安全情报

📊 2026-06-29 漏洞情报日报 · 200 条 · 高危 87

AiRedTeam

29 Jun 2026 • 阅读时间 20 分钟

每日漏洞情报汇总 · 2026-06-29

📊 2026-06-29 漏洞情报日报

📋 共 200 条 🔥 高危/严重 87 条 🐙 GitHub-Advisory 53 条 🔥24 🛡️ NVD-Latest 63 条 🔥63 ⚔️ Sploitus 84 条

🤖 今日安全态势分析

🎯 今日重点关注

CVE-2026-46716 (Nezha) - 跨租户会话劫持： 影响 Nezha v1.14.13-v1.14.14 及 v2.0.0-v2.0.9。WebSocket 终端/文件管理器端点仅通过有效UUID认证，未校验所有权，导致攻击者可劫持其他租户的会话。无需交互即可利用，危害极高。
CVE-2026-53519 (Nezha Monitoring) - 未授权路径遍历： 影响 Nezha Dashboard。由于路由处理逻辑缺陷（使用字符串前缀而非路径段匹配），攻击者可通过构造`/dashboard..`等前缀发起路径遍历，获取服务器敏感文件。无需认证。
CVE-2026-48930 (Node.js) - TLS主机名绕过/权威重绑定： 影响所有Node.js受支持版本。由于TLS主机名处理中内嵌空字符（Embedded-nul）导致C字符串截断，可造成TLS证书验证绕过或DNS权威重绑定，攻击面广且利用门槛低。
GeoVision GV-LPC系列 (CVE-2026-57878等) - 未授权栈溢出： 影响GeoVision GV-LPC2011/LPC2211 V1.12及更早版本。存在多个堆栈缓冲区溢出漏洞（RTSP/Web请求），攻击者可通过发送特制数据包实现远程代码执行，CVSS高达9.8。
pnpm (多项CVE) - 依赖劫持与路径遍历： 影响pnpm包管理器。多个高危漏洞允许攻击者通过投毒的锁文件或配置依赖，在构建过程中执行任意代码或删除项目外文件，严重威胁供应链安全。

📈 威胁趋势

远程代码执行 (RCE)： 今日核心威胁。GeoVision 监控摄像头（CVE-2026-57878等）存在多个未认证栈溢出漏洞，可导致设备被完全控制。Node.js（CVE-2026-48930）的TLS绕过可导致中间人攻击并执行代码。
访问控制与权限提升： Nezha监控系统存在严重的身份认证缺失漏洞，包括会话劫持(CVE-2026-46716)和未授权文件访问(CVE-2026-53519)。pnpm的一系列漏洞涉及依赖混淆和路径穿越，可导致供应链攻击下的权限提升。
SQL注入： 多个WordPress插件（GeoDirectory、Real Estate 7、wpDataTables）存在高危未认证SQL注入漏洞（CVSS 9.3），可能导致数据库数据泄露或完全接管网站。
拒绝服务(DoS)： js-toml库(CVE-2026-49293)存在CPU耗尽漏洞，通过解析特定格式的BigInt可导致服务崩溃。

🛡️ 缓解建议

立即升级受影响软件： 优先升级Nezha至最新版本；将GeoVision GV-LPC设备固件升级至V1.12以上；更新所有受影响的WordPress插件（GeoDirectory、Real Estate 7、wpDataTables）；升级pnpm及js-toml库至安全版本。
紧急处置Node.js环境： 立即更新Node.js至官方发布的最新安全版本，修补TLS主机名截断漏洞。在更新前，建议严格限制对外暴露的HTTPS服务，并监控异常连接。
实施网络访问控制： 对暴露于公网的GeoVision摄像头、Nezha Dashboard及Node.js服务进行访问限制，仅允许必要IP或VPN访问，并启用防火墙规则阻断异常流量。
审查供应链安全： 针对pnpm漏洞，项目维护者应严格审查并锁定锁文件（lockfile），避免从不可信源引入依赖。同时启用CI/CD流水线中的依赖扫描与安全审计功能。

🐙 GitHub-Advisory（53 条）

Critical (2 条)

GHSA-q6xx-5vr8-p898 - Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSoc CVE-2026-46716Critical
Summary In nezha **v1.14.13–v1.14.14** and **v2.0.0–v2.0.9**, the WebSocket endpoints `GET /ws/terminal/:id` and `GET /ws/file/:id` authenticate the caller…
CVE-2026-53519 - Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leak CVE-2026-53519Critical
Summary `fallbackToFrontend` in the dashboard's `NoRoute` handler treats any URL whose **raw string** starts with `/dashboard` as an admin-frontend asset…

High (22 条)

CVE-2026-49293 - js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-pre CVE-2026-49293High 3.1
## Summary `js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a hand-written `parseBigInt` loop that…
CVE-2026-55697 - pnpm: Repository-controlled configDependencies can select a pacquet native insta CVE-2026-55697High 3.1
 ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected…
CVE-2026-55698 - pnpm: Project env lockfile can short-circuit package-manager resolution and exec CVE-2026-55698High 3.1
 ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected…
GHSA-fr4h-3cph-29xv - pnpm: Hoisted install imports lockfile alias outside node_modules High
## Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile…
GHSA-72r4-9c5j-mj57 - pnpm: `patch-remove` could delete project-selected files outside the patches dir High
## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could…
GHSA-qrv3-253h-g69c - pnpm: Path traversal in configDependencies env lockfile allows symlink creation High
## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config dependency…
CVE-2026-47071 - Hackney: `ssl:connect/2` post-handshake upgrade has no timeout CVE-2026-47071High
Summary The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the…
CVE-2026-47074 - Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OO CVE-2026-47074High
Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory without any size cap. The `after Timeout`…
CVE-2026-47073 - Hackney has unbounded buffer accumulation in WebSocket CVE-2026-47073High
Summary The WebSocket client in `src/hackney_ws.erl` imposes no upper bound on memory consumption across three distinct code paths. In each case, an…
CVE-2026-47067 - Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes CVE-2026-47067High
Summary [CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney's URL parser…
CVE-2026-49286 - PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-2 CVE-2026-49286High
Summary `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist: ```php if (0 ===…
CVE-2026-49287 - Statamic CMS's unsafe method invocation via collection sorting allows data destr CVE-2026-49287High
Impact The fix for GHSA-4jjr-vmv7-wh4w was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory…
GHSA-7vfx-4246-jcfh - SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API High
## Summary Four authorization bypass vulnerabilities in Symfony LiveComponent actions allow any authenticated user within a company to access, modify, or…
GHSA-wcr3-9x4c-f5gj - Blnk has an API key authorization bypass in owner and scope enforcement High
Blnk API key endpoints had an authorization issue that allowed non-master API keys to perform key-management actions outside their intended authorization…
GHSA-8jgf-23q5-x7xx - ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature byp High
Summary `ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incoming SNS message without validating that the…
CVE-2026-50016 - pnpm: Transitive dependency alias path traversal allows project path override vi CVE-2026-50016High
## Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that…
CVE-2026-50015 - pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Tr CVE-2026-50015High
## Summary pnpm's patch application pipeline (`@pnpm/patch-package`) performs no path validation on file paths extracted from `.patch` files. An attacker who…
CVE-2026-55487 - pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVE-2026-55487High
## Summary Keep build approval for opaque dependency sources byte-exact for GHSA-5wx6-mg75-v57r / CAND-PNPM-123. Merged upstream commit `bf1b731ee6` fixed the…
CVE-2026-49340 - gonic has arbitrary file write in createPlaylist: any authenticated user can wri CVE-2026-49340High
## Summary A logic error in `ServeCreateOrUpdatePlaylist` allows **any authenticated Subsonic user** (including non-admin) to write playlist M3U content to an…
CVE-2026-49339 - gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any us CVE-2026-49339High
## Summary The maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic/commit/6dd71e6) (`fix(subsonic):…
CVE-2026-49338 - Subsonic API: any authenticated user can delete or read any other user's playlis CVE-2026-49338High
## Summary In gonic, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once…
CVE-2026-55700 - pnpm: `stage download` writes outside its destination directory via manifest nam CVE-2026-55700High
## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by…

Medium (25 条)

CVE-2026-55180 - pnpm: Repository config can expand victim environment secrets into registry requ CVE-2026-55180Medium 3.1
 ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected…
CVE-2026-55699 - pnpm: Reserved bin name deletes PNPM_HOME during global remove CVE-2026-55699Medium 3.1
<details> <summary>Maintainer Action Plan</summary> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR…
CVE-2026-47076 - Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded CVE-2026-47076Medium
Summary `hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization using OTP's…
CVE-2026-47070 - Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body CVE-2026-47070Medium
Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authorization`) and, for…
CVE-2026-47075 - Hackney has CR/LF injection in query parameter CVE-2026-47075Medium
Summary `hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\r` or `\n`. RFC 3986 §3.4…
CVE-2026-47072 - Hackney has CRLF / header injection in WebSocket upgrade request CVE-2026-47072Medium
Summary CRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `host`, `path`, `headers`, and `protocols`…
CVE-2026-49359 - PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment op CVE-2026-49359Medium
Summary `pontedilana/php-weasyprint` fetches the content of option values server-side via `file_get_contents()` when the value looks like a URL, without…
CVE-2026-49288 - Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows CVE-2026-49288Medium
Impact An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users,…

…另有 17 条 Medium 级漏洞（已省略）

Low (4 条)

CVE-2026-48794 - Authelia has an Edge Case Access Control Rule Mismatch CVE-2026-48794Low 4.0
Impact **CVSSv4 Baseline Score:** Low 2.4 **CVSSv4 Weighted Score:** Low 1.3 The full CVSSv4 Vector for this vulnerability is: >…
CVE-2026-47069 - Hackney has CRLF / header injection via unvalidated `domain` and `path` options CVE-2026-47069Low
Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` and `Value` against CR/LF and control…
CVE-2026-49358 - PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temp CVE-2026-49358Low
Summary `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown…

…另有 1 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（63 条）

Critical (11 条)

CVE-2026-57881 An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in CVE-2026-57881Critical 9.8
CVE-2026-57881 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.…
CVE-2026-57880 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G CVE-2026-57880Critical 9.8
CVE-2026-57880 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.…
CVE-2026-57879 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G CVE-2026-57879Critical 9.8
CVE-2026-57879 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.…
CVE-2026-57878 An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in CVE-2026-57878Critical 9.8
CVE-2026-57878 CVSS:9.8 An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.…
CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lea CVE-2026-48930Critical 9.8
CVE-2026-48930 CVSS:9.8 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string…
CVE-2026-54831 Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. CVE-2026-54831Critical 9.3
CVE-2026-54831 CVSS:9.3 Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. 产品:
CVE-2026-54827 Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. CVE-2026-54827Critical 9.3
CVE-2026-54827 CVSS:9.3 Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. 产品:
CVE-2026-54825 Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. CVE-2026-54825Critical 9.3
CVE-2026-54825 CVSS:9.3 Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. 产品:
CVE-2026-54820 Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. CVE-2026-54820Critical 9.3
CVE-2026-54820 CVSS:9.3 Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. 产品:
CVE-2025-64152 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v CVE-2025-64152Critical 9.1
CVE-2025-64152 CVSS:9.1 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache…
CVE-2025-55017 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v CVE-2025-55017Critical 9.1
CVE-2025-55017 CVSS:9.1 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache…

High (52 条)

CVE-2025-68052 Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 ve CVE-2025-68052High 8.8
CVE-2025-68052 CVSS:8.8 Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions. 产品:
CVE-2026-50741 Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also re CVE-2026-50741High 8.8
CVE-2026-50741 CVSS:8.8 Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed…
CVE-2026-5305 The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium CVE-2026-5305High 8.8
CVE-2026-5305 CVSS:8.8 The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle…
CVE-2026-12244 If NSD is configured as secondary for a zone, the primary of that zone can crash CVE-2026-12244High 8.8
CVE-2026-12244 CVSS:8.8 If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a…
CVE-2026-10086 GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 bef CVE-2026-10086High 8.7
CVE-2026-10086 CVSS:8.7 GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1…
CVE-2026-57877 An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-L CVE-2026-57877High 8.6
CVE-2026-57877 CVSS:8.6 An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The…
CVE-2026-12053 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef CVE-2026-12053High 8.6
CVE-2026-12053 CVSS:8.6 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have…
CVE-2026-13325 A flaw was found in KubeVirt's migration proxy. When spec.configuration.migratio CVE-2026-13325High 8.5
CVE-2026-13325 CVSS:8.5 A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom…
CVE-2026-2053 The WSO2 API Manager's message flow component, when processing WS-Addressing hea CVE-2026-2053High 8.3
CVE-2026-2053 CVSS:8.3 The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict…
CVE-2026-9222 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior o CVE-2026-9222High 8.1
CVE-2026-9222 CVSS:8.1 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with…
CVE-2026-12246 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an ad CVE-2026-12246High 8.1
CVE-2026-12246 CVSS:8.1 NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family…
CVE-2026-40711 Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unit CVE-2026-40711High 8.0
CVE-2026-40711 CVSS:8.0 Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0,…
CVE-2026-10712 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 CVE-2026-10712High 8.0
CVE-2026-10712 CVSS:8.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before…
CVE-2026-45257 The KTLS receive path decrypted each record in place, assuming that the mbufs ho CVE-2026-45257High 7.8
CVE-2026-45257 CVSS:7.8 The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. …
CVE-2026-57920 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon t CVE-2026-57920High 7.7
CVE-2026-57920 CVSS:7.7 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain…
CVE-2026-10835 The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly saniti CVE-2026-10835High 7.7
CVE-2026-10835 CVSS:7.7 The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX…
CVE-2026-8666 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon CVE-2026-8666High 7.7
CVE-2026-8666 CVSS:7.7 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers…
CVE-2026-8665 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra CVE-2026-8665High 7.7
CVE-2026-8665 CVSS:7.7 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to…
CVE-2026-54826 Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 ver CVE-2026-54826High 7.6
CVE-2026-54826 CVSS:7.6 Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. 产品:
CVE-2026-54837 Unauthenticated Broken Access Control in Intranet & Private Site – All CVE-2026-54837High 7.5
CVE-2026-54837 CVSS:7.5 Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions. 产品:
CVE-2026-54835 Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 vers CVE-2026-54835High 7.5
CVE-2026-54835 CVSS:7.5 Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. 产品:
CVE-2026-54834 Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 vers CVE-2026-54834High 7.5
CVE-2026-54834 CVSS:7.5 Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. 产品:
CVE-2026-54832 Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. CVE-2026-54832High 7.5
CVE-2026-54832 CVSS:7.5 Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. 产品:
CVE-2026-54824 Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. CVE-2026-54824High 7.5
CVE-2026-54824 CVSS:7.5 Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. 产品:
CVE-2026-30041 An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 al CVE-2026-30041High 7.5
CVE-2026-30041 CVSS:7.5 An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a…
CVE-2025-68064 Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. CVE-2025-68064High 7.5
CVE-2025-68064 CVSS:7.5 Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. 产品:
CVE-2025-68063 Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Bask CVE-2025-68063High 7.5
CVE-2025-68063 CVSS:7.5 Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. 产品:
CVE-2026-57913 Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allo CVE-2026-57913High 7.5
CVE-2026-57913 CVSS:7.5 Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts. 产品:
CVE-2026-57912 Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data pro CVE-2026-57912High 7.5
CVE-2026-57912 CVSS:7.5 Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about…
CVE-2026-11702 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state CVE-2026-11702High 7.5
CVE-2026-11702 CVSS:7.5 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised…
CVE-2026-11625 Bytes::Random::Secure versions through 0.29 for Perl share internal state across CVE-2026-11625High 7.5
CVE-2026-11625 CVSS:7.5 Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before…
CVE-2026-57876 An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoV CVE-2026-57876High 7.5
CVE-2026-57876 CVSS:7.5 An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The…
CVE-2026-57875 An unauthenticated NULL pointer dereference vulnerability exists in the HTTP req CVE-2026-57875High 7.5
CVE-2026-57875 CVSS:7.5 An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI components in…
CVE-2026-57874 An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi CVE-2026-57874High 7.5
CVE-2026-57874 CVSS:7.5 An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and…
CVE-2026-57873 An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_up CVE-2026-57873High 7.5
CVE-2026-57873 CVSS:7.5 An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12…
CVE-2026-57872 An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in CVE-2026-57872High 7.5
CVE-2026-57872 CVSS:7.5 An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier.…
CVE-2026-49486 The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_T CVE-2026-49486High 7.5
CVE-2026-49486 CVSS:7.5 The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although…
CVE-2026-10823 The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access CVE-2026-10823High 7.5
CVE-2026-10823 CVSS:7.5 The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate…
CVE-2026-48933 A flaw in Node.js WebCrypto implementation can crash the process if the input of CVE-2026-48933High 7.5
CVE-2026-48933 CVSS:7.5 A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This…
CVE-2026-48619 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of O CVE-2026-48619High 7.5
CVE-2026-48619 CVSS:7.5 A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory…
CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in CVE-2026-48615High 7.5
CVE-2026-48615 CVSS:7.5 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy…
CVE-2026-9221 The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and e CVE-2026-9221High 7.5
CVE-2026-9221 CVSS:7.5 The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for…
CVE-2026-9220 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior e CVE-2026-9220High 7.5
CVE-2026-9220 CVSS:7.5 Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with…
CVE-2026-12937 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Pl CVE-2026-12937High 7.5
CVE-2026-12937 CVSS:7.5 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL…
CVE-2026-9702 The InPost PL WordPress plugin before 1.9.1 does not verify that the request ori CVE-2026-9702High 7.5
CVE-2026-9702 CVSS:7.5 The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the…
CVE-2026-12490 When a provide-xfr is given with a tls-auth-name, a secondary requesting a trans CVE-2026-12490High 7.5
CVE-2026-12490 CVSS:7.5 When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name.…
CVE-2026-12245 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS c CVE-2026-12245High 7.5
CVE-2026-12245 CVSS:7.5 NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process,…
CVE-2026-13311 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.protot CVE-2026-13311High 7.5
CVE-2026-13311 CVSS:7.5 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates…
CVE-2026-12077 The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via CVE-2026-12077High 7.5
CVE-2026-12077 CVSS:7.5 The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all…
CVE-2026-54833 Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. CVE-2026-54833High 7.4
CVE-2026-54833 CVSS:7.4 Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. 产品:
CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby b CVE-2026-57915High 7.3
CVE-2026-57915 CVSS:7.3 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported…
CVE-2026-57918 libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC i CVE-2026-57918High 7.1
CVE-2026-57918 CVSS:7.1 libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a…

⚔️ Sploitus（84 条）

Unknown (84 条)

Exploit for SQL Injection in Devcode Openstamanager exploit
Exploit for SQL Injection in Devcode Openstamanager exploit
Exploitarium-Detections exploit
Exploitarium-Detections exploit

…另有 82 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-06-29 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV