🤖 今日安全态势分析

🎯 今日重点关注

• Crawl4AI Docker API 多重漏洞 (GHSA-365w-hqf6-vxfg, CVSS 9.1)：影响 Crawl4AI Docker 服务端点，组合了文件写入、SSRF 及认证缺陷，攻击者可远程实现未授权控制。
• Langflow IDOR 与任意文件读取 (CVE-2026-55255 / CVE-2026-55447)：允许已认证攻击者越权执行他人工作流，并可通过 BaseFileComponent 读取服务器敏感文件，进而组合为 RCE。
• Fortra BoKS 命令注入 (CVE-2026-9862, CVSS 9.8)：远程攻击者利用 boks_autoregisterd 服务中的 OS 命令注入漏洞，无需认证即可执行任意系统命令，影响核心特权访问管理。
• LobeHub 未认证 SSRF (CVE-2026-54157)：任何人可利用 /webapi/proxy 端点发起服务器端请求伪造，劫持 cookie 或进行内网探测。
• Rclone 未认证命令执行 (CVE-2026-49980)：通过 rclone rcd 服务可接受未授权的 GET 请求，解析远程路径导致任意命令执行，威胁数据安全。

📈 威胁趋势

• 远程代码执行 (RCE)：Fortra BoKS (CVE-2026-9862/9863)、Crawl4AI AST 沙盒逃逸 (CVE-2026-53753)、Rclone (CVE-2026-49980) 均为高危 RCE，部分无需认证，影响严重。
• 身份认证与访问控制漏洞：Langflow IDOR (CVE-2026-55255)、OpenRemote 跨租户 IDOR 及 LiteLLM 主机头绕过，均导致已认证用户越权操作或绕过认证。
• 服务端请求伪造 (SSRF)：LobeHub /webapi/proxy 端点及 Crawl4AI 内置 SSRF，可被用于内网扫描及信息窃取。
• 信息泄露与文件操作：Langflow 任意文件读取 (CVE-2026-55447) 及 Mastodon 缺失条件检查 (CVE-2026-47777) 可泄露敏感数据。

🛡️ 缓解建议

• 立即隔离或升级受影响容器：针对 Crawl4AI Docker、具体分析其 API 暴露端点，确保非必要端口不对外开放；升级至官方已修复版本。
• 限制 Langflow 访问：立即审查 /api/v1/responses 与 BaseFileComponent 相关节点，启用严格的身份验证和授权检查，并更新至安全版本。
• 更新 Fortra BoKS 并加固服务：将 BoKS Manager 更新至最新补丁，同时对 boks_autoregisterd 服务使用防火墙限制访问来源，禁用不必要的 CLI 接口。
• 修复网络服务端点：检查 LobeHub 的 /webapi/proxy 与 Rclone rcd 端点，限制请求方法、添加认证并对输入 URL 进行白名单校验。

🚨 CISA-KEV（1 条）

Unknown (1 条)

• CVE-2026-48907 - Widget Factory Joomla Content Editor Improper Access Control Vulnerability CVE-2026-48907
  CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability 产品: Widget Factory Joomla Content Editor 描述: Widget Factory Joomla…

🐙 GitHub-Advisory（106 条）

Critical (8 条)

• GHSA-365w-hqf6-vxfg - Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, X Critical 9.1
  Summary Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs,…
• CVE-2026-55255 - Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticate CVE-2026-55255Critical
  ## Summary Insecure Direct Object Reference (IDOR) vulnerability in `/api/v1/responses` endpoint allows an authenticated attacker to execute any flow belonging…
• CVE-2026-55447 - Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit CVE-2026-55447Critical
  Summary All components based on `BaseFileComponent` are vulnerable to the following vulnerability: 1. Docling (`DoclingInlineComponent`) 2. Docling Serve…
• GHSA-h3m5-97jq-qjrf - OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete) Critical
  Summary OpenRemote Manager is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the bulk alarm deletion endpoint. An authenticated user…
• CVE-2026-53753 - Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker CVE-2026-53753Critical
  Summary The `_safe_eval_expression()` function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore.…
• CVE-2026-54157 - LobeHub: Unauthenticated SSRF in `/webapi/proxy` CVE-2026-54157Critical
  ## Unauthenticated SSRF in /webapi/proxy allows anyone to proxy requests and inject cookies on lobehub.com ## Summary The `/webapi/proxy` endpoint on…
• CVE-2026-49468 - LiteLLM: Authentication Bypass via Host Header Injection CVE-2026-49468Critical
  Impact A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth…
• CVE-2026-49980 - Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline CVE-2026-49980Critical
  ## Summary `rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form: ```text /[remote:path]/object ``` The `remote` value…

High (45 条)

• CVE-2026-55446 - Langflow: Unauthenticated DoS through multipart form boundary file upload CVE-2026-55446High
  Summary An attacker can send a `/api/v1/files/upload/` request without any authentication token/cookies and abuse a very long multipart form boundary to make…
• CVE-2026-55692 - StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wg CVE-2026-55692High
  Summary With $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data attribute`data-mw-iframeconfig`. When given…
• CVE-2026-55878 - symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Craf CVE-2026-55878High
  Description The `ux:install` console command installs files from a recipe kit by copying paths listed in a `copy-files` map. The only guard against malicious…
• GHSA-2fmp-9rvw-hc96 - Network-AI: Poisoned environment backup manifest allows arbitrary recursive dele High
  Summary `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()`…
• GHSA-xcqx-9jf5-w339 - SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `we High
  ## Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read` Summary The `web_url_read` MCP tool in mcp-searxng enforces its 5 MiB response-size…
• GHSA-mrvx-jmjw-vggc - SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read` High
  ## DNS-resolved Private Hostname SSRF in `web_url_read` Summary The `web_url_read` MCP tool in `mcp-searxng` is vulnerable to Server-Side Request Forgery…
• GHSA-6vxv-wg6j-5qwp - Gogs: XSS in .ipynb files renderer due to outdated notebookjs High
  Summary Gogs renders Jupyter notebook files (`.ipynb`) using [jsvine/notebookjs](https://github.com/jsvine/notebookjs), but the version is outdated, missing…
• GHSA-6v7p-g79w-8964 - MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a cau High
  Impact If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. If the Unpacker is used repeatedly to unpack untrusted…
• GHSA-x26h-xmv8-gxf7 - stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind High
  Summary On a multi-tenant stigmem node, RTBF (right-to-be-forgotten) tombstones were mis-scoped two ways. (1) `issue_tombstone` defaulted the tenant to…
• GHSA-xhv3-q4xx-349r - stistigmem-node: quarantine review surface exposes and mutates other tenants' qu High
  Summary On a multi-tenant stigmem node, a tenant administrator could list, read, and **admit or reject** quarantined facts belonging to **other** tenants. The…
• GHSA-6gqw-jqv7-v88m - stigmem-node: decay sweep expires and counts facts across all tenants (cross-ten High
  Summary On a multi-tenant stigmem node, a caller holding a `write` credential for **one** tenant can run a decay sweep that acts on **every** tenant's facts.…
• GHSA-v3f4-w7r7-v3hm - Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost request High
  ## Impact Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before…
• GHSA-c795-2g9c-j48m - EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id High
  EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. The per-message sender_id field was not…
• GHSA-x975-rgx4-5fh4 - appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGenerato High
  ## Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI) Summary `appium-mcp`'s `createLocatorGeneratorUI` function interpolates…
• GHSA-c3xh-98xp-6qhf - githubtoplanguages: Command Injection via Issue Title in Discord Notification Wo High
  Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and…
• GHSA-f4xh-w4cj-qxq8 - LangSmith SDK TracingMiddleware: Arbitrary server-side file read High
  # Summary An attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file…
• GHSA-h5x8-xp6m-x6q4 - @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Sign High
  ## Arbitrary Cloudinary API Parameter Signing in @jhb.software/payload-cloudinary-plugin Summary `@jhb.software/payload-cloudinary-plugin` v0.3.4 exposes a…
• GHSA-g2gw-q38m-vjfc - Lokka: Azure Resource Manager URL path validation issue High
  Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Specially…
• GHSA-cc8f-fcx3-gpjr - SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter High
  SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (`DEFINE ANALYZER ... FILTERS…
• GHSA-869j-r97x-hx2g - Anki's local HTTP server does not sufficiently validate requests High
  ## Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. The server fails to validate requests in the…
• CVE-2026-49402 - Deno: Command Injection via spawnSync & spawn on Windows CVE-2026-49402High
  ## Summary Deno's `node:child_process` implementation provided an `escapeShellArg()` helper used when callers passed `shell: true` to `spawn` / `spawnSync` /…
• CVE-2026-49440 - Deno: Miller-Rabin Primality Test Allows Zero Rounds CVE-2026-49440High
  ## Summary `node:crypto.checkPrime(candidate[, options][, callback])` and `crypto.checkPrimeSync(candidate[, options])` ran no Miller-Rabin rounds at all when…
• CVE-2026-50023 - yt-dlp: Dangerous file type creation via insufficient filename sanitization (Byp CVE-2026-50023High
  Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the…
• CVE-2026-53754 - Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / CVE-2026-53754High
  Summary The Docker API server's SSRF protection (`validate_webhook_url` / `validate_url_destination` in `deploy/docker/utils.py`) used an explicit IPv4/IPv6…
• GHSA-f989-c77f-r2cq - Crawl4AI: LLM credential exfiltration in Docker server via request base_url and High
  Summary The Docker API server let a request control where LLM calls were sent and which environment variable an LLM token resolved from. Both could be abused…
• GHSA-7cx2-g3h9-382p - Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header inje High
  Summary Three backward-compatible hardening fixes in the Docker API server. The headline issue is an arbitrary file write via the screenshot/PDF `output_path`.…
• CVE-2026-53755 - Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SS CVE-2026-53755High
  Summary The Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could…
• CVE-2026-53622 - Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mix CVE-2026-53622High
  ## Summary There is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass…
• CVE-2026-54321 - Daytona: Public sandbox previews remain accessible for up to one hour after bein CVE-2026-54321High
  Summary Sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a…
• CVE-2026-50574 - yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVE-2026-50574High
  Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input…
• CVE-2026-52844 - Caddy: Windows `file_server` path authorization bypass via encoded backslash CVE-2026-52844High
  Summary On Windows, Caddy `path` matchers treat `/private\secret.txt` as outside `/private/*`, but `file_server` later resolves the same request path as…
• CVE-2026-52845 - Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` CVE-2026-52845High
  Summary `forward_auth copy_headers` deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the…
• CVE-2026-54322 - Daytona: Cross-org IDOR in organization role update/delete — any org owner can r CVE-2026-54322High
  Summary Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved…
• GHSA-69qj-pvh9-c5wg - yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp High
  Summary yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting…
• CVE-2026-54312 - n8n: Microsoft SQL Node Prototype Pollution CVE-2026-54312High
  ## Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying…
• CVE-2026-54302 - n8n: Stored XSS in Chat Trigger Node CVE-2026-54302High
  ## Impact An authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious…
• CVE-2026-54307 - n8n: Credential Exfiltration via Permission Bypass CVE-2026-54307High
  ## Impact A member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential…
• CVE-2026-54305 - n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints CVE-2026-54305High
  ## Impact Three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope…
• CVE-2026-54309 - n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions CVE-2026-54309High
  ## Impact When `@n8n/mcp-browser` is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any…
• CVE-2026-54304 - n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host CVE-2026-54304High
  ## Impact An authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could…
• CVE-2026-28744 - Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens CVE-2026-28744High
  Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart HTTP path, however, this check runs only…
• CVE-2026-52797 - Gogs: Overwriting critical files results in a denial of service CVE-2026-52797High
  **Vulnerability type:** Path Traversal **Impact:** DoS **Exploitation prerequisite:** authorized user **Description:** As an authorized user, an intruder can…
• CVE-2026-28699 - Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authenticatio CVE-2026-28699High
  Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2…
• CVE-2026-26231 - Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthoriz CVE-2026-26231High
  ## Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all…
• CVE-2026-48526 - PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when m CVE-2026-48526High
  > [!NOTE] > Exploitation requires a verifier configured with both symmetric and asymmetric algorithms in `algorithms=[…]` and a raw-JSON JWK as the `key=`…

Medium (46 条)

• GHSA-jvcm-f35g-w78p - Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside th Medium 3.1
  Summary `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A…
• CVE-2026-55187 - Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechan CVE-2026-55187Medium
  ## Summary The remediation shipped in mailpit v1.29.2 for [GHSA-mpf7-p9x7-96r3](https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3)…
• CVE-2026-55195 - py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction CVE-2026-55195Medium
  py7zr's `Worker.decompress()` extracts archive entries without tracking total decompressed size. A crafted `.7z` file can exhaust disk or memory before the…
• CVE-2026-55206 - py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read() CVE-2026-55206Medium
  Summary PackInfo._read() uses an O(n^2) cumulative sum pattern where numstreams is read directly from the archive header. A crafted .7z archive with a large…
• CVE-2026-55423 - Langflow: Logout button does not clear session CVE-2026-55423Medium
  Summary The logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. Details Not in auto login mode.…
• CVE-2026-55650 - Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposu CVE-2026-55650Medium
  ## Summary A Stored Cross-Site Scripting (XSS) issue previously existed in the Text Widget in Board of Outerbase Studio where unsanitized HTML could be…
• CVE-2026-55770 - OpenBao: LDAPi ldaputil (wrong escape func) CVE-2026-55770Medium
  ## 1. Description Component `sdk/helper/ldaputil/client.go` — the shared LDAP utility library used by both the LDAP authentication backend and OpenLDAP secrets…
• CVE-2026-55776 - OpenBao: Transit secrets engine crashes on key creation with `derived: true` for CVE-2026-55776Medium
  On OpenBao 2.5.4 and 2.5.2(and likely earlier versions also), an authenticated caller with write access to `transit/keys/*` can crash the OpenBao server by…

…另有 38 条 Medium 级漏洞（已省略）

Low (7 条)

• CVE-2026-55774 - OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revo CVE-2026-55774Low
  Summary OpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases in any other namespace as long as the lease…
• CVE-2026-55775 - OpenBao's System Backend allows Unauthorized Management of the containing Namesp CVE-2026-55775Low
  Summary A user that is granted namespace management (`/sys/namespaces`) capabilities within a non-root namespace ("the victim namespace") can abuse special…
• CVE-2026-55866 - SpiceDB: Checks involving relations with caveats can result in unconditional per CVE-2026-55866Low
  Impact Under concurrency, `CheckPermission` and `CheckBulkPermissions` can return `PERMISSIONSHIP_HAS_PERMISSION` for a (resource, permission, subject) whose…

…另有 4 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（3 条）

Critical (1 条)

• CVE-2026-9862 Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection CVE-2026-9862Critical 9.8
  CVE-2026-9862 CVSS:9.8 Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A…

High (2 条)

• CVE-2026-47777 Mastodon is a free, open-source social network server based on ActivityPub. In v CVE-2026-47777High 7.5
  CVE-2026-47777 CVSS:7.5 Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if…
• CVE-2026-9863 Fortra BoKS Manager contains an OS command injection vulnerability in the client CVE-2026-9863High 7.5
  CVE-2026-9863 CVSS:7.5 Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client…

⚔️ Sploitus（90 条）

Unknown (90 条)

• Exploit for CVE-2026-11551 exploit CVE-2026-11551
  Exploit for CVE-2026-11551 exploit
• Exploit for Execution with Unnecessary Privileges in Percona Monitoring_And_Management exploit
  Exploit for Execution with Unnecessary Privileges in Percona Monitoring_And_Management exploit

…另有 88 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-20 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV