🤖 今日安全态势分析

🎯 今日重点关注

• OpenAM 预授权远程代码执行 (CVE-2026-45051, CVSS 9.8)： 影响 OpenAM WebAuthn 模块。攻击者可通过发送特制的序列化数据，在无需认证的情况下触发反序列化漏洞，导致任意代码执行。利用条件低，可直接威胁服务器安全。
• Flowise 多重OS命令注入 (CVE-2026-56274, CVSS 9.9)： 影响 Flowise 低于 3.1.2 的版本。攻击者利用 Custom MCP Server 功能中命令校验的缺陷，结合正则绕过，能够注入并执行任意OS命令，可完全控制主机。
• n8n 全局原型污染绕过 (CVE-2026-44789, CVSS 9.9)： 影响 n8n 多个旧版本。已认证用户可通过未经验证的输入触发全局 JavaScript 原型污染，绕过此前针对 CVE-2026-42232 的补丁，实现更深入的攻击，如权限提升或数据篡改。
• Nezha 跨租户会话劫持 (CVE-2026-46716, Critical)： 影响 Nezha 多个版本。其 WebSocket 端点仅凭有效的 UUID 进行认证，缺乏所有权校验，导致攻击者可以劫持任意租户的终端或文件管理会话，直接获得对另一用户资源的控制权。

📈 威胁趋势

• 远程代码执行 (RCE) / 命令注入： 今日共有 3 个此类漏洞（CVE-2026-56274, CVE-2026-40079, CVE-2026-45051），且均为 Critical 级别。攻击者无需或仅需低权限即可利用，是当前最危险的威胁类型，主要影响开源框架和监控系统。
• 权限提升 / 安全机制绕过： 出现 4 个相关漏洞，包括 n8n 的原型污染（CVE-2026-44789）和 OpenAM 的用户篡改（CVE-2026-45052）。表明攻击者正试图通过绕过认证和权限检查，获取更高级别的系统访问权限。
• 拒绝服务 (DoS) / 资源耗尽： 以 js-toml 库的 CPU 耗尽（CVE-2026-49293）和 Hackney TLS 连接超时（CVE-2026-47071）为代表。此类漏洞虽不直接导致数据泄露，但可造成应用不可用，影响业务连续性。
• 信息泄露 / 会话劫持： Nezha 跨租户会话劫持（CVE-2026-46716）和 Mojolicious OAuth2 不安全的 state 参数（CVE-2026-9733）等，攻击者通过中间人攻击或直接劫持会话，可窃取敏感凭证和数据。

🛡️ 缓解建议

• 立即升级受影响组件： 优先升级 OpenAM、Flowise、n8n 至最新安全版本；将 Nezha 升级至修复版本，以修复远程代码执行和会话劫持等高危漏洞。安排专人跟进补丁发布窗口。
• 强化访问控制与网络隔离： 尽快为 Nezha 等内部管理工具启用 IP白名单或 VPN，并审查所有 WebSocket 接口的认证逻辑。对于 Cacti 等监控系统，限制其 Web 管理界面的暴露面。
• 启用并复核日志与告警： 开启对所有关键应用的审计日志，特别关注异常的 WebSocket 连接尝试、反序列化错误及命令执行记录。配置告警规则，对异常流量和权限变更行为进行实时监控。
• 执行安全加固配置： 检查 Flowise 和 n8n 等应用中的用户权限配置，遵循最小权限原则。验证 OAuth2 等认证模块的配置，确保使用了正确且随机化的 state 参数，防止 CSRF 攻击。

🐙 GitHub-Advisory（55 条）

Critical (4 条)

• GHSA-q6xx-5vr8-p898 - Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSoc CVE-2026-46716Critical
  Summary In nezha **v1.14.13–v1.14.14** and **v2.0.0–v2.0.9**, the WebSocket endpoints `GET /ws/terminal/:id` and `GET /ws/file/:id` authenticate the caller…
• CVE-2026-53519 - Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leak CVE-2026-53519Critical
  Summary `fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-frontend asset…
• CVE-2026-45051 - OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage CVE-2026-45051Critical
  ## Summary **Description** A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module. Under certain…
• CVE-2026-45052 - OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/ CVE-2026-45052Critical
  ## Summary **Description** An Improper Authorization (CWE-285) issue in OpenAM's Liberty Web Services SOAP receiver allows an unauthenticated remote attacker…

High (20 条)

• CVE-2026-49293 - js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-pre CVE-2026-49293High 3.1
  ## Summary `js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that…
• CVE-2026-55697 - pnpm: Repository-controlled configDependencies can select a pacquet native insta CVE-2026-55697High 3.1
  <!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected…
• CVE-2026-55698 - pnpm: Project env lockfile can short-circuit package-manager resolution and exec CVE-2026-55698High 3.1
  <!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected…
• CVE-2026-47071 - Hackney: `ssl:connect/2` post-handshake upgrade has no timeout CVE-2026-47071High
  Summary The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the…
• CVE-2026-47074 - Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OO CVE-2026-47074High
  Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory without any size cap. The `after Timeout`…
• CVE-2026-47073 - Hackney has unbounded buffer accumulation in WebSocket CVE-2026-47073High
  Summary The WebSocket client in `src/hackney_ws.erl` imposes no upper bound on memory consumption across three distinct code paths. In each case, an…
• CVE-2026-47067 - Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes CVE-2026-47067High
  Summary [CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney's URL parser…
• CVE-2026-49286 - PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-2 CVE-2026-49286High
  Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist: ```php if (0 ===…
• CVE-2026-49287 - Statamic CMS's unsafe method invocation via collection sorting allows data destr CVE-2026-49287High
  Impact The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory…
• GHSA-7vfx-4246-jcfh - SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API High
  ## Summary Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to access, modify, or…
• GHSA-wcr3-9x4c-f5gj - Blnk has an API key authorization bypass in owner and scope enforcement High
  Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions outside their intended authorization…
• GHSA-8jgf-23q5-x7xx - ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature byp High
  Summary `ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incoming SNS message without validating that the…
• CVE-2026-50016 - pnpm: Transitive dependency alias path traversal allows project path override vi CVE-2026-50016High
  ## Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that…
• CVE-2026-50015 - pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Tr CVE-2026-50015High
  ## Summary pnpm's patch application pipeline (`@pnpm/patch-package`) performs no path validation on file paths extracted from `.patch` files. An attacker who…
• CVE-2026-55487 - pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVE-2026-55487High
  ## Summary Keep build approval for opaque dependency sources byte-exact for GHSA-5wx6-mg75-v57r / CAND-PNPM-123. Merged upstream commit `bf1b731ee6` fixed the…
• CVE-2026-49340 - gonic has arbitrary file write in createPlaylist: any authenticated user can wri CVE-2026-49340High
  ## Summary A logic error in `ServeCreateOrUpdatePlaylist` allows **any authenticated Subsonic user** (including non-admin) to write playlist M3U content to an…
• CVE-2026-49339 - gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any us CVE-2026-49339High
  ## Summary The maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic/commit/6dd71e6) (`fix(subsonic):…
• CVE-2026-49338 - Subsonic API: any authenticated user can delete or read any other user's playlis CVE-2026-49338High
  ## Summary In gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once…
• CVE-2026-55700 - pnpm: `stage download` writes outside its destination directory via manifest nam CVE-2026-55700High
  ## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by…
• CVE-2026-48708 - OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-R CVE-2026-48708High
  ## Summary OliveTin's template engine uses a **single shared `text/template.Template` instance** (`tpl` package-level variable in…

Medium (26 条)

• CVE-2026-55180 - pnpm: Repository config can expand victim environment secrets into registry requ CVE-2026-55180Medium 3.1
  <!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected…
• CVE-2026-55699 - pnpm: Reserved bin name deletes PNPM_HOME during global remove CVE-2026-55699Medium 3.1
  <details> <summary>Maintainer Action Plan</summary> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR…
• CVE-2026-47076 - Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded CVE-2026-47076Medium
  Summary `hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization using OTP's…
• CVE-2026-47070 - Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body CVE-2026-47070Medium
  Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authorization`) and, for…
• CVE-2026-47075 - Hackney has CR/LF injection in query parameter CVE-2026-47075Medium
  Summary `hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\r` or `\n`. RFC 3986 §3.4…
• CVE-2026-47072 - Hackney has CRLF / header injection in WebSocket upgrade request CVE-2026-47072Medium
  Summary CRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `host`, `path`, `headers`, and `protocols`…
• CVE-2026-49359 - PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment op CVE-2026-49359Medium
  Summary `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without…
• CVE-2026-49288 - Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows CVE-2026-49288Medium
  Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users,…

…另有 18 条 Medium 级漏洞（已省略）

Low (5 条)

• CVE-2026-48794 - Authelia has an Edge Case Access Control Rule Mismatch CVE-2026-48794Low 4.0
  Impact **CVSSv4 Baseline Score:** Low 2.4 **CVSSv4 Weighted Score:** Low 1.3 The full CVSSv4 Vector for this vulnerability is: >…
• CVE-2026-47069 - Hackney has CRLF / header injection via unvalidated `domain` and `path` options CVE-2026-47069Low
  Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` and `Value` against CR/LF and control…
• CVE-2026-49358 - PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temp CVE-2026-49358Low
  Summary `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown…

…另有 2 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（73 条）

Critical (9 条)

• CVE-2026-44791 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a CVE-2026-44791Critical 9.9
  CVE-2026-44791 CVSS:9.9 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to…
• CVE-2026-44789 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a CVE-2026-44789Critical 9.9
  CVE-2026-44789 CVSS:9.9 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to…
• CVE-2026-56274 Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in t CVE-2026-56274Critical 9.9
  CVE-2026-56274 CVSS:9.9 Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server feature due to incomplete…
• CVE-2026-40079 Cacti is an open source performance and fault management framework. Versions 1.2 CVE-2026-40079Critical 9.8
  CVE-2026-40079 CVSS:9.8 Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due…
• CVE-2026-56315 picklescan before 1.0.4 fails to block at least seven Python standard library mo CVE-2026-56315Critical 9.8
  CVE-2026-56315 CVSS:9.8 picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support,…
• CVE-2026-12866 All versions of the package expr-eval are vulnerable to Code Execution via the t CVE-2026-12866Critical 9.8
  CVE-2026-12866 CVSS:9.8 All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary…
• CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an in CVE-2026-9733Critical 9.1
  CVE-2026-9733 CVSS:9.1 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator…
• CVE-2026-44792 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a CVE-2026-44792Critical 9.0
  CVE-2026-44792 CVSS:9.0 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git…
• CVE-2026-11374 In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and CVE-2026-11374Critical 9.0
  CVE-2026-11374 CVSS:9.0 In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to…

High (64 条)

• CVE-2026-5305 The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium CVE-2026-5305High 8.8
  CVE-2026-5305 CVSS:8.8 The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle…
• CVE-2026-12244 If NSD is configured as secondary for a zone, the primary of that zone can crash CVE-2026-12244High 8.8
  CVE-2026-12244 CVSS:8.8 If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a…
• CVE-2026-9155 OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux CVE-2026-9155High 8.8
  CVE-2026-9155 CVSS:8.8 OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS…
• CVE-2026-9787 Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vuln CVE-2026-9787High 8.8
  CVE-2026-9787 CVSS:8.8 Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-9786 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab CVE-2026-9786High 8.8
  CVE-2026-9786 CVSS:8.8 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-9785 Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulner CVE-2026-9785High 8.8
  CVE-2026-9785 CVSS:8.8 Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-9784 Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulner CVE-2026-9784High 8.8
  CVE-2026-9784 CVSS:8.8 Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-9783 Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vul CVE-2026-9783High 8.8
  CVE-2026-9783 CVSS:8.8 Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers…
• CVE-2026-9782 Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulner CVE-2026-9782High 8.8
  CVE-2026-9782 CVSS:8.8 Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-9781 Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerab CVE-2026-9781High 8.8
  CVE-2026-9781 CVSS:8.8 Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-9780 Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vuln CVE-2026-9780High 8.8
  CVE-2026-9780 CVSS:8.8 Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-7570 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab CVE-2026-7570High 8.8
  CVE-2026-7570 CVSS:8.8 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-7569 Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vuln CVE-2026-7569High 8.8
  CVE-2026-7569 CVSS:8.8 Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to…
• CVE-2026-44790 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a CVE-2026-44790High 8.8
  CVE-2026-44790 CVSS:8.8 n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to…
• CVE-2026-34916 A missing validation of user input when saving delivery limitations in Revive Ad CVE-2026-34916High 8.8
  CVE-2026-34916 CVSS:8.8 A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged…
• CVE-2026-33760 Langflow is a tool for building and deploying AI-powered agents and workflows. P CVE-2026-33760High 8.8
  CVE-2026-33760 CVSS:8.8 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router…
• CVE-2026-35018 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenti CVE-2026-35018High 8.8
  CVE-2026-35018 CVSS:8.8 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows…
• CVE-2026-10711 Missing authentication for critical function vulnerability in AKIN Software Comp CVE-2026-10711High 8.8
  CVE-2026-10711 CVSS:8.8 Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus…
• CVE-2026-8163 The Infility Global WordPress plugin before 2.15.19 does not properly sanitize a CVE-2026-8163High 8.8
  CVE-2026-8163 CVSS:8.8 The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL…
• CVE-2026-10086 GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 bef CVE-2026-10086High 8.7
  CVE-2026-10086 CVSS:8.7 GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1…
• CVE-2026-12053 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef CVE-2026-12053High 8.6
  CVE-2026-12053 CVSS:8.6 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have…
• CVE-2026-34914 A missing sanitisation of user input in the zone-include.php script of Revive Ad CVE-2026-34914High 8.3
  CVE-2026-34914 CVSS:8.3 A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could…
• CVE-2026-56225 Capgo before 12.128.2 contains an authorization bypass vulnerability in its publ CVE-2026-56225High 8.3
  CVE-2026-56225 CVSS:8.3 Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post).…
• CVE-2025-71337 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverifi CVE-2025-71337High 8.3
  CVE-2025-71337 CVSS:8.3 Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user…
• CVE-2026-12246 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an ad CVE-2026-12246High 8.1
  CVE-2026-12246 CVSS:8.1 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family…
• CVE-2026-35019 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenti CVE-2026-35019High 8.1
  CVE-2026-35019 CVSS:8.1 NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated…
• CVE-2026-56784 OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vul CVE-2026-56784High 8.1
  CVE-2026-56784 CVSS:8.1 OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that…
• CVE-2026-56258 Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the scre CVE-2026-56258High 8.1
  CVE-2026-56258 CVSS:8.1 Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated…
• CVE-2026-56243 Capgo before 12.128.2 contains a security control bypass vulnerability where the CVE-2026-56243High 8.1
  CVE-2026-56243 CVSS:8.1 Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through…
• CVE-2025-71376 picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.au CVE-2025-71376High 8.1
  CVE-2025-71376 CVSS:8.1 picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce…
• CVE-2025-71370 picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ CVE-2025-71370High 8.1
  CVE-2025-71370 CVSS:8.1 picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle…
• CVE-2025-71365 picklescan before 0.0.33 fails to detect malicious pickle files that invoke nump CVE-2025-71365High 8.1
  CVE-2025-71365 CVSS:8.1 picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce…
• CVE-2025-71341 picklescan before 0.0.29 fails to detect the profile.Profile.runctx function whe CVE-2025-71341High 8.1
  CVE-2025-71341 CVSS:8.1 picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed…
• CVE-2026-10712 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 CVE-2026-10712High 8.0
  CVE-2026-10712 CVSS:8.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before…
• CVE-2026-12958 Missing symlink validation in Language Servers for AWS may allow an arbitrary fi CVE-2026-12958High 7.8
  CVE-2026-12958 CVSS:7.8 Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This…
• CVE-2026-12957 Improper trust boundary enforcement in Language Servers for AWS before version 1 CVE-2026-12957High 7.8
  CVE-2026-12957 CVSS:7.8 Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for…
• CVE-2026-8666 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon CVE-2026-8666High 7.7
  CVE-2026-8666 CVSS:7.7 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers…
• CVE-2026-8665 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra CVE-2026-8665High 7.7
  CVE-2026-8665 CVSS:7.7 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to…
• CVE-2026-8660 OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect P CVE-2026-8660High 7.7
  CVE-2026-8660 CVSS:7.7 OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute…
• CVE-2026-8592 OS Command Injection vulnerability in the process_string action of Rapid7 Insigh CVE-2026-8592High 7.7
  CVE-2026-8592 CVSS:7.7 OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to…
• CVE-2026-39951 Cacti is an open source performance and fault management framework. Versions 1.2 CVE-2026-39951High 7.6
  CVE-2026-39951 CVSS:7.6 Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability…
• CVE-2026-12937 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Pl CVE-2026-12937High 7.5
  CVE-2026-12937 CVSS:7.5 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL…
• CVE-2026-9702 The InPost PL WordPress plugin before 1.9.1 does not verify that the request ori CVE-2026-9702High 7.5
  CVE-2026-9702 CVSS:7.5 The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the…
• CVE-2026-12490 When a provide-xfr is given with a tls-auth-name, a secondary requesting a trans CVE-2026-12490High 7.5
  CVE-2026-12490 CVSS:7.5 When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name.…
• CVE-2026-12245 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS c CVE-2026-12245High 7.5
  CVE-2026-12245 CVSS:7.5 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process,…
• CVE-2026-13311 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.protot CVE-2026-13311High 7.5
  CVE-2026-13311 CVSS:7.5 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates…
• CVE-2026-12077 The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via CVE-2026-12077High 7.5
  CVE-2026-12077 CVSS:7.5 The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all…
• CVE-2026-13007 Tenable Identity Exposure contains multiple unauthenticated API endpoints under CVE-2026-13007High 7.5
  CVE-2026-13007 CVSS:7.5 Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application…
• CVE-2025-61025 An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 a CVE-2025-61025High 7.5
  CVE-2025-61025 CVSS:7.5 An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via…
• CVE-2025-61022 An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2 CVE-2025-61022High 7.5
  CVE-2025-61022 CVSS:7.5 An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)…
• CVE-2025-61020 An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7. CVE-2025-61020High 7.5
  CVE-2025-61020 CVSS:7.5 An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service…
• CVE-2025-61018 An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2 CVE-2025-61018High 7.5
  CVE-2025-61018 CVSS:7.5 An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)…
• CVE-2026-56322 Capgo before 12.128.2 contains an information disclosure vulnerability in the un CVE-2026-56322High 7.5
  CVE-2026-56322 CVSS:7.5 Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the…
• CVE-2026-56248 Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial CVE-2026-56248High 7.5
  CVE-2026-56248 CVSS:7.5 Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs…
• CVE-2023-54365 Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnera CVE-2023-54365High 7.5
  CVE-2023-54365 CVSS:7.5 Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go…
• CVE-2026-8379 The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly CVE-2026-8379High 7.5
  CVE-2026-8379 CVSS:7.5 The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler,…
• CVE-2026-57589 sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local p CVE-2026-57589High 7.4
  CVE-2026-57589 CVSS:7.4 sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch…
• CVE-2026-56815 pwnlift before d7a9544, in a privileged deployment, contains a symlink following CVE-2026-56815High 7.4
  CVE-2026-56815 CVSS:7.4 pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in…
• CVE-2026-56222 Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /pr CVE-2026-56222High 7.2
  CVE-2026-56222 CVSS:7.2 Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id…
• CVE-2026-10521 An high privileged remote attacker can access a hidden configuration method, tha CVE-2026-10521High 7.2
  CVE-2026-10521 CVSS:7.2 An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify…
• CVE-2026-9154 Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux CVE-2026-9154High 7.1
  CVE-2026-9154 CVSS:7.1 Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write…
• CVE-2026-8172 The Simple Basic Contact Form WordPress plugin through 20250114 does not escape CVE-2026-8172High 7.1
  CVE-2026-8172 CVSS:7.1 The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the…
• CVE-2026-10658 A missing length validation in the Zephyr Bluetooth Host ISO receive path can be CVE-2026-10658High 7.1
  CVE-2026-10658 CVSS:7.1 A missing length validation in the Zephyr Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In bt_iso_recv()…
• CVE-2026-10651 A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in CVE-2026-10651High 7.1
  CVE-2026-10651 CVSS:7.1 A malformed Bluetooth Classic SDP attribute can trigger a reachable assertion in Zephyr's SDP parser. In…

⚔️ Sploitus（72 条）

Unknown (72 条)

• Exploit for Deserialization of Untrusted Data in Splunk exploit
  Exploit for Deserialization of Untrusted Data in Splunk exploit
• Exploit for CVE-2026-43503 exploit CVE-2026-43503
  Exploit for CVE-2026-43503 exploit

…另有 70 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-27 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV