🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-52704 (CVSS 10.0) – WooCommerce PDF Invoice Builder： 插件存在代码注入漏洞，远程攻击者无需认证即可实现远程代码执行，影响版本低于 2.0.9。该插件广泛部署于电商站点，风险极高。
• CVE-2026-53753 (CVSS 9.1？) – Crawl4AI AST沙箱逃逸： 计算字段功能中的 `_safe_eval_expression()` 函数仅拦截下划线开头的属性，攻击者可利用 `gi_frame.f_back` 链绕过沙箱，在未授权情况下实现远程代码执行。
• CVE-2026-49468 (CVSS 9.8) – LiteLLM 认证绕过： 代理服务因Host Header解析缺陷，攻击者可通过构造特殊请求绕过认证，未授权访问受保护的管理路由，导致敏感信息泄露或服务控制权丢失。
• CVE-2026-54157 (Critical) – LobeHub 未授权SSRF： `/webapi/proxy` 端点未进行认证与URL校验，允许任何人发起服务器端请求伪造，可导致内网探测、凭证窃取或Cookie注入。

📈 威胁趋势

• 远程代码执行（RCE）及代码注入： 今日高危漏洞中占比最高，达6个以上。涉及 WooCommerce PDF插件、Crawl4AI、Deno (Windows)、Fortra BoKS、Pizzy Library等。攻击面覆盖Web应用、开发框架及基础组件。
• 权限提升与认证绕过： 共4个漏洞。LiteLLM的Host Header注入可导致未授权访问管理面板；WP MAPS PRO插件注册未认证AJAX接口，攻击者可利用公开nonce创建管理员账户；Masteriyo LMS存在越权漏洞。
• 服务端请求伪造（SSRF）： 出现2个关键SSRF漏洞，分别位于 LobeHub 和 Crawl4AI，均可作为内网横向移动的跳板。
• 文件上传与任意文件写入： 多个WordPress插件（如Baggage Freight Shipping、Ultimate Product Catalog）依然存在老式文件上传漏洞，攻击者可上传WebShell。
• 缓冲区与内存问题： Electron的`Buffer` API计算错误可能导致崩溃或内存分配异常，影响大量桌面应用。

🛡️ 缓解建议

• 立即升级受影响软件： 优先升级 WooCommerce PDF Invoice Builder 至 2.0.9 及以上、LiteLLM 至最新修复版、WP MAPS PRO 至 6.1.1。同步检查并升级 Crawl4AI、LobeHub、Rclone、Deno、Electron 至各自修复版本。
• 实施网络访问控制： 对暴露在公网的LobeHub `/webapi/proxy` 端点、Crawl4AI Docker API端口、LiteLLM管理接口、以及BoKS的boks_autoregisterd服务进行白名单策略，禁止不必要的公网访问。
• 审查并启用安全配置： 检查所有WordPress站点，禁用或加固存在漏洞的插件（尤其含文件上传、SSRF、非认证AJAX的插件）。禁用或修复Crawl4AI中AST沙箱的`_safe_eval_expression()`函数。对Rclone的`rclone rcd`服务务必启用强制认证。

🚨 CISA-KEV（1 条）

Unknown (1 条)

• CVE-2026-48907 - Widget Factory Joomla Content Editor Improper Access Control Vulnerability CVE-2026-48907
  CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability 产品: Widget Factory Joomla Content Editor 描述: Widget Factory Joomla…

🐙 GitHub-Advisory（100 条）

Critical (7 条)

• GHSA-365w-hqf6-vxfg - Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, X Critical 9.1
  Summary Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs,…
• CVE-2026-53753 - Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker CVE-2026-53753Critical
  Summary The `_safe_eval_expression()` function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore.…
• CVE-2026-54157 - LobeHub: Unauthenticated SSRF in `/webapi/proxy` CVE-2026-54157Critical
  ## Unauthenticated SSRF in /webapi/proxy allows anyone to proxy requests and inject cookies on lobehub.com ## Summary The `/webapi/proxy` endpoint on…
• CVE-2026-49468 - LiteLLM: Authentication Bypass via Host Header Injection CVE-2026-49468Critical
  Impact A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth…
• CVE-2026-49980 - Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline CVE-2026-49980Critical
  ## Summary `rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form: ```text /[remote:path]/object ``` The `remote` value…
• CVE-2026-53633 - Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config File CVE-2026-53633Critical
  ## Summary Vitest Browser Mode exposes a `cdp()` API that forwards raw Chrome DevTools Protocol (CDP) methods over the Vitest browser WebSocket RPC. CDP is not…
• CVE-2026-54257 - Electron: Buffer performs incorrect byte length calculations resulting in heap b CVE-2026-54257Critical
  Impact Most apps will crash and some may perform incorrect buffer allocations in the Node.js `Buffer` API resulting in unexpected truncation or allocation.…

High (38 条)

• CVE-2026-49402 - Deno: Command Injection via spawnSync & spawn on Windows CVE-2026-49402High
  ## Summary Deno's `node:child_process` implementation provided an `escapeShellArg()` helper used when callers passed `shell: true` to `spawn` / `spawnSync` /…
• CVE-2026-49440 - Deno: Miller-Rabin Primality Test Allows Zero Rounds CVE-2026-49440High
  ## Summary `node:crypto.checkPrime(candidate[, options][, callback])` and `crypto.checkPrimeSync(candidate[, options])` ran no Miller-Rabin rounds at all when…
• CVE-2026-50023 - yt-dlp: Dangerous file type creation via insufficient filename sanitization (Byp CVE-2026-50023High
  Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the…
• CVE-2026-53754 - Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / CVE-2026-53754High
  Summary The Docker API server's SSRF protection (`validate_webhook_url` / `validate_url_destination` in `deploy/docker/utils.py`) used an explicit IPv4/IPv6…
• GHSA-f989-c77f-r2cq - Crawl4AI: LLM credential exfiltration in Docker server via request base_url and High
  Summary The Docker API server let a request control where LLM calls were sent and which environment variable an LLM token resolved from. Both could be abused…
• GHSA-7cx2-g3h9-382p - Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header inje High
  Summary Three backward-compatible hardening fixes in the Docker API server. The headline issue is an arbitrary file write via the screenshot/PDF `output_path`.…
• CVE-2026-53755 - Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SS CVE-2026-53755High
  Summary The Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could…
• CVE-2026-53622 - Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mix CVE-2026-53622High
  ## Summary There is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass…
• CVE-2026-54321 - Daytona: Public sandbox previews remain accessible for up to one hour after bein CVE-2026-54321High
  Summary Sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a…
• CVE-2026-50574 - yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVE-2026-50574High
  Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input…
• CVE-2026-52844 - Caddy: Windows `file_server` path authorization bypass via encoded backslash CVE-2026-52844High
  Summary On Windows, Caddy `path` matchers treat `/private\secret.txt` as outside `/private/*`, but `file_server` later resolves the same request path as…
• CVE-2026-52845 - Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` CVE-2026-52845High
  Summary `forward_auth copy_headers` deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the…
• CVE-2026-54322 - Daytona: Cross-org IDOR in organization role update/delete — any org owner can r CVE-2026-54322High
  Summary Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved…
• GHSA-69qj-pvh9-c5wg - yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp High
  Summary yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting…
• CVE-2026-54312 - n8n: Microsoft SQL Node Prototype Pollution CVE-2026-54312High
  ## Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying…
• CVE-2026-54302 - n8n: Stored XSS in Chat Trigger Node CVE-2026-54302High
  ## Impact An authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious…
• CVE-2026-54307 - n8n: Credential Exfiltration via Permission Bypass CVE-2026-54307High
  ## Impact A member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential…
• CVE-2026-54305 - n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints CVE-2026-54305High
  ## Impact Three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope…
• CVE-2026-54309 - n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions CVE-2026-54309High
  ## Impact When `@n8n/mcp-browser` is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any…
• CVE-2026-54304 - n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host CVE-2026-54304High
  ## Impact An authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could…
• CVE-2026-28744 - Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens CVE-2026-28744High
  Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only…
• CVE-2026-52797 - Gogs: Overwriting critical files results in a denial of service CVE-2026-52797High
  **Vulnerability type:** Path Traversal **Impact:** DoS **Exploitation prerequisite:** authorized user **Description:** As an authorized user, an intruder can…
• CVE-2026-28699 - Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authenticatio CVE-2026-28699High
  Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2…
• CVE-2026-26231 - Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthoriz CVE-2026-26231High
  ## Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all…
• CVE-2026-48526 - PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when m CVE-2026-48526High
  > [!NOTE] > Exploitation requires a verifier configured with both symmetric and asymmetric algorithms in `algorithms=[…]` and a raw-JSON JWK as the `key=`…
• CVE-2026-45591 - Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vuln CVE-2026-45591High
  ## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core SignalR and Blazor Server. This…
• GHSA-537c-gmf6-5ccf - Vulnerable OpenSSL included in cryptography wheels High
  pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to…
• CVE-2026-54271 - protobufjs-cli: Code injection in pbjs static output from crafted JSON descripto CVE-2026-54271High
  ## Summary A previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Affected versions of `protobufjs-cli` could…
• CVE-2026-48818 - Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Window CVE-2026-48818High
  Summary When serving static files on Windows, `StaticFiles` resolves the requested path with…
• CVE-2026-49855 - tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip CVE-2026-49855High
  Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will…
• CVE-2026-49853 - Tornado: Authorization header forwarded across cross-origin redirects in SimpleA CVE-2026-49853High
  ## Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and…
• CVE-2026-53539 - python-multipart: Quadratic-time querystring parsing with semicolon separators c CVE-2026-53539High
  Summary When parsing `application/x-www-form-urlencoded` bodies, `QuerystringParser` located the field separator with a two step lookup: it first scanned the…
• CVE-2026-54281 - Nest: Middleware Bypass on Fastify via Trailing Slash CVE-2026-54281High
  Impact An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of…
• CVE-2026-54283 - Starlette: request.form() limits silently ignored for application/x-www-form-url CVE-2026-54283High
  Summary `request.form()` accepts `max_fields` and `max_part_size` to bound resource consumption while parsing form data. These limits are enforced for…
• CVE-2026-48748 - Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion CVE-2026-48748High
  Summary A memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error.…
• CVE-2026-50010 - Netty: Wrapping plain trust manager silently disables hostname verification CVE-2026-50010High
  SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends…
• CVE-2026-50011 - Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length CVE-2026-50011High
  Summary RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is…
• CVE-2026-11417 - aws-cdk-lib: OS Command Injection in NodejsFunction Bundling CVE-2026-11417High
  Summary AWS CDK (`aws-cdk-lib`) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS…

Medium (40 条)

• CVE-2026-49859 - Deno: `fetch()` API sandbox bypass via missing DNS resolution check CVE-2026-49859Medium
  ## Summary When `fetch()` was called, Deno checked the destination hostname against `--deny-net` rules but did not re-check the IP addresses that hostname…
• CVE-2026-49860 - Deno: WebSocket API sandbox bypass via missing post-DNS check CVE-2026-49860Medium
  ## Summary When a WebSocket connection was opened, Deno checked the destination hostname against `--deny-net` rules but did not re-check the IP addresses that…
• CVE-2026-49983 - Deno: process.loadEnvFile() bypasses env permission checks and mutates process.e CVE-2026-49983Medium
  ## Summary In Deno, environment access is gated by the `env` permission. You can deny it with `--deny-env`, or restrict it to a specific allowlist with…
• CVE-2026-49411 - Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny c CVE-2026-49411Medium
  ## Summary Deno's network permission model is designed so that `--deny-net` rules apply to the **resolved IP address** of a destination, not just the literal…
• CVE-2026-49406 - Deno: BYONM module resolution allows `package.json` main path traversal to bypas CVE-2026-49406Medium
  ## Summary When Deno was run in BYONM mode (`nodeModulesDir: "manual"`), the module resolver did not validate that a package's resolved entrypoint stayed…
• CVE-2026-49401 - Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) CVE-2026-49401Medium
  ## Summary Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to `--deny-read`,…
• CVE-2026-50133 - Hugo: XSS via text/html content files CVE-2026-50133Medium
  **Commit:** [e41a06447d](https://github.com/gohugoio/hugo/commit/e41a06447d) — _Disallow HTML content by default_ **Affected versions:** all Hugo versions…
• CVE-2026-50134 - Hugo: security.http.urls allow-list bypass via HTTP redirects CVE-2026-50134Medium
  **Commit:** [86fbb0f7a8](https://github.com/gohugoio/hugo/commit/86fbb0f7a8) — _security: Validate redirects against security.http.urls_ **Affected versions:**…

…另有 32 条 Medium 级漏洞（已省略）

Low (15 条)

• GHSA-m3q2-p4fw-w38m - Cross-site scripting via <NoScript> slot content in Nuxt's head components Low
  Impact Nuxt's globally registered `<NoScript>` component (from `@unhead/vue` head components, re-exported by Nuxt) wrote its default-slot content to the…
• CVE-2026-54326 - Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization by CVE-2026-54326Low
  # Potential XSS in HTML session exports via Markdown URL handling Pi HTML exports render session Markdown into a static HTML file. Affected versions did not…
• GHSA-x4vx-rjvf-j5p4 - DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-for Low
  ## Summary When `DOMPurify.sanitize(root, { IN_PLACE: true })` is called on an attacker-supplied live DOM node, `DOMPurify` still trusts `currentNode.nodeName`…

…另有 12 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（39 条）

Critical (4 条)

• CVE-2026-52704 Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar CVE-2026-52704Critical 10.0
  CVE-2026-52704 CVSS:10.0 Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote…
• CVE-2026-9862 Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection CVE-2026-9862Critical 9.8
  CVE-2026-9862 CVSS:9.8 Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A…
• CVE-2018-25436 WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestrict CVE-2018-25436Critical 9.8
  CVE-2018-25436 CVSS:9.8 WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows…
• CVE-2026-8935 The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX CVE-2026-8935Critical 9.8
  CVE-2026-8935 CVSS:9.8 The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly…

High (35 条)

• CVE-2026-5242 Improper neutralization of formula elements in a CSV file vulnerability in MIA T CVE-2026-5242High 8.8
  CVE-2026-5242 CVSS:8.8 Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This…
• CVE-2026-49111 Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allow CVE-2026-49111High 8.8
  CVE-2026-49111 CVSS:8.8 Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo -…
• CVE-2026-49062 Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Eng CVE-2026-49062High 8.8
  CVE-2026-49062 CVSS:8.8 Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation.…
• CVE-2016-20075 WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulne CVE-2016-20075High 8.8
  CVE-2016-20075 CVSS:8.8 WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with…
• CVE-2026-12192 A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown funct CVE-2026-12192High 8.8
  CVE-2026-12192 CVSS:8.8 A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component Web Server. This manipulation…
• CVE-2026-12057 When the application executes the JavaScript script embedded in the PDF within t CVE-2026-12057High 8.6
  CVE-2026-12057 CVSS:8.6 When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous…
• CVE-2016-20073 Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerabil CVE-2016-20073High 8.2
  CVE-2016-20073 CVSS:8.2 Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute…
• CVE-2016-20072 BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerabili CVE-2016-20072High 8.2
  CVE-2016-20072 CVSS:8.2 BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute…
• CVE-2016-20071 The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthe CVE-2016-20071High 8.2
  CVE-2016-20071 CVSS:8.2 The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote…
• CVE-2016-20069 WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind CVE-2016-20069High 8.2
  CVE-2016-20069 CVSS:8.2 WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function…
• CVE-2016-20068 WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticat CVE-2016-20068High 8.2
  CVE-2016-20068 CVSS:8.2 WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote…
• CVE-2026-12222 A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the CVE-2026-12222High 8.0
  CVE-2026-12222 CVSS:8.0 A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function mod_webd.BlueToothTest of the file…
• CVE-2026-12221 A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the fun CVE-2026-12221High 8.0
  CVE-2026-12221 CVSS:8.0 A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the…
• CVE-2026-12220 A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects th CVE-2026-12220High 8.0
  CVE-2026-12220 CVSS:8.0 A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file…
• CVE-2026-12218 A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected eleme CVE-2026-12218High 8.0
  CVE-2026-12218 CVSS:8.0 A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file…
• CVE-2026-50100 Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPA CVE-2026-50100High 7.8
  CVE-2026-50100 CVSS:7.8 Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability.…
• CVE-2026-12217 A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impa CVE-2026-12217High 7.8
  CVE-2026-12217 CVSS:7.8 A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys…
• CVE-2026-12214 A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulner CVE-2026-12214High 7.8
  CVE-2026-12214 CVSS:7.8 A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW…
• CVE-2026-12193 A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affec CVE-2026-12193High 7.8
  CVE-2026-12193 CVSS:7.8 A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtl_Handler in the…
• CVE-2026-47777 Mastodon is a free, open-source social network server based on ActivityPub. In v CVE-2026-47777High 7.5
  CVE-2026-47777 CVSS:7.5 Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if…
• CVE-2026-9863 Fortra BoKS Manager contains an OS command injection vulnerability in the client CVE-2026-9863High 7.5
  CVE-2026-9863 CVSS:7.5 Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client…
• CVE-2026-5079 Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to CVE-2026-5079High 7.5
  CVE-2026-5079 CVSS:7.5 Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in…
• CVE-2026-49064 Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPa CVE-2026-49064High 7.5
  CVE-2026-49064 CVSS:7.5 Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue…
• CVE-2018-25437 WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulner CVE-2018-25437High 7.5
  CVE-2018-25437 CVSS:7.5 WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to…
• CVE-2016-20081 WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerabi CVE-2016-20081High 7.5
  CVE-2016-20081 CVSS:7.5 WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download…
• CVE-2016-20076 WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unau CVE-2016-20076High 7.5
  CVE-2016-20076 CVSS:7.5 WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and…
• CVE-2026-12204 A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects CVE-2026-12204High 7.3
  CVE-2026-12204 CVSS:7.3 A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function…
• CVE-2026-12200 A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 CVE-2026-12200High 7.3
  CVE-2026-12200 CVSS:7.3 A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the…
• CVE-2026-12198 A weakness has been identified in Microweber up to 2.0.20. This affects the func CVE-2026-12198High 7.3
  CVE-2026-12198 CVSS:7.3 A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file…
• CVE-2016-20084 WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escala CVE-2016-20084High 7.2
  CVE-2016-20084 CVSS:7.2 WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated…
• CVE-2016-20066 WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerabilit CVE-2016-20066High 7.2
  CVE-2016-20066 CVSS:7.2 WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts…
• CVE-2026-12197 A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted eleme CVE-2026-12197High 7.2
  CVE-2026-12197 CVSS:7.2 A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file…
• CVE-2026-5233 Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. P CVE-2026-5233High 7.1
  CVE-2026-5233 CVSS:7.1 Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy…
• CVE-2026-5230 Improper Access Control, Missing Authorization vulnerability in MIA Technology I CVE-2026-5230High 7.1
  CVE-2026-5230 CVSS:7.1 Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly…
• CVE-2019-25746 WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerab CVE-2019-25746High 7.1
  CVE-2019-25746 CVSS:7.1 WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate…

⚔️ Sploitus（60 条）

Unknown (60 条)

• vulnerability-playtest exploit
  vulnerability-playtest exploit
• Exploit for CVE-2026-39949 exploit CVE-2026-39949
  Exploit for CVE-2026-39949 exploit

…另有 58 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-17 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV