📊 2026-06-25 漏洞情报日报 · 200 条 · 高危 95
每日漏洞情报汇总 · 2026-06-25
📊 2026-06-25 漏洞情报日报
📋 共 200 条
🔥 高危/严重 95 条
🚨 CISA-KEV 4 条
🐙 GitHub-Advisory 55 条 🔥20
🛡️ NVD-Latest 75 条 🔥75
⚔️ Sploitus 66 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-10561 (CVSS 10.0) - IBM Langflow OSS：未认证远程代码执行漏洞。结合Python执行隔离缺陷与身份认证绕过，攻击者可完全控制主机。影响版本1.0.0至1.9.3，利用条件低，危害极高。
- CVE-2026-45051 - OpenAM WebAuthn：预认证远程代码执行。利用Java反序列化漏洞，攻击者无需凭证即可在OpenAM服务器上执行任意代码。严重威胁企业单点登录基础设施。
- CVE-2026-54350 - Budibase：非认证NoSQL操作符注入。攻击者可通过发送特制查询参数实现后端数据篡改或越权操作，直接威胁低代码平台的数据安全。
- CVE-2026-52813 - Gogs：路径遍历导致远程代码执行。通过组织名称中的`../`序列写入任意路径，攻击者可上传恶意文件并触发执行，影响自托管Git服务。
- MotionEye多阶段链：结合本地文件读取、Pass-the-Hash及不安全恢复功能，可实现完全未授权的远程代码执行。该链利用简单，对物联网监控系统威胁极大。
📈 威胁趋势
- 远程代码执行 (RCE)：今日漏洞绝对主体。Langflow、OpenAM、Gogs、MotionEye及Flowise等均涉及预认证或低权限RCE，利用链多样化，攻击面显著扩大。
- 不安全反序列化/注入：OpenAM (Java)、Budibase (NoSQL) 及 expr-eval (JavaScript) 漏洞表明，反序列化和参数注入仍是严重威胁，且覆盖多种语言环境。
- 认证与授权绕过：n8n的全局原型污染、Langflow的MCP资源未授权访问及OpenAM的SOAP认证绕过，均显示在身份验证与访问控制逻辑上存在系统性缺陷。
- 路径遍历与信息泄露：Gogs的LFS仓库内容泄露及MotionEye的文件读取，构成横向移动和数据窃取链条。
🛡️ 缓解建议
- 立即升级受影响软件：针对Langflow、Gogs、n8n、Budibase、Flowise等高危漏洞，应优先升级至官方发布的最新修复版本。对于已停止维护的组件（如OpenAM），建议评估并迁移至替代方案或启用WAF规则。
- 强化网络隔离与访问控制：对暴露在公网的管理后台（如MotionEye、OpenAM、Langflow）实施严格的IP白名单或VPN接入。确保未认证端点无法直接访问。
- 启用运行时防护与监控：部署RASP工具或WAF规则，重点检测Java反序列化、NoSQL注入及路径穿越流量。同时审计系统日志，针对异常的用户操作或文件写入行为进行告警。
- 审查低代码/自动化平台权限：对于n8n、Budibase等平台，严格限制工作流的创建与修改权限，并禁用或审查高风险节点（如自定义MCP、XML处理）的使用，遵循最小权限原则。
🚨 CISA-KEV（4 条）
Unknown (4 条)
- CVE-2026-34908 - Ubiquiti UniFi OS Improper Access Control Vulnerability
CVE-2026-34908
CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability 产品: Ubiquiti UniFi OS 描述: Ubiquiti UniFi OS contains an improper access control… - CVE-2026-34909 - Ubiquiti UniFi OS Path Traversal Vulnerability
CVE-2026-34909
CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability 产品: Ubiquiti UniFi OS 描述: Ubiquiti UniFi OS contains a path traversal vulnerability which could…
…另有 2 条 Unknown 级漏洞（已省略）
🐙 GitHub-Advisory（55 条）
Critical (6 条)
- CVE-2026-45051 - OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
CVE-2026-45051Critical
## Summary **Description** A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain… - CVE-2026-45052 - OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/
CVE-2026-45052Critical
## Summary **Description** An Improper Authorization (CWE-285) issue in OpenAM's Liberty Web Services SOAP receiver allows an unauthenticated remote attacker… - CVE-2026-52813 - Gogs has Path Traversal in organization name that results in RCE through Git hoo
CVE-2026-52813Critical
Summary Organization names containing path traversal sequences (`../`) are accepted by Gogs, and repositories under them are written to paths following these… - CVE-2026-54350 - Budibase has nonymous NoSQL operator injection via published-app query templates
CVE-2026-54350Critical
## Summary `enrichContext` at `packages/server/src/sdk/workspace/queries/queries.ts:121-138` substitutes parameter values into the raw JSON body of a query,… - GHSA-qxvg-h7q2-hcxh - motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE) Critical
## Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines: 1. **Arbitrary file read (LFI)** via the picture download… - GHSA-phv5-334h-mxcw - motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft Critical
# Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal Summary Myself and others have reported several RCE vulnerabilities…
High (14 条)
- CVE-2026-48708 - OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-R
CVE-2026-48708High
## Summary OliveTin's template engine uses a **single shared `text/template.Template` instance** (`tpl` package-level variable in… - CVE-2026-52812 - Gogs: LFS dedupe path leaks private repo content across tenants
CVE-2026-52812High
Summary Git LFS storage is content-addressed by OID alone (`<LFS-root>/<oid[0]>/<oid[1]>/<oid>`) but per-repo authorization lives in the `lfs_object` table… - CVE-2026-45048 - OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
CVE-2026-45048High
## Summary Description An insufficient authorization (CWE-285) and information exposure (CWE-200) issue in OpenAM's session management endpoint allows a… - CVE-2026-45049 - OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet
CVE-2026-45049High
## Summary **Description** An Information Exposure Through Sent Data (CWE-201) issue in OpenAM's Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in… - CVE-2026-55173 - AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allo
CVE-2026-55173High
Summary The fix for CVE-2026-33482 (GHSA-pmj8-r2j7-xg6c) is incomplete. That advisory reported that `sanitizeFFmpegCommand()`… - CVE-2026-53925 - Glances has arbitrary file write and command execution via `secure_popen` redire
CVE-2026-53925High
Summary The `secure_popen()` function in `glances/secure.py` interprets `>` (file redirection), `|` (pipe), and `&&` (command chaining) operators in command… - CVE-2026-54134 - OctoPrint has possible file exfiltration via query parameters on upload endpoint
CVE-2026-54134High
Impact OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD`… - CVE-2026-55441 - Mise vulnerable to arbitrary command execution via task-include files in an untr
CVE-2026-55441High
Summary mise's trust feature gates config files (`mise.toml`, `.tool-versions`) through `trust_check`, but task-include files are loaded on a path that never… - CVE-2026-55488 - motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File
CVE-2026-55488High
Summary mEye contains an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the… - CVE-2026-54512 - jackson-databind has a PolymorphicTypeValidator bypass via generic type paramete
CVE-2026-54512High
`jackson-databind`'s `PolymorphicTypeValidator` (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled… - CVE-2026-54513 - jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeVa
CVE-2026-54513High
## Summary `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` allowlists any array type based only on `clazz.isArray()`, without validating the… - CVE-2026-48126 - Algernon: Host header path traversal in --domain mode reads files and runs Lua f
CVE-2026-48126High
Summary When algernon is started with `--domain` (or `--letsencrypt`, which silently turns on `--domain` at `engine/flags.go:372`), the request handler… - CVE-2026-48507 - Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editi
CVE-2026-48507High
Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the… - CVE-2026-54329 - Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
CVE-2026-54329High
Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A…
Medium (31 条)
- CVE-2026-55863 - motionEye's missing authentication on ActionHandler allows unauthenticated camer
CVE-2026-55863Medium 3.1
## Summary The `ActionHandler.post()` method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions… - CVE-2026-53541 - OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
CVE-2026-53541Medium
Description The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's… - CVE-2026-52814 - Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake St
CVE-2026-52814Medium
The Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections… - CVE-2026-52815 - Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via
CVE-2026-52815Medium
## Summary Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at… - CVE-2026-35163 - OctoPrint has XSS in its Suppressed Command Notifications
CVE-2026-35163Medium
Impact OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML… - CVE-2026-52816 - Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data:
CVE-2026-52816Medium
## Summary The Jupyter Notebook (ipynb) sanitizer endpoint at `POST /-/api/sanitize_ipynb` allows arbitrary `data:` URIs without proper restrictions,… - CVE-2026-54557 - mise HTTP backend uses raw version path for install symlink destination
CVE-2026-54557Medium
## Summary The mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths… - CVE-2026-55448 - Mise's local credential_command executes untrusted config
CVE-2026-55448Medium
Summary `mise` loads `github.credential_command` from local project config before any trust decision, then executes that value with `sh -c` when resolving a…
…另有 23 条 Medium 级漏洞（已省略）
Low (4 条)
- CVE-2026-48709 - OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Acti
CVE-2026-48709Low
## Summary The `ValidateArgumentType` RPC endpoint in `service/internal/api/api.go` does not perform any authentication or authorization checks. Unlike all… - CVE-2026-48488 - phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing
CVE-2026-48488Low
Summary Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017… - CVE-2026-55519 - Snipe-IT has Improper Authorization in File Deletion (IDOR)
CVE-2026-55519Low
Impact A vulnerability was identified in Snipe-IT v8.4.0 (build 21280-g91a95dbc6) that allows any authenticated user with generic asset edit permissions to…
…另有 1 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（75 条）
Critical (14 条)
- CVE-2026-10561 IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper iso
CVE-2026-10561Critical 10.0
CVE-2026-10561 CVSS:10.0 IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an… - CVE-2026-44791 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a
CVE-2026-44791Critical 9.9
CVE-2026-44791 CVSS:9.9 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to… - CVE-2026-44789 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a
CVE-2026-44789Critical 9.9
CVE-2026-44789 CVSS:9.9 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to… - CVE-2026-56274 Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in t
CVE-2026-56274Critical 9.9
CVE-2026-56274 CVSS:9.9 Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete… - CVE-2026-56315 picklescan before 1.0.4 fails to block at least seven Python standard library mo
CVE-2026-56315Critical 9.8
CVE-2026-56315 CVSS:9.8 picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support,… - CVE-2026-12866 All versions of the package expr-eval are vulnerable to Code Execution via the t
CVE-2026-12866Critical 9.8
CVE-2026-12866 CVSS:9.8 All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary… - CVE-2026-7664 IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to ac
CVE-2026-7664Critical 9.8
CVE-2026-7664 CVSS:9.8 IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP… - CVE-2026-10789 A maliciously crafted webpage, when visited by a user with Autodesk Fusion Deskt
CVE-2026-10789Critical 9.6
CVE-2026-10789 CVSS:9.6 A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a… - CVE-2026-28381 The Snowflake datasource allows for GET/PUT commands, which can allow any user w
CVE-2026-28381Critical 9.6
CVE-2026-28381 CVSS:9.6 The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to… - CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an in
CVE-2026-9733Critical 9.1
CVE-2026-9733 CVSS:9.1 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator… - CVE-2026-12628 IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snaps
CVE-2026-12628Critical 9.1
CVE-2026-12628 CVSS:9.1 IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a… - CVE-2026-11373 Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections.
CVE-2026-11373Critical 9.1
CVE-2026-11373 CVSS:9.1 Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite… - CVE-2026-44792 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a
CVE-2026-44792Critical 9.0
CVE-2026-44792 CVSS:9.0 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git… - CVE-2026-11374 In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and
CVE-2026-11374Critical 9.0
CVE-2026-11374 CVSS:9.0 In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to…
High (61 条)
- CVE-2026-44790 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a
CVE-2026-44790High 8.8
CVE-2026-44790 CVSS:8.8 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to… - CVE-2026-34916 A missing validation of user input when saving delivery limitations in Revive Ad
CVE-2026-34916High 8.8
CVE-2026-34916 CVSS:8.8 A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged… - CVE-2026-33760 Langflow is a tool for building and deploying AI-powered agents and workflows. P
CVE-2026-33760High 8.8
CVE-2026-33760 CVSS:8.8 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router… - CVE-2026-35018 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenti
CVE-2026-35018High 8.8
CVE-2026-35018 CVSS:8.8 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows… - CVE-2026-10711 Missing authentication for critical function vulnerability in AKIN Software Comp
CVE-2026-10711High 8.8
CVE-2026-10711 CVSS:8.8 Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus… - CVE-2026-8163 The Infility Global WordPress plugin before 2.15.19 does not properly sanitize a
CVE-2026-8163High 8.8
CVE-2026-8163 CVSS:8.8 The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL… - CVE-2026-56424 MISP core contained multiple broken access-control flaws where authorization che
CVE-2026-56424High 8.8
CVE-2026-56424 CVSS:8.8 MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where… - CVE-2026-56423 MISP Core contained broken access-control checks in the bulk deletion flows for
CVE-2026-56423High 8.8
CVE-2026-56423 CVSS:8.8 MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected… - CVE-2026-54099 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenS
CVE-2026-54099High 8.8
CVE-2026-54099 CVSS:8.8 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver… - CVE-2026-8157 The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles
CVE-2026-8157High 8.8
CVE-2026-8157 CVSS:8.8 The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of… - CVE-2026-34914 A missing sanitisation of user input in the zone-include.php script of Revive Ad
CVE-2026-34914High 8.3
CVE-2026-34914 CVSS:8.3 A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could… - CVE-2026-56225 Capgo before 12.128.2 contains an authorization bypass vulnerability in its publ
CVE-2026-56225High 8.3
CVE-2026-56225 CVSS:8.3 Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post).… - CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverifi
CVE-2025-71337High 8.3
CVE-2025-71337 CVSS:8.3 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user… - CVE-2026-54100 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenS
CVE-2026-54100High 8.3
CVE-2026-54100 CVSS:8.3 A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH… - CVE-2026-56104 Chainlit before 2.10.1 contains a session hijacking vulnerability that allows un
CVE-2026-56104High 8.2
CVE-2026-56104 CVSS:8.2 Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit… - CVE-2026-35019 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenti
CVE-2026-35019High 8.1
CVE-2026-35019 CVSS:8.1 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated… - CVE-2026-56784 OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vul
CVE-2026-56784High 8.1
CVE-2026-56784 CVSS:8.1 OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that… - CVE-2026-56258 Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the scre
CVE-2026-56258High 8.1
CVE-2026-56258 CVSS:8.1 Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated… - CVE-2026-56243 Capgo before 12.128.2 contains a security control bypass vulnerability where the
CVE-2026-56243High 8.1
CVE-2026-56243 CVSS:8.1 Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through… - CVE-2025-71376 picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.au
CVE-2025-71376High 8.1
CVE-2025-71376 CVSS:8.1 picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce… - CVE-2025-71370 picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_
CVE-2025-71370High 8.1
CVE-2025-71370 CVSS:8.1 picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle… - CVE-2025-71365 picklescan before 0.0.33 fails to detect malicious pickle files that invoke nump
CVE-2025-71365High 8.1
CVE-2025-71365 CVSS:8.1 picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce… - CVE-2025-71341 picklescan before 0.0.29 fails to detect the profile.Profile.runctx function whe
CVE-2025-71341High 8.1
CVE-2025-71341 CVSS:8.1 picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed… - CVE-2026-9072 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSpher
CVE-2026-9072High 8.1
CVE-2026-9072 CVSS:8.1 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server, and IBM WebSphere Application Server Liberty - when using Intelligent… - CVE-2026-41045 A time-to-check-time-of-use in polkit authentication of qSnapper before version
CVE-2026-41045High 8.1
CVE-2026-41045 CVSS:8.1 A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers… - CVE-2023-45796 A stored cross-site scripting vulnerability in the Runtime component of Pilz PAS
CVE-2023-45796High 8.1
CVE-2023-45796 CVSS:8.1 A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including… - CVE-2025-66336 Apache Doris MCP Server contains a SQL injection vulnerability in a metadata que
CVE-2025-66336High 8.1
CVE-2025-66336 CVSS:8.1 Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly… - CVE-2026-12958 Missing symlink validation in Language Servers for AWS may allow an arbitrary fi
CVE-2026-12958High 7.8
CVE-2026-12958 CVSS:7.8 Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This… - CVE-2026-12957 Improper trust boundary enforcement in Language Servers for AWS before version 1
CVE-2026-12957High 7.8
CVE-2026-12957 CVSS:7.8 Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for… - CVE-2023-45795 A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu be
CVE-2023-45795High 7.8
CVE-2023-45795 CVSS:7.8 A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to… - CVE-2026-42129 The Loki datasource plugin's callResource handler contains a path traversal vuln
CVE-2026-42129High 7.7
CVE-2026-42129 CVSS:7.7 The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An authenticated Viewer-role user can escape… - CVE-2026-13007 Tenable Identity Exposure contains multiple unauthenticated API endpoints under
CVE-2026-13007High 7.5
CVE-2026-13007 CVSS:7.5 Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application… - CVE-2025-61025 An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 a
CVE-2025-61025High 7.5
CVE-2025-61025 CVSS:7.5 An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via… - CVE-2025-61022 An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2
CVE-2025-61022High 7.5
CVE-2025-61022 CVSS:7.5 An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)… - CVE-2025-61020 An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.
CVE-2025-61020High 7.5
CVE-2025-61020 CVSS:7.5 An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service… - CVE-2025-61018 An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2
CVE-2025-61018High 7.5
CVE-2025-61018 CVSS:7.5 An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)… - CVE-2026-56322 Capgo before 12.128.2 contains an information disclosure vulnerability in the un
CVE-2026-56322High 7.5
CVE-2026-56322 CVSS:7.5 Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the… - CVE-2026-56248 Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial
CVE-2026-56248High 7.5
CVE-2026-56248 CVSS:7.5 Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs… - CVE-2023-54365 Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnera
CVE-2023-54365High 7.5
CVE-2023-54365 CVSS:7.5 Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go… - CVE-2026-8379 The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly
CVE-2026-8379High 7.5
CVE-2026-8379 CVSS:7.5 The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler,… - CVE-2026-9071 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv
CVE-2026-9071High 7.5
CVE-2026-9071 CVSS:7.5 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to… - CVE-2026-8858 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere
CVE-2026-8858High 7.5
CVE-2026-8858 CVSS:7.5 IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote… - CVE-2025-66389 GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (w
CVE-2025-66389High 7.5
CVE-2025-66389 CVSS:7.5 GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter… - CVE-2026-12581 EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unau
CVE-2026-12581High 7.5
CVE-2026-12581 CVSS:7.5 EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session… - CVE-2026-56815 pwnlift before d7a9544, in a privileged deployment, contains a symlink following
CVE-2026-56815High 7.4
CVE-2026-56815 CVSS:7.4 pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in… - CVE-2026-9006 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque
CVE-2026-9006High 7.4
CVE-2026-9006 CVSS:7.4 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This… - CVE-2026-8646 IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Serve
CVE-2026-8646High 7.4
CVE-2026-8646 CVSS:7.4 IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to… - CVE-2026-41046 A path traversal attack when using a "configName" parameter in qSnapper before v
CVE-2026-41046High 7.3
CVE-2026-41046 CVSS:7.3 A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious… - CVE-2026-10845 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to by
CVE-2026-10845High 7.3
CVE-2026-10845 CVSS:7.3 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to… - CVE-2026-9029 The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug.
CVE-2026-9029High 7.3
CVE-2026-9029 CVSS:7.3 The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template… - CVE-2026-56222 Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /pr
CVE-2026-56222High 7.2
CVE-2026-56222 CVSS:7.2 Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id… - CVE-2026-10521 An high privileged remote attacker can access a hidden configuration method, tha
CVE-2026-10521High 7.2
CVE-2026-10521 CVSS:7.2 An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify… - CVE-2026-56447 MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config
CVE-2026-56447High 7.2
CVE-2026-56447 CVSS:7.2 MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP… - CVE-2026-56446 MISP allowed a site administrator to configure an arbitrary filesystem path for
CVE-2026-56446High 7.2
CVE-2026-56446 CVSS:7.2 MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log… - CVE-2026-44914 Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Proces
CVE-2026-44914High 7.2
CVE-2026-44914 CVSS:7.2 Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with… - CVE-2026-44913 Improper escaping of database table names in the CaptureChangeMySQL Processor in
CVE-2026-44913High 7.2
CVE-2026-44913 CVSS:7.2 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for… - CVE-2026-8172 The Simple Basic Contact Form WordPress plugin through 20250114 does not escape
CVE-2026-8172High 7.1
CVE-2026-8172 CVSS:7.1 The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the… - CVE-2026-10658 A missing length validation in the Zephyr Bluetooth Host ISO receive path can be
CVE-2026-10658High 7.1
CVE-2026-10658 CVSS:7.1 A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv()… - CVE-2026-10651 A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in
CVE-2026-10651High 7.1
CVE-2026-10651 CVSS:7.1 A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In… - CVE-2026-6858 The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape
CVE-2026-6858High 7.1
CVE-2026-6858 CVSS:7.1 The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to… - CVE-2026-4259 The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not san
CVE-2026-4259High 7.1
CVE-2026-4259 CVSS:7.1 The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back…
⚔️ Sploitus（66 条）
Unknown (66 条)
- Exploit for CVE-2026-48908 exploit
CVE-2026-48908
Exploit for CVE-2026-48908 exploit - Exploit for Unrestricted Upload of File with Dangerous Type in Gvectors Wpdiscuz exploit
Exploit for Unrestricted Upload of File with Dangerous Type in Gvectors Wpdiscuz exploit
…另有 64 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-06-25 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV