🤖 今日安全态势分析

🎯 今日重点关注

• vm2 沙箱逃逸系列 (CVE-2026-47208等，CVSS 10.0): vm2 沙箱存在多个严重漏洞，攻击者可编写恶意代码逃逸沙箱，实现任意代码执行，影响所有使用 vm2 3.11.4 以下版本的 Node.js 环境，利用条件低，需立即升级。
• MariaDB 命令注入 (CVE-2026-49261，CVSS 10.0): MariaDB 服务器在启用 wsrep_notify_cmd 配置时，存在命令注入漏洞。网络可访问且拥有低权限的攻击者可利用此漏洞在数据库服务器上执行任意命令，影响多个版本分支。
• Budibase 权限提升 (CVE-2026-48150，Critical): Budibase 中拥有工作区级构建者权限的用户，可通过特制的 API 请求绕过权限检查，提升为全局管理员，从而完全控制系统，内部威胁风险极高。
• UniFi OS 命令注入与权限提升 (CVE-2026-47370/367，CVSS 9.9): UniFi OS 设备和 UID Enterprise Agent 存在输入验证缺陷，低权限攻击者可通过网络访问实现命令注入或权限提升，严重威胁 Ubiquiti 网络设备安全。
• Appsmith 超级用户创建竞争条件 (GHSA-9wcp-79g5-5c3c，High): Appsmith 初始设置接口存在 TOCTOU 竞争条件，允许攻击者在多实例部署中创建多个超级用户实例，从而绕过管理员权限限制。

📈 威胁趋势

• 远程代码执行 (RCE) / 沙箱逃逸: 数量最多且风险最高。vm2 的多个沙箱逃逸漏洞（CVSS 10.0）和 MariaDB 的命令注入（CVSS 10.0）构成最严重威胁，可直接导致主机沦陷。
• 权限提升 / 授权绕过: 密度极高。Budibase 单日贡献3个相关漏洞（权限提升、授权绕过），Appsmith 的竞争条件及 UniFi OS 的提权漏洞均表明，应用层逻辑缺陷是当前攻击热点。
• 信息泄露 / SSRF: 涉及 Budibase (OAuth2 SSRF、REST 凭据泄露) 和 GeoServer (明文密码文件写入)。攻击者可借此窃取敏感凭证或内网信息。
• 访前验证绕过: Budibase 的 Webhook 端点存在未授权访问，且 Appsmith 的密码重置流程存在来源验证绕过，直指身份认证与访问控制的基础薄弱环节。

🛡️ 缓解建议

• 紧急升级核心组件: 立即将 vm2 升级至 3.11.4 或以上版本；将 MariaDB 升级至已修复版本（10.6.27+，10.11.18+等），并审查 wsrep_notify_cmd 配置的安全性。
• 修补低代码平台漏洞: 针对 Budibase 和 Appsmith，立即应用厂商发布的安全更新。在进行全面升级前，可考虑限制对 /api/public/ 和 /api/v1/users/super 等关键 API 的访问。
• 加固网络设备与代理: 检查并更新 UniFi OS 及相关设备固件，确保 UID Enterprise Agent 为最新版。在网络边界配置严格访问控制，限制对管理接口的暴露。
• 实施纵深防御与监控: 对所有内部应用启用 Web 应用防火墙 (WAF)，重点检测 SSRF、命令注入及路径穿越尝试。加强日志审计，监控异常的权限变更和超级用户创建行为。

🐙 GitHub-Advisory（50 条）

Critical (1 条)

• CVE-2026-48150 - Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/ CVE-2026-48150Critical
  ## Summary `/api/public/v1/roles/assign` is guarded by the `builderOrAdmin` middleware, which passes any user who is a builder for the app id in the…

High (19 条)

• GHSA-9wcp-79g5-5c3c - Appsmith Super User Creation Race Condition Allows Multiple Instance Administrat High 3.1
  ## Summary The `/api/v1/users/super` endpoint enforces a restriction that only one super user (Instance Administrator) can be created during initial setup.…
• CVE-2026-53999 - Radius Controller May Delete a Container Resource via an Injected Deployment Ann CVE-2026-53999High 3.1
  # Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) ## Summary A configuration-validation issue…
• CVE-2026-48146 - Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protect CVE-2026-48146High
  Summary The OAuth2 token fetch function in `packages/server/src/sdk/workspace/oauth2/utils.ts` (line 59) uses raw `fetch(config.url)` with **no SSRF…
• CVE-2025-52465 - GeoServer has an arbitrary file write vulnerability in its Master Password Dump CVE-2025-52465High
  Summary A vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master…
• CVE-2026-48151 - Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mu CVE-2026-48151High
  The webhook schema-building endpoint is registered under `builderRoutes`, but the generic authorization middleware skips authorization for all paths matching…
• CVE-2026-48152 - Budibase: Basic app users can exfiltrate stored REST datasource auth by rewritin CVE-2026-48152High
  Summary Budibase stores external REST datasource credentials server-side and documents that database credentials are applied server-side and are not exposed in…
• GHSA-j9gf-vw2f-9hrw - Appsmith: Configuration-dependent origin validation bypass in password reset and High
  Summary A configuration-dependent origin validation bypass was identified in Appsmith’s password reset and email verification flows on current `release`. Both…
• CVE-2026-49742 - TYPO3 CMS has Broken Access Control in its Media Module CVE-2026-49742High
  Problem Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media…
• CVE-2026-47346 - TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-47346High
  Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., `.FORM.YAML`) to bypass the Form…
• CVE-2026-49741 - TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework CVE-2026-49741High
  Problem Backend users with write access to the `form_definition` database table were able to directly create, update, or delete form definition records via…
• GHSA-36hh-v3qg-5jq4 - PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` High
  PyO3 0.24.0 added optimized implementations of `Iterator::nth` and `DoubleEndedIterator::nth_back` for the `BoundListIterator` and `BoundTupleIterator` types.…
• CVE-2026-47343 - TYPO3 CMS: Destructive Actions on File Mount Folders CVE-2026-47343High
  Problem Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an…
• CVE-2026-11607 - TYPO3 CMS has Broken Access Control in its Form Framework CVE-2026-11607High
  Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without…
• GHSA-gv7w-rqvm-qjhr - esbuild: Missing binary integrity verification in Deno module enables remote cod High
  Summary The esbuild Deno module (`lib/deno/mod.ts`) downloads native binary executables from an npm registry and writes them to disk with executable…
• CVE-2026-54097 - File Browser: Cross-user unauthorized share-link deletion via unbounded prefix m CVE-2026-54097High
  Summary A low-privileged authenticated user of filebrowser (with `create` + `delete` permissions in their own isolated scope) can silently destroy share-link…
• CVE-2026-54096 - File Browser: Improper Access Control Occurs via Pre-Created Public Share for a CVE-2026-54096High
  Summary This is similar vulnrability of **`CVE-2026-0035`**, which was fixed in Android `MediaProvider` with **high** severity. In the original Java issue,…
• CVE-2026-54092 - File Browser has a DoS Vulnerability via Public Login API CVE-2026-54092High
  Summary Unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing,…
• CVE-2026-54091 - File Browser has incorrect access control for public directory shares via rule p CVE-2026-54091High
  Summary File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and then evaluate descendant paths against the…
• CVE-2026-54090 - File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter In CVE-2026-54090High
  > [!NOTE] > **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations**. To exploit this…

Medium (24 条)

• CVE-2026-28975 - NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Le CVE-2026-28975Medium
  Impact When `NIOHTTPRequestDecompressor` is configured with `.ratio(N)`, the decompression limit is enforced using the `Content-Length` header value from the…
• CVE-2026-48128 - Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step CVE-2026-48128Medium
  Summary The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller…
• CVE-2025-58175 - GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Enti CVE-2025-58175Medium
  Summary A GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). Details This…
• CVE-2026-48147 - Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String CVE-2026-48147Medium
  Summary The `buildMatcherRegex()` / `matches()` functions in `packages/backend-core/src/middleware/matchers.ts` share the same structural root cause as the…
• CVE-2026-48148 - Budibase: Unvalidated VectorDB Host Parameter Enables SSRF CVE-2026-48148Medium
  Summary The VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames,…
• CVE-2026-48154 - gorest InMemorySecret2FA race condition allows process crash via concurrent map CVE-2026-48154Medium
  ## Vulnerability: CWE-362 — Concurrent Map Access Race Condition in InMemorySecret2FA **CWE:** CWE-362 (Concurrent Execution using Shared Resource with…
• CVE-2026-48155 - pypdf: Possible large memory usage for large offsets for layout mode text CVE-2026-48155Medium
  Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large…
• CVE-2026-48156 - pypdf: Possible long runtimes for zero-only width values in cross-reference stre CVE-2026-48156Medium
  Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with `/W [0 0 0]` values and…

…另有 16 条 Medium 级漏洞（已省略）

Low (6 条)

• CVE-2026-28898 - SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo CVE-2026-28898Low
  swift-nio-http2's HTTP/2-to-HTTP/1.1 codec (`HTTP2FramePayloadToHTTP1ServerCodec` / `HTTP2ToHTTP1ServerCodec`) did not validate pseudo-header values for…
• GHSA-6vgg-xhvh-38ff - nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: Low
  `internal/api/mobile_bundle.go:62-66` sets only `Content-Type: application/yaml`. The Web-UI sibling at `internal/web/handlers.go:1316-1321` sets…
• CVE-2026-49854 - Tornado has out-of-bounds memory access via C extension CVE-2026-49854Low
  Summary Tornado's optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes…

…另有 3 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（76 条）

Critical (20 条)

• CVE-2026-47208 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffe CVE-2026-47208Critical 10.0
  CVE-2026-47208 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows…
• CVE-2026-47140 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM bl CVE-2026-47140Critical 10.0
  CVE-2026-47140 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as…
• CVE-2026-47137 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix f CVE-2026-47137Critical 10.0
  CVE-2026-47137 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a…
• CVE-2026-47131 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combin CVE-2026-47131Critical 10.0
  CVE-2026-47131 CVSS:10.0 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer,…
• CVE-2026-49261 MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 th CVE-2026-49261Critical 10.0
  CVE-2026-49261 CVSS:10.0 MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1…
• CVE-2026-47370 A malicious actor with access to the network and low privileges could exploit an CVE-2026-47370Critical 9.9
  CVE-2026-47370 CVSS:9.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in…
• CVE-2026-47369 A malicious actor with access to the network and low privileges could exploit an CVE-2026-47369Critical 9.9
  CVE-2026-47369 CVSS:9.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in…
• CVE-2026-47367 A malicious actor with access to the network and low privileges could exploit an CVE-2026-47367Critical 9.9
  CVE-2026-47367 CVSS:9.9 A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID…
• CVE-2026-47365 Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in c CVE-2026-47365Critical 9.9
  CVE-2026-47365 CVSS:9.9 Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to…
• CVE-2026-11839 Unrestricted upload of file with dangerous type vulnerability in Başarsoft Infor CVE-2026-11839Critical 9.9
  CVE-2026-11839 CVSS:9.9 Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web…
• CVE-2026-12183 Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 CVE-2026-12183Critical 9.8
  CVE-2026-12183 CVSS:9.8 Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication…
• CVE-2026-6853 Improper restriction of excessive authentication attempts vulnerability in Başbe CVE-2026-6853Critical 9.8
  CVE-2026-6853 CVSS:9.8 Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd.…
• CVE-2026-54133 jmespath.php allows users to use JMESPath, software for declaratively specifying CVE-2026-54133Critical 9.8
  CVE-2026-54133 CVSS:9.8 jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP…
• CVE-2026-53787 Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthent CVE-2026-53787Critical 9.8
  CVE-2026-53787 CVSS:9.8 Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows…
• CVE-2026-47210 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox CVE-2026-47210Critical 9.8
  CVE-2026-47210 CVSS:9.8 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code…
• CVE-2026-10557 The Yarbo Android and iOS applications contain hard-coded MQTT broker credential CVE-2026-10557Critical 9.8
  CVE-2026-10557 CVSS:9.8 The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices.…
• CVE-2026-11849 The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded CVE-2026-11849Critical 9.8
  CVE-2026-11849 CVSS:9.8 The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated…
• CVE-2026-48611 Improper authentication checks in the OAuth implementation allow account hijacki CVE-2026-48611Critical 9.8
  CVE-2026-48611 CVSS:9.8 Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading…
• CVE-2026-38581 SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 al CVE-2026-38581Critical 9.8
  CVE-2026-38581 CVSS:9.8 SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands…
• CVE-2026-9648 The crypton-x509-validation Haskell library fails to enforce X.509 NameConstrain CVE-2026-9648Critical 9.1
  CVE-2026-9648 CVSS:9.1 The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose…

High (56 条)

• CVE-2026-12187 A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Aff CVE-2026-12187High 8.8
  CVE-2026-12187 CVSS:8.8 A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality…
• CVE-2026-12186 A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the CVE-2026-12186High 8.8
  CVE-2026-12186 CVSS:8.8 A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library…
• CVE-2026-12174 A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issu CVE-2026-12174High 8.8
  CVE-2026-12174 CVSS:8.8 A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file…
• CVE-2026-12059 The SSH service of CelloOS developed by Cellopoint has an Improper Access Contro CVE-2026-12059High 8.8
  CVE-2026-12059 CVSS:8.8 The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote…
• CVE-2026-11933 A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript CVE-2026-11933High 8.8
  CVE-2026-11933 CVSS:8.8 A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript…
• CVE-2025-24284 This issue was addressed with improved checks to prevent unauthorized actions. T CVE-2025-24284High 8.8
  CVE-2025-24284 CVSS:8.8 This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be…
• CVE-2026-7870 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due CVE-2026-7870High 8.8
  CVE-2026-7870 CVSS:8.8 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could…
• CVE-2026-6211 Unrestricted upload of file with dangerous type vulnerability in Global IT Infor CVE-2026-6211High 8.7
  CVE-2026-6211 CVSS:8.7 Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc. WEOLL allows Accessing…
• CVE-2026-47135 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.fo CVE-2026-47135High 8.7
  CVE-2026-47135 CVSS:8.7 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9…
• CVE-2026-45674 Netty is a network application framework for development of protocol servers and CVE-2026-45674High 8.7
  CVE-2026-45674 CVSS:8.7 Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and…
• CVE-2026-44494 Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to CVE-2026-44494High 8.7
  CVE-2026-44494 CVSS:8.7 Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a…
• CVE-2026-54410 nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_ms CVE-2026-54410High 8.6
  CVE-2026-54410 CVSS:8.6 nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server that…
• CVE-2026-47209 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseH CVE-2026-47209High 8.6
  CVE-2026-47209 CVSS:8.6 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the…
• CVE-2026-47139 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM su CVE-2026-47139High 8.6
  CVE-2026-47139 CVSS:8.6 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the…
• CVE-2026-47368 A malicious actor with access to the network could exploit a Path Traversal vuln CVE-2026-47368High 8.6
  CVE-2026-47368 CVSS:8.6 A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to…
• CVE-2026-44492 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32. CVE-2026-44492High 8.6
  CVE-2026-44492 CVSS:8.6 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6…
• CVE-2026-54420 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn bef CVE-2026-54420High 8.5
  CVE-2026-54420 CVSS:8.5 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user…
• CVE-2026-54413 driftregion iso14229 through 0.9.0 contains an integer underflow and downstream CVE-2026-54413High 8.2
  CVE-2026-54413 CVSS:8.2 driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess()…
• CVE-2026-54412 LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read CVE-2026-54412High 8.2
  CVE-2026-54412 CVSS:8.2 LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the…
• CVE-2026-49982 tmp is a temporary file and directory creator for node.js. In version 0.2.6, the CVE-2026-49982High 8.2
  CVE-2026-49982 CVSS:8.2 tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string…
• CVE-2026-7368 The Yarbo cloud does not enforce per-device or per-user authorization. Any clien CVE-2026-7368High 8.1
  CVE-2026-7368 CVSS:8.1 The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared…
• CVE-2026-50633 A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integrati CVE-2026-50633High 8.1
  CVE-2026-50633 CVSS:8.1 A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an…
• CVE-2026-50632 A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS c CVE-2026-50632High 8.1
  CVE-2026-50632 CVSS:8.1 A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been…
• CVE-2026-11846 The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has CVE-2026-11846High 8.1
  CVE-2026-11846 CVSS:8.1 The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing…
• CVE-2026-48610 Under certain network configurations, a malicious actor with access to network c CVE-2026-48610High 8.1
  CVE-2026-48610 CVSS:8.1 Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability…
• CVE-2026-53777 Perry before 0.5.1159 contains a path traversal vulnerability that allows a mali CVE-2026-53777High 8.1
  CVE-2026-53777 CVSS:8.1 Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any…
• CVE-2026-48612 Improper state verification in the OAuth implementation could allow an attacker CVE-2026-48612High 8.0
  CVE-2026-48612 CVSS:8.0 Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a…
• CVE-2026-12191 A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the fun CVE-2026-12191High 7.8
  CVE-2026-12191 CVSS:7.8 A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file…
• CVE-2026-54228 A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D CVE-2026-54228High 7.8
  CVE-2026-54228 CVSS:7.8 A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump…
• CVE-2025-31272 The issue was addressed with improved checks. This issue is fixed in macOS Sequo CVE-2025-31272High 7.8
  CVE-2025-31272 CVSS:7.8 The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint…
• CVE-2026-6428 SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.3 CVE-2026-6428High 7.6
  CVE-2026-6428 CVSS:7.6 SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11,…
• CVE-2026-11774 An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server CVE-2026-11774High 7.6
  CVE-2026-11774 CVSS:7.6 An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding…
• CVE-2026-9848 The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPr CVE-2026-9848High 7.5
  CVE-2026-9848 CVSS:7.5 The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and…
• CVE-2026-46340 Netty is a network application framework for development of protocol servers and CVE-2026-46340High 7.5
  CVE-2026-46340 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to…
• CVE-2026-45416 Netty is a network application framework for development of protocol servers and CVE-2026-45416High 7.5
  CVE-2026-45416 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and…
• CVE-2026-44894 Netty is a network application framework for development of protocol servers and CVE-2026-44894High 7.5
  CVE-2026-44894 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used…
• CVE-2026-44893 Netty is a network application framework for development of protocol servers and CVE-2026-44893High 7.5
  CVE-2026-44893 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions…
• CVE-2026-50645 There is no restriction on the amount of attachment headers that a message can c CVE-2026-50645High 7.5
  CVE-2026-50645 CVSS:7.5 There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can…
• CVE-2026-44892 Netty is a network application framework for development of protocol servers and CVE-2026-44892High 7.5
  CVE-2026-44892 CVSS:7.5 Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default…
• CVE-2025-46315 A permissions issue was addressed with additional restrictions. This issue is fi CVE-2025-46315High 7.5
  CVE-2025-46315 CVSS:7.5 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access…
• CVE-2026-46697 Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5 CVE-2026-46697High 7.5
  CVE-2026-46697 CVSS:7.5 Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST…
• CVE-2026-44496 Axios is a promise based HTTP client for the browser and Node.js. Axios versions CVE-2026-44496High 7.5
  CVE-2026-44496 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the…
• CVE-2026-44488 Axios is a promise based HTTP client for the browser and Node.js. Axios versions CVE-2026-44488High 7.5
  CVE-2026-44488 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured…
• CVE-2026-44487 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32. CVE-2026-44487High 7.5
  CVE-2026-44487 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward…
• CVE-2026-44486 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32. CVE-2026-44486High 7.5
  CVE-2026-44486 CVSS:7.5 Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak…
• CVE-2026-7787 IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read o CVE-2026-7787High 7.5
  CVE-2026-7787 CVSS:7.5 IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing…
• CVE-2026-50631 A race condition in AbstractOAuthDataProvider allows concurrent requests using t CVE-2026-50631High 7.4
  CVE-2026-50631 CVSS:7.4 A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics…
• CVE-2026-12066 A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability CVE-2026-12066High 7.3
  CVE-2026-12066 CVSS:7.3 A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file…
• CVE-2026-48546 KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an at CVE-2026-48546High 7.3
  CVE-2026-48546 CVSS:7.3 KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the…
• CVE-2026-5513 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre CVE-2026-5513High 7.2
  CVE-2026-5513 CVSS:7.2 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
• CVE-2026-9109 The GPTranslate – Multilingual AI Translation for WordPress: Automatically Trans CVE-2026-9109High 7.2
  CVE-2026-9109 CVSS:7.2 The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to…
• CVE-2026-11845 The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has CVE-2026-11845High 7.2
  CVE-2026-11845 CVSS:7.2 The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing…
• CVE-2026-47366 Improper verification of access permissions when modifying permissions through t CVE-2026-47366High 7.2
  CVE-2026-47366 CVSS:7.2 Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an…
• CVE-2026-54230 A symlink following vulnerability was found in the ABRT post-create event handle CVE-2026-54230High 7.0
  CVE-2026-54230 CVSS:7.0 A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output…
• CVE-2026-54229 A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir meth CVE-2026-54229High 7.0
  CVE-2026-54229 CVSS:7.0 A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with…
• CVE-2026-44495 Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to CVE-2026-44495High 7.0
  CVE-2026-44495 CVSS:7.0 Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains…

⚔️ Sploitus（74 条）

Unknown (74 条)

• Exploit for CVE-2026-36826 exploit CVE-2026-36826
  Exploit for CVE-2026-36826 exploit
• Exploit for CVE-2022-30190 exploit CVE-2022-30190
  Exploit for CVE-2022-30190 exploit

…另有 72 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-15 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV