📊 2026-06-28 漏洞情报日报 · 200 条 · 高危 104
每日漏洞情报汇总 · 2026-06-28
📊 2026-06-28 漏洞情报日报
📋 共 200 条
🔥 高危/严重 104 条
🐙 GitHub-Advisory 53 条 🔥24
🛡️ NVD-Latest 80 条 🔥80
⚔️ Sploitus 67 条
🤖 今日安全态势分析
🎯 今日重点关注
- GeoVision GV-LPC 系列设备 (CVE-2026-57878/79/80/81)： 多个未认证栈缓冲区溢出漏洞（CVSS 9.8），攻击者可通过特殊构造的RTSP请求或Web请求实现远程代码执行，相关设备（V1.12及更早版本）暴露在公网时危害极大。
- Nezha 监控系统 (CVE-2026-53519 & CVE-2026-46716)： 两个严重漏洞：路径遍历漏洞允许未授权访问管理前端资源；WebSocket会话劫持漏洞允许跨租户终端/文件管理。利用链可导致完全控制监控代理。
- Cacti 框架 (CVE-2026-40079)： 命令注入漏洞（CVSS 9.8），因escape_command()函数缺乏输入过滤，攻击者可利用该漏洞在服务器上执行任意命令，影响1.2.30及以下版本。
- Node.js (CVE-2026-48930)： TLS主机名校验绕过（CVSS 9.8），利用嵌入空字符（NULL字节）的主机名可导致中间人攻击或权限提升，影响所有支持版本。
- pnpm 包管理器 (CVE-2026-55697/98 等系列)： 多个高危漏洞，攻击者通过精心构造的锁文件或configDependencies可实现路径遍历、符号链接攻击及包解析绕过，导致恶意代码执行。
📈 威胁趋势
- 远程代码执行 (RCE)： 占比最高，以GeoVision物联网设备、Cacti、Node.js为代表，攻击面集中在缺乏输入校验和内存安全问题上。
- 应用逻辑滥用/绕过： Nezha 和 pnpm 相关漏洞凸显对权限校验缺失（如会话无绑定）及路径解析逻辑漏洞的利用趋势。
- 拒绝服务 (DoS) / 资源消耗： js-toml库解析十六进制/二进制大整数时的O(n²)复杂度问题，可通过构造特殊输入导致CPU耗尽。
- SQL注入： GeoDirectory 和 Real Estate 7 等WordPress插件存在未认证SQL注入漏洞，攻击门槛低，影响大量网站。
🛡️ 缓解建议
- 立即打补丁或升级：优先升级 GeoVision GV-LPC 设备固件至V1.12以上；升级 Nezha 至 v1.14.15 或 v2.0.10+；升级 Cacti 至 1.2.31+；更新 Node.js 至最新安全版本。
- 限制网络暴露面：对 GeoVision 设备、Cacti 管理后台等易受攻击资产，不得直接暴露在公网，应使用VPN或内网隔离。
- 审查供应链依赖：立即排查项目中是否使用 js-toml v1.1.0 及以下版本；锁定pnpm版本并审计锁文件（pnpm-lock.yaml），拒绝未经验证的第三方configDependencies或patch配置。
- 部署WAF与入侵检测：对Web应用（如Cacti）启用WAF规则拦截命令注入尝试；监控WebSocket连接异常请求和涉及路径遍历（如`/dashboard..`）的访问日志。
🐙 GitHub-Advisory（53 条）
Critical (2 条)
- GHSA-q6xx-5vr8-p898 - Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSoc
CVE-2026-46716Critical
Summary In nezha **v1.14.13–v1.14.14** and **v2.0.0–v2.0.9**, the WebSocket endpoints `GET /ws/terminal/:id` and `GET /ws/file/:id` authenticate the caller… - CVE-2026-53519 - Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leak
CVE-2026-53519Critical
Summary `fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-frontend asset…
High (22 条)
- CVE-2026-49293 - js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-pre
CVE-2026-49293High 3.1
## Summary `js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that… - CVE-2026-55697 - pnpm: Repository-controlled configDependencies can select a pacquet native insta
CVE-2026-55697High 3.1
<!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected… - CVE-2026-55698 - pnpm: Project env lockfile can short-circuit package-manager resolution and exec
CVE-2026-55698High 3.1
<!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected… - GHSA-fr4h-3cph-29xv - pnpm: Hoisted install imports lockfile alias outside node_modules High
## Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile… - GHSA-72r4-9c5j-mj57 - pnpm: `patch-remove` could delete project-selected files outside the patches dir High
## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could… - GHSA-qrv3-253h-g69c - pnpm: Path traversal in configDependencies env lockfile allows symlink creation High
## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config dependency… - CVE-2026-47071 - Hackney: `ssl:connect/2` post-handshake upgrade has no timeout
CVE-2026-47071High
Summary The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the… - CVE-2026-47074 - Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OO
CVE-2026-47074High
Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory without any size cap. The `after Timeout`… - CVE-2026-47073 - Hackney has unbounded buffer accumulation in WebSocket
CVE-2026-47073High
Summary The WebSocket client in `src/hackney_ws.erl` imposes no upper bound on memory consumption across three distinct code paths. In each case, an… - CVE-2026-47067 - Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes
CVE-2026-47067High
Summary [CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney's URL parser… - CVE-2026-49286 - PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-2
CVE-2026-49286High
Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist: ```php if (0 ===… - CVE-2026-49287 - Statamic CMS's unsafe method invocation via collection sorting allows data destr
CVE-2026-49287High
Impact The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory… - GHSA-7vfx-4246-jcfh - SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API High
## Summary Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to access, modify, or… - GHSA-wcr3-9x4c-f5gj - Blnk has an API key authorization bypass in owner and scope enforcement High
Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions outside their intended authorization… - GHSA-8jgf-23q5-x7xx - ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature byp High
Summary `ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incoming SNS message without validating that the… - CVE-2026-50016 - pnpm: Transitive dependency alias path traversal allows project path override vi
CVE-2026-50016High
## Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that… - CVE-2026-50015 - pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Tr
CVE-2026-50015High
## Summary pnpm's patch application pipeline (`@pnpm/patch-package`) performs no path validation on file paths extracted from `.patch` files. An attacker who… - CVE-2026-55487 - pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
CVE-2026-55487High
## Summary Keep build approval for opaque dependency sources byte-exact for GHSA-5wx6-mg75-v57r / CAND-PNPM-123. Merged upstream commit `bf1b731ee6` fixed the… - CVE-2026-49340 - gonic has arbitrary file write in createPlaylist: any authenticated user can wri
CVE-2026-49340High
## Summary A logic error in `ServeCreateOrUpdatePlaylist` allows **any authenticated Subsonic user** (including non-admin) to write playlist M3U content to an… - CVE-2026-49339 - gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any us
CVE-2026-49339High
## Summary The maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic/commit/6dd71e6) (`fix(subsonic):… - CVE-2026-49338 - Subsonic API: any authenticated user can delete or read any other user's playlis
CVE-2026-49338High
## Summary In gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once… - CVE-2026-55700 - pnpm: `stage download` writes outside its destination directory via manifest nam
CVE-2026-55700High
## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by…
Medium (25 条)
- CVE-2026-55180 - pnpm: Repository config can expand victim environment secrets into registry requ
CVE-2026-55180Medium 3.1
<!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected… - CVE-2026-55699 - pnpm: Reserved bin name deletes PNPM_HOME during global remove
CVE-2026-55699Medium 3.1
<details> <summary>Maintainer Action Plan</summary> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR… - CVE-2026-47076 - Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded
CVE-2026-47076Medium
Summary `hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization using OTP's… - CVE-2026-47070 - Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body
CVE-2026-47070Medium
Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authorization`) and, for… - CVE-2026-47075 - Hackney has CR/LF injection in query parameter
CVE-2026-47075Medium
Summary `hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\r` or `\n`. RFC 3986 §3.4… - CVE-2026-47072 - Hackney has CRLF / header injection in WebSocket upgrade request
CVE-2026-47072Medium
Summary CRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `host`, `path`, `headers`, and `protocols`… - CVE-2026-49359 - PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment op
CVE-2026-49359Medium
Summary `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without… - CVE-2026-49288 - Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows
CVE-2026-49288Medium
Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users,…
…另有 17 条 Medium 级漏洞（已省略）
Low (4 条)
- CVE-2026-48794 - Authelia has an Edge Case Access Control Rule Mismatch
CVE-2026-48794Low 4.0
Impact **CVSSv4 Baseline Score:** Low 2.4 **CVSSv4 Weighted Score:** Low 1.3 The full CVSSv4 Vector for this vulnerability is: >… - CVE-2026-47069 - Hackney has CRLF / header injection via unvalidated `domain` and `path` options
CVE-2026-47069Low
Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` and `Value` against CR/LF and control… - CVE-2026-49358 - PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temp
CVE-2026-49358Low
Summary `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown…
…另有 1 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（80 条）
Critical (12 条)
- CVE-2026-57881 An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in
CVE-2026-57881Critical 9.8
CVE-2026-57881 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.… - CVE-2026-57880 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G
CVE-2026-57880Critical 9.8
CVE-2026-57880 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.… - CVE-2026-57879 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G
CVE-2026-57879Critical 9.8
CVE-2026-57879 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.… - CVE-2026-57878 An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in
CVE-2026-57878Critical 9.8
CVE-2026-57878 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.… - CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lea
CVE-2026-48930Critical 9.8
CVE-2026-48930 CVSS:9.8 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string… - CVE-2026-40079 Cacti is an open source performance and fault management framework. Versions 1.2
CVE-2026-40079Critical 9.8
CVE-2026-40079 CVSS:9.8 Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due… - CVE-2026-54831 Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.
CVE-2026-54831Critical 9.3
CVE-2026-54831 CVSS:9.3 Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. 产品: - CVE-2026-54827 Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.
CVE-2026-54827Critical 9.3
CVE-2026-54827 CVSS:9.3 Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. 产品: - CVE-2026-54825 Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.
CVE-2026-54825Critical 9.3
CVE-2026-54825 CVSS:9.3 Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. 产品: - CVE-2026-54820 Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.
CVE-2026-54820Critical 9.3
CVE-2026-54820 CVSS:9.3 Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. 产品: - CVE-2025-64152 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v
CVE-2025-64152Critical 9.1
CVE-2025-64152 CVSS:9.1 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache… - CVE-2025-55017 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v
CVE-2025-55017Critical 9.1
CVE-2025-55017 CVSS:9.1 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache…
High (68 条)
- CVE-2025-68052 Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 ve
CVE-2025-68052High 8.8
CVE-2025-68052 CVSS:8.8 Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions. 产品: - CVE-2026-50741 Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also re
CVE-2026-50741High 8.8
CVE-2026-50741 CVSS:8.8 Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed… - CVE-2026-5305 The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium
CVE-2026-5305High 8.8
CVE-2026-5305 CVSS:8.8 The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle… - CVE-2026-12244 If NSD is configured as secondary for a zone, the primary of that zone can crash
CVE-2026-12244High 8.8
CVE-2026-12244 CVSS:8.8 If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a… - CVE-2026-9155 OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux
CVE-2026-9155High 8.8
CVE-2026-9155 CVSS:8.8 OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS… - CVE-2026-9787 Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vuln
CVE-2026-9787High 8.8
CVE-2026-9787 CVSS:8.8 Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-9786 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab
CVE-2026-9786High 8.8
CVE-2026-9786 CVSS:8.8 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-9785 Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulner
CVE-2026-9785High 8.8
CVE-2026-9785 CVSS:8.8 Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-9784 Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulner
CVE-2026-9784High 8.8
CVE-2026-9784 CVSS:8.8 Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-9783 Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vul
CVE-2026-9783High 8.8
CVE-2026-9783 CVSS:8.8 Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers… - CVE-2026-9782 Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulner
CVE-2026-9782High 8.8
CVE-2026-9782 CVSS:8.8 Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-9781 Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerab
CVE-2026-9781High 8.8
CVE-2026-9781 CVSS:8.8 Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-9780 Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vuln
CVE-2026-9780High 8.8
CVE-2026-9780 CVSS:8.8 Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-7570 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab
CVE-2026-7570High 8.8
CVE-2026-7570 CVSS:8.8 Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-7569 Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vuln
CVE-2026-7569High 8.8
CVE-2026-7569 CVSS:8.8 Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to… - CVE-2026-10086 GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 bef
CVE-2026-10086High 8.7
CVE-2026-10086 CVSS:8.7 GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1… - CVE-2026-57877 An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-L
CVE-2026-57877High 8.6
CVE-2026-57877 CVSS:8.6 An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The… - CVE-2026-12053 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef
CVE-2026-12053High 8.6
CVE-2026-12053 CVSS:8.6 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have… - CVE-2026-13325 A flaw was found in KubeVirt's migration proxy. When spec.configuration.migratio
CVE-2026-13325High 8.5
CVE-2026-13325 CVSS:8.5 A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom… - CVE-2026-2053 The WSO2 API Manager's message flow component, when processing WS-Addressing hea
CVE-2026-2053High 8.3
CVE-2026-2053 CVSS:8.3 The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict… - CVE-2026-9222 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior o
CVE-2026-9222High 8.1
CVE-2026-9222 CVSS:8.1 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with… - CVE-2026-12246 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an ad
CVE-2026-12246High 8.1
CVE-2026-12246 CVSS:8.1 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family… - CVE-2026-40711 Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unit
CVE-2026-40711High 8.0
CVE-2026-40711 CVSS:8.0 Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0,… - CVE-2026-10712 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10
CVE-2026-10712High 8.0
CVE-2026-10712 CVSS:8.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before… - CVE-2026-45257 The KTLS receive path decrypted each record in place, assuming that the mbufs ho
CVE-2026-45257High 7.8
CVE-2026-45257 CVSS:7.8 The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. … - CVE-2026-57920 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon t
CVE-2026-57920High 7.7
CVE-2026-57920 CVSS:7.7 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain… - CVE-2026-10835 The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly saniti
CVE-2026-10835High 7.7
CVE-2026-10835 CVSS:7.7 The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX… - CVE-2026-8666 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon
CVE-2026-8666High 7.7
CVE-2026-8666 CVSS:7.7 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers… - CVE-2026-8665 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra
CVE-2026-8665High 7.7
CVE-2026-8665 CVSS:7.7 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to… - CVE-2026-8660 OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect P
CVE-2026-8660High 7.7
CVE-2026-8660 CVSS:7.7 OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute… - CVE-2026-8592 OS Command Injection vulnerability in the process_string action of Rapid7 Insigh
CVE-2026-8592High 7.7
CVE-2026-8592 CVSS:7.7 OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to… - CVE-2026-54826 Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 ver
CVE-2026-54826High 7.6
CVE-2026-54826 CVSS:7.6 Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. 产品: - CVE-2026-39951 Cacti is an open source performance and fault management framework. Versions 1.2
CVE-2026-39951High 7.6
CVE-2026-39951 CVSS:7.6 Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability… - CVE-2026-54837 Unauthenticated Broken Access Control in Intranet & Private Site – All
CVE-2026-54837High 7.5
CVE-2026-54837 CVSS:7.5 Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions. 产品: - CVE-2026-54835 Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 vers
CVE-2026-54835High 7.5
CVE-2026-54835 CVSS:7.5 Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. 产品: - CVE-2026-54834 Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 vers
CVE-2026-54834High 7.5
CVE-2026-54834 CVSS:7.5 Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. 产品: - CVE-2026-54832 Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
CVE-2026-54832High 7.5
CVE-2026-54832 CVSS:7.5 Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. 产品: - CVE-2026-54824 Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.
CVE-2026-54824High 7.5
CVE-2026-54824 CVSS:7.5 Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. 产品: - CVE-2026-30041 An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 al
CVE-2026-30041High 7.5
CVE-2026-30041 CVSS:7.5 An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a… - CVE-2025-68064 Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
CVE-2025-68064High 7.5
CVE-2025-68064 CVSS:7.5 Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. 产品: - CVE-2025-68063 Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Bask
CVE-2025-68063High 7.5
CVE-2025-68063 CVSS:7.5 Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. 产品: - CVE-2026-57913 Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allo
CVE-2026-57913High 7.5
CVE-2026-57913 CVSS:7.5 Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts. 产品: - CVE-2026-57912 Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data pro
CVE-2026-57912High 7.5
CVE-2026-57912 CVSS:7.5 Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about… - CVE-2026-11702 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state
CVE-2026-11702High 7.5
CVE-2026-11702 CVSS:7.5 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised… - CVE-2026-11625 Bytes::Random::Secure versions through 0.29 for Perl share internal state across
CVE-2026-11625High 7.5
CVE-2026-11625 CVSS:7.5 Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before… - CVE-2026-57876 An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoV
CVE-2026-57876High 7.5
CVE-2026-57876 CVSS:7.5 An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The… - CVE-2026-57875 An unauthenticated NULL pointer dereference vulnerability exists in the HTTP req
CVE-2026-57875High 7.5
CVE-2026-57875 CVSS:7.5 An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in… - CVE-2026-57874 An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi
CVE-2026-57874High 7.5
CVE-2026-57874 CVSS:7.5 An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and… - CVE-2026-57873 An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_up
CVE-2026-57873High 7.5
CVE-2026-57873 CVSS:7.5 An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12… - CVE-2026-57872 An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in
CVE-2026-57872High 7.5
CVE-2026-57872 CVSS:7.5 An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.… - CVE-2026-49486 The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_T
CVE-2026-49486High 7.5
CVE-2026-49486 CVSS:7.5 The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although… - CVE-2026-10823 The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access
CVE-2026-10823High 7.5
CVE-2026-10823 CVSS:7.5 The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate… - CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of
CVE-2026-48933High 7.5
CVE-2026-48933 CVSS:7.5 A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This… - CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of O
CVE-2026-48619High 7.5
CVE-2026-48619 CVSS:7.5 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory… - CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in
CVE-2026-48615High 7.5
CVE-2026-48615 CVSS:7.5 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy… - CVE-2026-9221 The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and e
CVE-2026-9221High 7.5
CVE-2026-9221 CVSS:7.5 The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for… - CVE-2026-9220 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior e
CVE-2026-9220High 7.5
CVE-2026-9220 CVSS:7.5 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with… - CVE-2026-12937 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Pl
CVE-2026-12937High 7.5
CVE-2026-12937 CVSS:7.5 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL… - CVE-2026-9702 The InPost PL WordPress plugin before 1.9.1 does not verify that the request ori
CVE-2026-9702High 7.5
CVE-2026-9702 CVSS:7.5 The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the… - CVE-2026-12490 When a provide-xfr is given with a tls-auth-name, a secondary requesting a trans
CVE-2026-12490High 7.5
CVE-2026-12490 CVSS:7.5 When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name.… - CVE-2026-12245 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS c
CVE-2026-12245High 7.5
CVE-2026-12245 CVSS:7.5 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process,… - CVE-2026-13311 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.protot
CVE-2026-13311High 7.5
CVE-2026-13311 CVSS:7.5 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates… - CVE-2026-12077 The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via
CVE-2026-12077High 7.5
CVE-2026-12077 CVSS:7.5 The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all… - CVE-2026-54833 Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.
CVE-2026-54833High 7.4
CVE-2026-54833 CVSS:7.4 Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. 产品: - CVE-2026-57589 sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local p
CVE-2026-57589High 7.4
CVE-2026-57589 CVSS:7.4 sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch… - CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby b
CVE-2026-57915High 7.3
CVE-2026-57915 CVSS:7.3 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported… - CVE-2026-57918 libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC i
CVE-2026-57918High 7.1
CVE-2026-57918 CVSS:7.1 libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a… - CVE-2026-9154 Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux
CVE-2026-9154High 7.1
CVE-2026-9154 CVSS:7.1 Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write…
⚔️ Sploitus（67 条）
Unknown (67 条)
- Exploit for Unrestricted Upload of File with Dangerous Type in Devcode Openstamanager exploit
Exploit for Unrestricted Upload of File with Dangerous Type in Devcode Openstamanager exploit - vuln-corpus exploit
vuln-corpus exploit
…另有 65 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-06-28 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV