📊 2026-06-24 漏洞情报日报 · 200 条 · 高危 86
每日漏洞情报汇总 · 2026-06-24
📊 2026-06-24 漏洞情报日报
📋 共 200 条
🔥 高危/严重 86 条
🚨 CISA-KEV 4 条
🐙 GitHub-Advisory 50 条 🔥17
🛡️ NVD-Latest 69 条 🔥69
⚔️ Sploitus 77 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-52813 (Gogs，CVSS 未评但社区定为严重): 路径遍历漏洞。组织名称允许包含
../序列，导致仓库文件被写入任意路径，组合利用可实现远程代码执行 (RCE)。无需认证即可触发。 - CVE-2026-10561 (IBM Langflow OSS 1.0.0-1.9.3，CVSS 10.0): Python执行隔离不当 + 认证绕过。未认证攻击者可直接在宿主机上执行任意代码，影响Langflow的AI工作流运行环境。
- GHSA-qxvg-h7q2-hcxh (motionEye，严重): 多阶段攻击链：本地文件读取 (LFI) → 利用硬编码哈希登录admin → 恢复恶意备份 → 未授权RCE。攻击链完整且利用门槛低。
- CVE-2026-5366 (Prefect 3.6.23，CVSS 9.9): 远程代码执行。Git仓库类中
commit_sha参数未过滤直接拼入git命令，引发命令注入，危害高。 - CVE-2026-56265 (Crawl4AI < 0.8.7，CVSS 9.8): 认证绕过。Docker API服务器使用硬编码JWT签名密钥，攻击者可伪造任意用户令牌，完全接管系统。
📈 威胁趋势
- 远程代码执行 (RCE)： 占比最高。今日共出现 7 个严重/高危RCE漏洞，涵盖Gogs、Langflow、Prefect、motionEye、WooCommerce等，利用向量包括路径遍历、命令注入、Python隔离不当。
- 认证绕过/权限提升： 5个漏洞。涉及Crawl4AI（硬编码密钥）、Branda插件（账户接管）、Langflow、OpenAM以及WordPress插件，攻击者借此可获取高权限或完全接管系统。
- 信息泄露/路径遍历： 3个。如Gogs LFS泄露私有仓库内容、OpenAM跨域单点登录泄露会话令牌、motionEye的本地文件读取，常作为RCE攻击链的前置步骤。
- 多重漏洞组合链： 值得警惕。motionEye的LFI→哈希登录→RCE链，以及OpenAM令牌泄露可导致会话劫持，体现了单一漏洞被组合利用的真实威胁。
🛡️ 缓解建议
- 立即升级关键组件： 优先升级 Gogs、IBM Langflow（至1.9.4+）、Prefect（至3.6.24+）、Crawl4AI（至0.8.7+）及 Flowise（至2.1.4+）。对无法升级的资产部署WAF规则阻断利用流量。
- 加固认证与令牌管理： 检查所有系统的会话令牌、JWT密钥及硬编码凭证。立即更换Crawl4AI Docker实例的默认JWT密钥；对OpenAM等IAM系统启用令牌绑定或HttpOnly Cookie
- 实施输入验证与最小权限原则： 加固应用层对用户输入的过滤，特别是Git命令参数、路径字符串。监控异常文件写入操作，并限制容器的宿主机文件系统访问权限。
- 部署持续监控与联动告警： 针对motionEye、OpenAM等多阶段链式攻击，部署行为分析与关联规则（例如：LFI告警后紧随异常备份恢复操作），实现自动化阻断。
🚨 CISA-KEV（4 条）
Unknown (4 条)
- CVE-2026-34908 - Ubiquiti UniFi OS Improper Access Control Vulnerability
CVE-2026-34908
CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability 产品: Ubiquiti UniFi OS 描述: Ubiquiti UniFi OS contains an improper access control… - CVE-2026-34909 - Ubiquiti UniFi OS Path Traversal Vulnerability
CVE-2026-34909
CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability 产品: Ubiquiti UniFi OS 描述: Ubiquiti UniFi OS contains a path traversal vulnerability which could…
…另有 2 条 Unknown 级漏洞（已省略）
🐙 GitHub-Advisory（50 条）
Critical (4 条)
- CVE-2026-52813 - Gogs has Path Traversal in organization name that results in RCE through Git hoo
CVE-2026-52813Critical
Summary Organization names containing path traversal sequences (`../`) are accepted by Gogs, and repositories under them are written to paths following these… - CVE-2026-54350 - Budibase has nonymous NoSQL operator injection via published-app query templates
CVE-2026-54350Critical
## Summary `enrichContext` at `packages/server/src/sdk/workspace/queries/queries.ts:121-138` substitutes parameter values into the raw JSON body of a query,… - GHSA-qxvg-h7q2-hcxh - motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE) Critical
## Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines: 1. **Arbitrary file read (LFI)** via the picture download… - GHSA-phv5-334h-mxcw - motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft Critical
# Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal Summary Myself and others have reported several RCE vulnerabilities…
High (13 条)
- CVE-2026-52812 - Gogs: LFS dedupe path leaks private repo content across tenants
CVE-2026-52812High
Summary Git LFS storage is content-addressed by OID alone (`<LFS-root>/<oid[0]>/<oid[1]>/<oid>`) but per-repo authorization lives in the `lfs_object` table… - CVE-2026-45048 - OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
CVE-2026-45048High
## Summary Description An insufficient authorization (CWE-285) and information exposure (CWE-200) issue in OpenAM's session management endpoint allows a… - CVE-2026-45049 - OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
CVE-2026-45049High
## Summary **Description** An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in… - CVE-2026-55173 - AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allo
CVE-2026-55173High
Summary The fix for CVE-2026-33482 (GHSA-pmj8-r2j7-xg6c) is incomplete. That advisory reported that `sanitizeFFmpegCommand()`… - CVE-2026-53925 - Glances has arbitrary file write and command execution via `secure_popen` redire
CVE-2026-53925High
Summary The `secure_popen()` function in `glances/secure.py` interprets `>` (file redirection), `|` (pipe), and `&&` (command chaining) operators in command… - CVE-2026-54134 - OctoPrint has possible file exfiltration via query parameters on upload endpoint
CVE-2026-54134High
Impact OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD`… - CVE-2026-55441 - Mise vulnerable to arbitrary command execution via task-include files in an untr
CVE-2026-55441High
Summary mise's trust feature gates config files (`mise.toml`, `.tool-versions`) through `trust_check`, but task-include files are loaded on a path that never… - CVE-2026-55488 - motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File
CVE-2026-55488High
Summary mEye contains an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the… - CVE-2026-54512 - jackson-databind has a PolymorphicTypeValidator bypass via generic type paramete
CVE-2026-54512High
`jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled… - CVE-2026-54513 - jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeVa
CVE-2026-54513High
## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the… - CVE-2026-48126 - Algernon: Host header path traversal in --domain mode reads files and runs Lua f
CVE-2026-48126High
Summary When algernon is started with `--domain` (or `--letsencrypt`, which silently turns on `--domain` at `engine/flags.go:372`), the request handler… - CVE-2026-48507 - Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editi
CVE-2026-48507High
Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the… - CVE-2026-54329 - Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
CVE-2026-54329High
Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A…
Medium (30 条)
- CVE-2026-55863 - motionEye's missing authentication on ActionHandler allows unauthenticated camer
CVE-2026-55863Medium 3.1
## Summary The `ActionHandler.post()` method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions… - CVE-2026-52814 - Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake St
CVE-2026-52814Medium
The Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections… - CVE-2026-52815 - Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via
CVE-2026-52815Medium
## Summary Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at… - CVE-2026-35163 - OctoPrint has XSS in its Suppressed Command Notifications
CVE-2026-35163Medium
Impact OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML… - CVE-2026-52816 - Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data:
CVE-2026-52816Medium
## Summary The Jupyter Notebook (ipynb) sanitizer endpoint at `POST /-/api/sanitize_ipynb` allows arbitrary `data:` URIs without proper restrictions,… - CVE-2026-54557 - mise HTTP backend uses raw version path for install symlink destination
CVE-2026-54557Medium
## Summary The mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths… - CVE-2026-55448 - Mise's local credential_command executes untrusted config
CVE-2026-55448Medium
Summary `mise` loads `github.credential_command` from local project config before any trust decision, then executes that value with `sh -c` when resolving a… - GHSA-7cqp-7cfv-6c3q - AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User Medium
Summary The Meet plugin stores the raw HTTP `User-Agent` header of every meeting participant and later renders it without output encoding in the…
…另有 22 条 Medium 级漏洞（已省略）
Low (3 条)
- CVE-2026-48488 - phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
CVE-2026-48488Low
Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017… - CVE-2026-55519 - Snipe-IT has Improper Authorization in File Deletion (IDOR)
CVE-2026-55519Low
Impact A vulnerability was identified in Snipe-IT v8.4.0 (build 21280-g91a95dbc6) that allows any authenticated user with generic asset edit permissions to… - CVE-2026-55542 - Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
CVE-2026-55542Low
Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature…
🛡️ NVD-Latest（69 条）
Critical (14 条)
- CVE-2026-10561 IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper iso
CVE-2026-10561Critical 10.0
CVE-2026-10561 CVSS:10.0 IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an… - CVE-2026-5366 Prefect version 3.6.23 is vulnerable to remote code execution due to improper ha
CVE-2026-5366Critical 9.9
CVE-2026-5366 CVSS:9.9 Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository`… - CVE-2026-7664 IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to ac
CVE-2026-7664Critical 9.8
CVE-2026-7664 CVSS:9.8 IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP… - CVE-2026-56265 Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a h
CVE-2026-56265Critical 9.8
CVE-2026-56265 CVSS:9.8 Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API… - CVE-2024-58351 Flowise before 2.1.4 allows configuration to be injected into the Chainflow duri
CVE-2024-58351Critical 9.8
CVE-2024-58351 CVSS:9.8 Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported… - CVE-2022-50972 WooCommerce 7.1.0 contains a remote code execution vulnerability that allows att
CVE-2022-50972Critical 9.8
CVE-2022-50972 CVSS:9.8 WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell… - CVE-2019-25763 WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication
CVE-2019-25763Critical 9.8
CVE-2019-25763 CVSS:9.8 WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain… - CVE-2026-11551 The Branda plugin for WordPress is vulnerable to privilege escalation via accoun
CVE-2026-11551Critical 9.8
CVE-2026-11551 CVSS:9.8 The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including,… - CVE-2026-10789 A maliciously crafted webpage, when visited by a user with Autodesk Fusion Deskt
CVE-2026-10789Critical 9.6
CVE-2026-10789 CVSS:9.6 A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a… - CVE-2026-28381 The Snowflake datasource allows for GET/PUT commands, which can allow any user w
CVE-2026-28381Critical 9.6
CVE-2026-28381 CVSS:9.6 The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to… - CVE-2026-56397 SiYuan before v3.6.1 fails to sanitize package metadata and README content in th
CVE-2026-56397Critical 9.6
CVE-2026-56397 CVSS:9.6 SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package… - CVE-2026-56395 SiYuan before v3.6.1 fails to sanitize package metadata and README content in th
CVE-2026-56395Critical 9.6
CVE-2026-56395 CVSS:9.6 SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package… - CVE-2026-12628 IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snaps
CVE-2026-12628Critical 9.1
CVE-2026-12628 CVSS:9.1 IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a… - CVE-2026-11373 Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
CVE-2026-11373Critical 9.1
CVE-2026-11373 CVSS:9.1 Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite…
High (55 条)
- CVE-2026-56424 MISP core contained multiple broken access-control flaws where authorization che
CVE-2026-56424High 8.8
CVE-2026-56424 CVSS:8.8 MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where… - CVE-2026-56423 MISP Core contained broken access-control checks in the bulk deletion flows for
CVE-2026-56423High 8.8
CVE-2026-56423 CVSS:8.8 MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected… - CVE-2026-54099 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenS
CVE-2026-54099High 8.8
CVE-2026-54099 CVSS:8.8 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver… - CVE-2026-8157 The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles
CVE-2026-8157High 8.8
CVE-2026-8157 CVSS:8.8 The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of… - CVE-2026-56396 phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser
CVE-2026-56396High 8.8
CVE-2026-56396 CVSS:8.8 phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow… - CVE-2026-56340 vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in mul
CVE-2026-56340High 8.8
CVE-2026-56340 CVSS:8.8 vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables… - CVE-2026-56216 Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /fun
CVE-2026-56216High 8.8
CVE-2026-56216 CVSS:8.8 Capgo before 12.128.2 contains a scope escalation vulnerability in the POST /functions/v1/apikey endpoint that allows app-limited API… - CVE-2026-54100 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenS
CVE-2026-54100High 8.3
CVE-2026-54100 CVSS:8.3 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH… - CVE-2026-56215 Capgo before 12.128.12 allows authenticated users to modify their mutable public
CVE-2026-56215High 8.3
CVE-2026-56215 CVSS:8.3 Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO… - CVE-2026-56104 Chainlit before 2.10.1 contains a session hijacking vulnerability that allows un
CVE-2026-56104High 8.2
CVE-2026-56104 CVSS:8.2 Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit… - CVE-2026-9072 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSpher
CVE-2026-9072High 8.1
CVE-2026-9072 CVSS:8.1 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty - when using Intelligent… - CVE-2026-41045 A time-to-check-time-of-use in polkit authentication of qSnapper before version
CVE-2026-41045High 8.1
CVE-2026-41045 CVSS:8.1 A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers… - CVE-2023-45796 A stored cross-site scripting vulnerability in the Runtime component of Pilz PAS
CVE-2023-45796High 8.1
CVE-2023-45796 CVSS:8.1 A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including… - CVE-2025-66336 Apache Doris MCP Server contains a SQL injection vulnerability in a metadata que
CVE-2025-66336High 8.1
CVE-2025-66336 CVSS:8.1 Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly… - CVE-2025-71378 picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickl
CVE-2025-71378High 8.1
CVE-2025-71378 CVSS:8.1 picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute… - CVE-2025-71357 picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.py
CVE-2025-71357High 8.1
CVE-2025-71357 CVSS:8.1 picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods.… - CVE-2025-71348 picklescan before 0.0.28 fails to detect malicious pickle files that invoke torc
CVE-2025-71348High 8.1
CVE-2025-71348 CVSS:8.1 picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within… - CVE-2026-56345 AVideo through 29.0 contains an authorization bypass vulnerability in the Meet p
CVE-2026-56345High 8.1
CVE-2026-56345 CVSS:8.1 AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that… - CVE-2026-9843 The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress i
CVE-2026-9843High 8.1
CVE-2026-9843 CVSS:8.1 The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to… - CVE-2023-45795 A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu be
CVE-2023-45795High 7.8
CVE-2023-45795 CVSS:7.8 A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to… - CVE-2026-12786 A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76
CVE-2026-12786High 7.8
CVE-2026-12786 CVSS:7.8 A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality… - CVE-2026-12784 A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This a
CVE-2026-12784High 7.8
CVE-2026-12784 CVSS:7.8 A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys… - CVE-2026-12782 A security flaw has been discovered in EaseUS Partition Master up to 14.5. The i
CVE-2026-12782High 7.8
CVE-2026-12782 CVSS:7.8 A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library… - CVE-2026-12781 A vulnerability was identified in EaseUS Partition Master up to 14.5. The affect
CVE-2026-12781High 7.8
CVE-2026-12781 CVSS:7.8 A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library… - CVE-2026-12780 A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an un
CVE-2026-12780High 7.8
CVE-2026-12780 CVSS:7.8 A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the… - CVE-2026-12779 A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issu
CVE-2026-12779High 7.8
CVE-2026-12779 CVSS:7.8 A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the library… - CVE-2026-12778 A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This
CVE-2026-12778High 7.8
CVE-2026-12778 CVSS:7.8 A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library… - CVE-2026-42129 The Loki datasource plugin's callResource handler contains a path traversal vuln
CVE-2026-42129High 7.7
CVE-2026-42129 CVSS:7.7 The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape… - CVE-2026-56239 Capgo before 12.128.2 contains a potential privilege escalation vulnerability in
CVE-2026-56239High 7.6
CVE-2026-56239 CVSS:7.6 Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SECURITY DEFINER… - CVE-2026-9071 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv
CVE-2026-9071High 7.5
CVE-2026-9071 CVSS:7.5 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to… - CVE-2026-8858 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere
CVE-2026-8858High 7.5
CVE-2026-8858 CVSS:7.5 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote… - CVE-2025-66389 GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (w
CVE-2025-66389High 7.5
CVE-2025-66389 CVSS:7.5 GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter… - CVE-2026-12581 EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unau
CVE-2026-12581High 7.5
CVE-2026-12581 CVSS:7.5 EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session… - CVE-2026-56253 Capgo before 12.128.2 contains an improper access control vulnerability in the p
CVE-2026-56253High 7.5
CVE-2026-56253 CVSS:7.5 Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows… - CVE-2026-56242 Capgo before 12.128.2 contains an unauthenticated security definer RPC function
CVE-2026-56242High 7.5
CVE-2026-56242 CVSS:7.5 Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning… - CVE-2026-56341 AVideo through version 26.0 contains multiple unauthenticated list.json.php endp
CVE-2026-56341High 7.5
CVE-2026-56341 CVSS:7.5 AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks,… - CVE-2020-37255 WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerab
CVE-2020-37255High 7.5
CVE-2020-37255 CVSS:7.5 WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain… - CVE-2026-11912 The Simple File List plugin for WordPress is vulnerable to arbitrary file modifi
CVE-2026-11912High 7.5
CVE-2026-11912 CVSS:7.5 The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all… - CVE-2026-11911 The Simple File List plugin for WordPress is vulnerable to arbitrary file deleti
CVE-2026-11911High 7.5
CVE-2026-11911 CVSS:7.5 The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… - CVE-2026-56214 Capgo before 12.128.2 contains an information disclosure vulnerability in Supaba
CVE-2026-56214High 7.5
CVE-2026-56214 CVSS:7.5 Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org and… - CVE-2026-9006 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque
CVE-2026-9006High 7.4
CVE-2026-9006 CVSS:7.4 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This… - CVE-2026-8646 IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Serve
CVE-2026-8646High 7.4
CVE-2026-8646 CVSS:7.4 IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to… - CVE-2026-41046 A path traversal attack when using a "configName" parameter in qSnapper before v
CVE-2026-41046High 7.3
CVE-2026-41046 CVSS:7.3 A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious… - CVE-2026-10845 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to by
CVE-2026-10845High 7.3
CVE-2026-10845 CVSS:7.3 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to… - CVE-2026-9029 The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug.
CVE-2026-9029High 7.3
CVE-2026-9029 CVSS:7.3 The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template… - CVE-2026-12795 A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the
CVE-2026-12795High 7.3
CVE-2026-12795 CVSS:7.3 A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file… - CVE-2026-12775 A vulnerability was detected in Montodel House-Rental-Management up to 90010017b
CVE-2026-12775High 7.3
CVE-2026-12775 CVSS:7.3 A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affected by this issue… - CVE-2026-12773 A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the
CVE-2026-12773High 7.3
CVE-2026-12773 CVSS:7.3 A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file… - CVE-2026-56447 MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config
CVE-2026-56447High 7.2
CVE-2026-56447 CVSS:7.2 MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP… - CVE-2026-56446 MISP allowed a site administrator to configure an arbitrary filesystem path for
CVE-2026-56446High 7.2
CVE-2026-56446 CVSS:7.2 MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log… - CVE-2026-44914 Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Proces
CVE-2026-44914High 7.2
CVE-2026-44914 CVSS:7.2 Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with… - CVE-2026-44913 Improper escaping of database table names in the CaptureChangeMySQL Processor in
CVE-2026-44913High 7.2
CVE-2026-44913 CVSS:7.2 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for… - CVE-2026-56382 Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contai
CVE-2026-56382High 7.2
CVE-2026-56382 CVSS:7.2 Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the… - CVE-2026-6858 The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape
CVE-2026-6858High 7.1
CVE-2026-6858 CVSS:7.1 The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to… - CVE-2026-4259 The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not san
CVE-2026-4259High 7.1
CVE-2026-4259 CVSS:7.1 The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back…
⚔️ Sploitus（77 条）
Unknown (77 条)
- Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin exploit
Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin exploit - Exploit for Use After Free in Microsoft exploit
Exploit for Use After Free in Microsoft exploit
…另有 75 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-06-24 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV