
• CVE-2026-11849 The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded CVE-2026-11849Critical 9.8
  CVE-2026-11849 CVSS:9.8 The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated…
• CVE-2026-48611 Improper authentication checks in the OAuth implementation allow account hijacki CVE-2026-48611Critical 9.8
  CVE-2026-48611 CVSS:9.8 Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading…
• CVE-2026-38581 SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 al CVE-2026-38581Critical 9.8
  CVE-2026-38581 CVSS:9.8 SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands…
• CVE-2026-7852 Unrestricted upload of file with dangerous type vulnerability in Limatek System CVE-2026-7852Critical 9.8
  CVE-2026-7852 CVSS:9.8 Unrestricted upload of file with dangerous type vulnerability in Limatek System Inc. LimRAD NAC allows Remote Code Inclusion. This issue…
• CVE-2026-11561 Improper neutralization of special elements used in an expression language state CVE-2026-11561Critical 9.8
  CVE-2026-11561 CVSS:9.8 Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in…
• CVE-2026-35273 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS CVE-2026-35273Critical 9.8
  CVE-2026-35273 CVSS:9.8 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management).…
• CVE-2026-9648 The crypton-x509-validation Haskell library fails to enforce X.509 NameConstrain CVE-2026-9648Critical 9.1
  CVE-2026-9648 CVSS:9.1 The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose…

High (57 条)

• CVE-2026-12059 The SSH service of CelloOS developed by Cellopoint has an Improper Access Contro CVE-2026-12059High 8.8
  CVE-2026-12059 CVSS:8.8 The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote…
• CVE-2026-11933 A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript CVE-2026-11933High 8.8
  CVE-2026-11933 CVSS:8.8 A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript…
• CVE-2025-24284 This issue was addressed with improved checks to prevent unauthorized actions. T CVE-2025-24284High 8.8
  CVE-2025-24284 CVSS:8.8 This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be…
• CVE-2026-7870 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due CVE-2026-7870High 8.8
  CVE-2026-7870 CVSS:8.8 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could…
• CVE-2026-6211 Unrestricted upload of file with dangerous type vulnerability in Global IT Infor CVE-2026-6211High 8.7
  CVE-2026-6211 CVSS:8.7 Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc. WEOLL allows Accessing…
• CVE-2026-47135 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.fo CVE-2026-47135High 8.7
  CVE-2026-47135 CVSS:8.7 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9…
• CVE-2026-45674 Netty is a network application framework for development of protocol servers and CVE-2026-45674High 8.7
  CVE-2026-45674 CVSS:8.7 Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and…
• CVE-2026-44494 Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to CVE-2026-44494High 8.7
  CVE-2026-44494 CVSS:8.7 Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a…
• CVE-2026-6552 GitLab has remediated an issue in GitLab EE affecting all versions from 15.5 bef CVE-2026-6552High 8.7
  CVE-2026-6552 CVSS:8.7 GitLab has remediated an issue in GitLab EE affecting all versions from 15.5 before 18.10.8, 18.11 before 18.11.5, and 19.0 before…
• CVE-2026-10087 GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 bef CVE-2026-10087High 8.7
  CVE-2026-10087 CVSS:8.7 GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before…
• CVE-2026-47209 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseH CVE-2026-47209High 8.6
  CVE-2026-47209 CVSS:8.6 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the…
• CVE-2026-47139 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM su CVE-2026-47139High 8.6
  CVE-2026-47139 CVSS:8.6 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the…
• CVE-2026-47368 A malicious actor with access to the network could exploit a Path Traversal vuln CVE-2026-47368High 8.6
  CVE-2026-47368 CVSS:8.6 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to…
• CVE-2026-44492 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32. CVE-2026-44492High 8.6
  CVE-2026-44492 CVSS:8.6 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6…
• CVE-2026-40999 When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spri CVE-2026-40999High 8.6
  CVE-2026-40999 CVSS:8.6 When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through…
• CVE-2026-49982 tmp is a temporary file and directory creator for node.js. In version 0.2.6, the CVE-2026-49982High 8.2
  CVE-2026-49982 CVSS:8.2 tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string…
• CVE-2026-40998 Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource i CVE-2026-40998High 8.2
  CVE-2026-40998 CVSS:8.2 Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled…
• CVE-2026-40994 Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compl CVE-2026-40994High 8.2
  CVE-2026-40994 CVSS:8.2 Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J…
• CVE-2026-7368 The Yarbo cloud does not enforce per-device or per-user authorization. Any clien CVE-2026-7368High 8.1
  CVE-2026-7368 CVSS:8.1 The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared…
• CVE-2026-50633 A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integrati CVE-2026-50633High 8.1
  CVE-2026-50633 CVSS:8.1 A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an…
• CVE-2026-50632 A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS c CVE-2026-50632High 8.1
  CVE-2026-50632 CVSS:8.1 A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been…
• CVE-2026-11846 The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has CVE-2026-11846High 8.1
  CVE-2026-11846 CVSS:8.1 The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing…
• CVE-2026-48610 Under certain network configurations, a malicious actor with access to network c CVE-2026-48610High 8.1
  CVE-2026-48610 CVSS:8.1 Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability…
• CVE-2026-53777 Perry before 0.5.1159 contains a path traversal vulnerability that allows a mali CVE-2026-53777High 8.1
  CVE-2026-53777 CVSS:8.1 Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any…
• CVE-2026-11816 Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the a CVE-2026-11816High 8.1
  CVE-2026-11816 CVSS:8.1 Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in…
• CVE-2026-41700 Spring for GraphQL applications that have enabled the WebSocket transport are vu CVE-2026-41700High 8.1
  CVE-2026-41700 CVSS:8.1 Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker…
• CVE-2026-41699 Spring for GraphQL applications are vulnerable to Unsafe Deserialization when pr CVE-2026-41699High 8.1
  CVE-2026-41699 CVSS:8.1 Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can…
• CVE-2026-10795 The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable CVE-2026-10795High 8.1
  CVE-2026-10795 CVSS:8.1 The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and…
• CVE-2026-48612 Improper state verification in the OAuth implementation could allow an attacker CVE-2026-48612High 8.0
  CVE-2026-48612 CVSS:8.0 Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a…
• CVE-2025-31272 The issue was addressed with improved checks. This issue is fixed in macOS Sequo CVE-2025-31272High 7.8
  CVE-2025-31272 CVSS:7.8 The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint…
• CVE-2026-10847 A local privilege escalation vulnerability exists in Check Point Identity Agent CVE-2026-10847High 7.8
  CVE-2026-10847 CVSS:7.8 A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be…
• CVE-2026-11774 An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server CVE-2026-11774High 7.6
  CVE-2026-11774 CVSS:7.6 An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding…
• CVE-2026-46340 Netty is a network application framework for development of protocol servers and CVE-2026-46340High 7.5
  CVE-2026-46340 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to…
• CVE-2026-45416 Netty is a network application framework for development of protocol servers and CVE-2026-45416High 7.5
  CVE-2026-45416 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and…
• CVE-2026-44894 Netty is a network application framework for development of protocol servers and CVE-2026-44894High 7.5
  CVE-2026-44894 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used…
• CVE-2026-44893 Netty is a network application framework for development of protocol servers and CVE-2026-44893High 7.5
  CVE-2026-44893 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions…
• CVE-2026-50645 There is no restriction on the amount of attachment headers that a message can c CVE-2026-50645High 7.5
  CVE-2026-50645 CVSS:7.5 There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can…
• CVE-2026-44892 Netty is a network application framework for development of protocol servers and CVE-2026-44892High 7.5
  CVE-2026-44892 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default…
• CVE-2025-46315 A permissions issue was addressed with additional restrictions. This issue is fi CVE-2025-46315High 7.5
  CVE-2025-46315 CVSS:7.5 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access…
• CVE-2026-46697 Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5 CVE-2026-46697High 7.5
  CVE-2026-46697 CVSS:7.5 Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST…
• CVE-2026-44496 Axios is a promise based HTTP client for the browser and Node.js. Axios versions CVE-2026-44496High 7.5
  CVE-2026-44496 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the…
• CVE-2026-44488 Axios is a promise based HTTP client for the browser and Node.js. Axios versions CVE-2026-44488High 7.5
  CVE-2026-44488 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured…
• CVE-2026-44487 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32. CVE-2026-44487High 7.5
  CVE-2026-44487 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward…
• CVE-2026-44486 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32. CVE-2026-44486High 7.5
  CVE-2026-44486 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak…
• CVE-2026-7787 IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read o CVE-2026-7787High 7.5
  CVE-2026-7787 CVSS:7.5 IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing…
• CVE-2026-7250 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 CVE-2026-7250High 7.5
  CVE-2026-7250 CVSS:7.5 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before…
• CVE-2026-5497 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of CVE-2026-5497High 7.5
  CVE-2026-5497 CVSS:7.5 vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count…
• CVE-2026-41856 The Spring GraphQL annotation detection mechanism for @Controller data fetchers CVE-2026-41856High 7.5
  CVE-2026-41856 CVSS:7.5 The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within…
• CVE-2026-50631 A race condition in AbstractOAuthDataProvider allows concurrent requests using t CVE-2026-50631High 7.4
  CVE-2026-50631 CVSS:7.4 A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics…
• CVE-2026-12066 A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability CVE-2026-12066High 7.3
  CVE-2026-12066 CVSS:7.3 A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file…
• CVE-2026-48546 KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an at CVE-2026-48546High 7.3
  CVE-2026-48546 CVSS:7.3 KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the…
• CVE-2026-8589 GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 b CVE-2026-8589High 7.3
  CVE-2026-8589 CVSS:7.3 GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before…
• CVE-2026-11845 The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has CVE-2026-11845High 7.2
  CVE-2026-11845 CVSS:7.2 The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing…
• CVE-2026-47366 Improper verification of access permissions when modifying permissions through t CVE-2026-47366High 7.2
  CVE-2026-47366 CVSS:7.2 Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an…
• CVE-2023-33999 Improper neutralization of input during web page generation ('cross-site scripti CVE-2023-33999High 7.1
  CVE-2023-33999 CVSS:7.1 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows…
• CVE-2026-40987 A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywher CVE-2026-40987High 7.1
  CVE-2026-40987 CVSS:7.1 A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured…
• CVE-2026-44495 Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to CVE-2026-44495High 7.0
  CVE-2026-44495 CVSS:7.0 Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains…

⚔️ Sploitus（70 条）

Unknown (70 条)

• OffSploit exploit
  OffSploit exploit
• POC_cve_2026_35273 exploit
  POC_cve_2026_35273 exploit

…另有 68 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-14 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV