📊 2026-07-03 漏洞情报日报 · 200 条 · 高危 103
每日漏洞情报汇总 · 2026-07-03
📊 2026-07-03 漏洞情报日报
📋 共 200 条
🔥 高危/严重 103 条
🐙 GitHub-Advisory 100 条 🔥49
🛡️ NVD-Latest 54 条 🔥54
⚔️ Sploitus 46 条
🤖 今日安全态势分析
🎯 今日重点关注
- Adobe ColdFusion 双漏洞链 (CVE-2026-48277, CVE-2026-48276, CVSS 10.0)： 影响 ColdFusion 2025.9/2023.20 及更早版本。攻击者无需认证即可通过输入验证缺陷和危险文件上传漏洞实现远程代码执行，利用难度极低，极易形成蠕虫式攻击。
- Mautic 服务器端模板注入与路径遍历 (CVE-2026-9558, CVE-2026-9559, Critical)： 影响 Mautic 开源营销自动化平台。具备任意权限的认证用户可利用模板引擎无沙箱缺陷执行任意代码，或通过导入ZIP文件的路径遍历漏洞实现任意文件读写，威胁内部数据安全。
- 9router 双重致命缺陷 (GHSA-g6g7-pvmx-m74p & CVE-2026-49352, Critical)： 影响 9router npm包 v0.4.39及以下版本。该路由器的 Dashboard 存在硬编码JWT密钥，可致权限绕过；同时，其后端API接口存在无认证的OS命令注入漏洞，两者结合可导致设备完全失陷。
- QUIC 协议栈TLS验证绕过 (CVE-2026-49457, Critical)： 影响 QUIC 协议客户端实现。因未校验 TLS 1.3 握手阶段的 CertificateVerify 签名及证书链，攻击者可轻易实施中间人攻击，解密、篡改所有 QUIC 流量，影响依赖于该协议的安全通信。
- UltraVNC 中继器缓冲区溢出 (CVE-2026-7840, CVSS 9.8)： 影响 UltraVNC repeater 1.8.2.2及更早版本。其HTTP管理服务器存在全局缓冲区溢出，远程攻击者无需认证即可利用畸形请求导致服务崩溃或执行任意代码，威胁内网VNC管理安全。
📈 威胁趋势
- 远程代码执行（RCE）： 今日数量最多，涵盖 ColdFusion、Mautic、9router、LLaMA-Factory、Firefox 及 NetScaler 等多个主流平台。攻击面从Web应用到基础设施组件，且多个漏洞无需认证即可触发，风险极高。
- 权限提升与身份绕过： 包含 9router 硬编码JWT密钥、WordPress SMS插件账户接管漏洞。攻击者可借此获取管理员权限，为后续内网渗透铺平道路。
- 信息泄露与路径遍历： 涉及 Mautic 文件上传、LaunchServer 任意文件读取及 fast-mcp-telegram 令牌绕过。此类漏洞直接泄露服务器敏感文件或凭据，通常为勒索或数据窃取的前置步骤。
- 拒绝服务（DoS）与内存损坏： 集中出现在 NetScaler ADC/Gateway 及 UltraVNC。内存溢出不仅导致服务崩溃，亦可演变为代码执行，对关键业务连续性构成严重威胁。
🛡️ 缓解建议
- 立即升级受影响软件： 优先升级 Adobe ColdFusion 至官方最新版；更新 Mautic、9router 包及 UltraVNC repeater 至已修复版本；修补 NetScaler 和 LLaMA-Factory 至安全版本。
- 加强认证与密钥管理： 检查 9router 实例，必须设置环境变量
JWT_SECRET为强随机字符串，移除回退的硬编码密钥；为所有QUIC应用开启并强制完整的证书链校验。 - 强化输入验证与访问控制： 针对 ColdFusion 应用，在WAF层严格过滤上传文件类型；为 Mautic 等平台配置最小权限原则，限制用户上传和执行自定义模板的权限。
- 隔离与监控高危服务： 将 VNC 中继器、管理后台等关键服务置于内部网络或VPN后方，避免直接暴露于公网。部署入侵检测规则，重点监控异常的命令执行和文件读取行为。
🐙 GitHub-Advisory（100 条）
Critical (12 条)
- CVE-2026-52735 - zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled
CVE-2026-52735Critical
Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node validates blocks on mainnet, testnet, or any… - CVE-2026-9558 - Mautic has Server-Side Template Injection (SSTI) in Theme Templates
CVE-2026-9558Critical
Summary A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox… - CVE-2026-9559 - Mautic vulnerable to Path Traversal via Campaign Import
CVE-2026-9559Critical
Summary A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in… - GHSA-g6g7-pvmx-m74p - 9router: Missing Authorization and OS Command Injection Critical
# Unauthenticated RCE via `/api/tunnel/tailscale-install` **Affected:** `9router` (npm package) — current master (`v0.4.39`). Summary `POST… - CVE-2026-52830 - fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram sessio
CVE-2026-52830Critical
## Summary fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved… - CVE-2026-54617 - LaunchServer FileServerHandler has an unauthenticated path traversal issue
CVE-2026-54617Critical
Summary An unauthenticated path traversal in the LaunchServer HTTP file server (`FileServerHandler`) lets any remote actor read **any file** readable by the… - CVE-2026-49352 - 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
CVE-2026-49352Critical
Summary 9router uses a publicly known hardcoded string `"9router-default-secret-change-me"` as the fallback of JWT secret for all Dashboard session JWTs when… - CVE-2026-49457 - QUIC has Broken TLS verification
CVE-2026-49457Critical
Impact The QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was… - CVE-2026-44939 - Rancher vulnerable to command injection through unsanitized YAML parameter
CVE-2026-44939Critical
Impact A critical command injection vulnerability has been identified in the Rancher Manager cluster import endpoint `/v3/import/{token}_{clusterId}.yaml`… - CVE-2026-44935 - Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `v
CVE-2026-44935Critical
Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share the same downstream clusters (e.g.,… - CVE-2026-41052 - Rancher has Privilege Escalation from Project Owner to Host
CVE-2026-41052Critical
Impact A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to modify Pod Security Admission (PSA) labels… - CVE-2026-53943 - Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
CVE-2026-53943Critical
Impact When Ghost is behind a shared caching layer that results in cached content being shared between different visitors (e.g., Fastly, Cloudflare, nginx…
High (37 条)
- GHSA-f9ff-5x35-7gfw - Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perfor High
## Summary Authorization for scoped (agent) MCP callers is enforced **inline, per tool**, and is applied inconsistently — several mutating tools silently omit… - CVE-2026-52736 - Zebra has block suppression via NU5 same-header body poisoning of sent-hash cach
CVE-2026-52736High
## Description Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections… - CVE-2026-9808 - Mautic has an Authorization Bypass in API v2 Endpoints
CVE-2026-9808High
Summary An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with… - CVE-2026-9809 - Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
CVE-2026-9809High
Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on… - CVE-2026-50281 - Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwr
CVE-2026-50281High
## Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an… - CVE-2026-50282 - Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forc
CVE-2026-50282High
We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete… - CVE-2026-52746 - jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-52746High
Impact In JSONata `<v2.2.0`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function… - GHSA-322x-v876-g883 - @asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows ar High
## Summary The `matchFileSnapshot` function in `src/assertions/snapshots.ts` accepted a `filePath` parameter with zero validation. When snapshot update mode… - CVE-2026-52817 - Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalati
CVE-2026-52817High
Summary In the [Debian.sudoers](https://github.com/Linuxfabrik/monitoring-plugins/blob/main/assets/sudoers/Debian.sudoers) file, `apt-get` is allowed for the… - CVE-2026-49283 - SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authenticat
CVE-2026-49283High
## Summary SimpleSAMLphp's HTTP-Artifact receive path can treat an unsigned embedded SAML `Response` as cryptographically valid for the wrong IdP. In the… - CVE-2026-52829 - Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update
CVE-2026-52829High
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node listens on the default `[::]` address on a Linux host (the… - CVE-2026-49289 - SimpleSAMLphp has Possible DoS via XPath Transform
CVE-2026-49289High
## Summary This library turned out to be vulnerable to Denial-of-Service attacks using XPath transforms. A mitigation has been put in place to restrict the… - CVE-2026-50194 - Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
CVE-2026-50194High
Summary When Steeltoe management endpoints are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware… - CVE-2026-50196 - Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire regis
CVE-2026-50196High
Summary `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification… - CVE-2026-50200 - Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
CVE-2026-50200High
Summary The `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The… - CVE-2026-2092 - Keycloak: Unauthorized access via improper validation of encrypted SAML assertio
CVE-2026-2092High
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed… - CVE-2026-52834 - jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
CVE-2026-52834High
Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test… - CVE-2026-52792 - Algernon vulnerable to server-side script source disclosure on Windows via NTFS
CVE-2026-52792High
Summary Algernon selects its file handler from `filepath.Ext()` (engine/handlers.go:134), which does not treat the NTFS-equivalent names `x.lua::$DATA`,… - CVE-2026-49284 - SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Respon
CVE-2026-49284High
## Summary SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login. If a saved SP state contains `ExpectedIssuer = IdP A`,… - CVE-2026-46599 - golang.org/x/image/tiff has excessive resource consumption in PackBits decompres
CVE-2026-46599High
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in… - CVE-2026-49353 - 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host
CVE-2026-49353High
## Summary The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only access gate in `src/dashboardGuard.js`… - CVE-2026-49360 - Recce server has unauthenticated SQL execution that allows local file read/write
CVE-2026-49360High
Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution… - CVE-2026-48815 - sigstore's `certificateOIDs` verification constraints are silently dropped and n
CVE-2026-48815High
Summary The documented `certificateOIDs` option in `sigstore.verify()` is accepted by the public API but discarded before verification, so required certificate… - GHSA-5qfp-32cf-69jh - SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling fu High
The HTTP `/rpc` `sessions` method returned every attached session UUID without authentication, and the `/rpc` handler accepted an arbitrary `session` field… - GHSA-4vgr-h27g-cf9p - SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation High
The HTTP `/rpc` endpoint has a time-of-check/time-of-use (TOCTOU) race condition on internal session state. When authenticated and unauthenticated requests are… - GHSA-q729-696q-g9pq - SurrealDB has Denial of Service in JSON parser due to nested objects High
The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when parsing nested `{`, `[`, or `(` tokens. The expression parser… - GHSA-wjjj-24cx-f28g - SurrealDB has unauthenticated remote DoS via malformed RPC `use` call High
A single unauthenticated WebSocket message to `/rpc` crashed the SurrealDB server. Sending `use { db: "x" }` without first selecting a namespace hit… - CVE-2026-49998 - Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT
CVE-2026-49998High
#### Summary Centrifugo's dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cached from another allowed issuer. The JWKS… - CVE-2026-44938 - Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent
CVE-2026-44938High
Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from `namespaceLabels` in `fleet.yaml`… - CVE-2026-44937 - Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repos
CVE-2026-44937High
Impact A vulnerability has been identified in Fleet when the webhook endpoint is configured without a secret; an attacker can forge webhook requests. The… - CVE-2026-41053 - Rancher has over-inclusive team membership expansion in GitHub App authenticatio
CVE-2026-41053High
Impact A vulnerability has been identified within Rancher Manager in the GitHub App authentication provider. When evaluating permissions, the provider… - CVE-2026-9795 - Keycloak has privilege escalation via improper scope mapping enforcement
CVE-2026-9795High
Description A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can… - CVE-2026-50151 - oras-go blob upload vulnerable to credential forwarding via unvalidated Location
CVE-2026-50151High
## Summary oras-go follows a registry-controlled `Location` header during the monolithic blob upload flow and reuses the `Authorization` header from the… - CVE-2026-50163 - `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract
CVE-2026-50163High
Root cause The tar-extraction helper `ensureLinkPath` at… - CVE-2026-53712 - OnGres SCRAM silent channel-binding authentication downgrade via unsupported cer
CVE-2026-53712High
## Summary A flaw in `com.ongres.scram:scram-client` allows an attacker capable of performing a TLS man-in-the-middle (MITM) attack to silently downgrade a… - CVE-2026-50138 - goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode
CVE-2026-50138High
# WebDAV listener ignores `--read-only`, `--upload-only`, and `--no-delete` mode flags **Ecosystem:** Go **Package:** `goshs.de/goshs/v2`… - CVE-2026-50143 - Apify Model Context Protocol (MCP) server: Actor MCP path authority injection le
CVE-2026-50143High
## Actor MCP path authority injection leaks Apify token Summary `@apify/actors-mcp-server` version `0.10.7` builds Actor standby URLs by directly concatenating…
Medium (42 条)
- GHSA-c8w6-x74f-vmg3 - zebrad vulnerable to full node denial of service via crafted Sapling receiver in Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server… - CVE-2026-52732 - zebrad has mempool transaction admission denial via single-peer inbound queue sa
CVE-2026-52732Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections (`network.listen_addr` is… - CVE-2026-52737 - Zebra has sync restart poisoning from single unauthenticated peer via above-look
CVE-2026-52737Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections and is syncing or catching up… - CVE-2026-52738 - Zebra: Finalized address balance credit-first overflow on consensus-valid blocks
CVE-2026-52738Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks on any Zcash network. Summary The finalized… - CVE-2026-52739 - Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate
CVE-2026-52739Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks past the checkpoint height (non-finalized… - CVE-2026-9557 - Mautic Focus component Vulnerable to SSRF
CVE-2026-9557Medium
Summary A Server-Side Request Forgery (SSRF) vulnerability exists in the Mautic Focus component (`MauticFocusBundle`). Under certain conditions, insufficiency… - CVE-2026-9811 - Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
CVE-2026-9811Medium
Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating… - CVE-2026-52733 - zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after
CVE-2026-52733Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node participates in a network where chain forks occur (mainnet,…
…另有 34 条 Medium 级漏洞（已省略）
Low (9 条)
- GHSA-443g-gwgp-49x4 - zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped Low
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections. Summary The `read_getblocks`… - GHSA-h72h-ppcx-998p - Zebra has pre-handshake buffer capacity reservation based on attacker-claimed bo Low
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections (`network.listen_addr` is… - CVE-2026-50268 - Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
CVE-2026-50268Low
Summary Configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting…
…另有 6 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（54 条）
Critical (16 条)
- CVE-2026-48277 ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu
CVE-2026-48277Critical 10.0
CVE-2026-48277 CVSS:10.0 ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in… - CVE-2026-48276 ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted
CVE-2026-48276Critical 10.0
CVE-2026-48276 CVSS:10.0 ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that… - CVE-2026-11387 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart
CVE-2026-11387Critical 9.8
CVE-2026-11387 CVSS:9.8 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to… - CVE-2026-7840 UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embed
CVE-2026-7840Critical 9.8
CVE-2026-7840 CVSS:9.8 UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions… - CVE-2026-14241 Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidenc
CVE-2026-14241Critical 9.8
CVE-2026-14241 CVSS:9.8 Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough… - CVE-2026-8655 Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway
CVE-2026-8655Critical 9.8
CVE-2026-8655 CVSS:9.8 Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and… - CVE-2026-8452 Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unp
CVE-2026-8452Critical 9.8
CVE-2026-8452 CVSS:9.8 Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service… - CVE-2026-58116 LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that
CVE-2026-58116Critical 9.8
CVE-2026-58116 CVSS:9.8 LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary… - CVE-2026-8402 Improper neutralization of special elements used in an SQL command ('SQL injecti
CVE-2026-8402Critical 9.8
CVE-2026-8402 CVSS:9.8 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Eksagate Electronic Engineering… - CVE-2026-14162 Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure
CVE-2026-14162Critical 9.8
CVE-2026-14162 CVSS:9.8 Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote… - CVE-2026-13766 DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquote
CVE-2026-13766Critical 9.8
CVE-2026-13766 CVSS:9.8 DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a… - CVE-2026-14198 @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside
CVE-2026-14198Critical 9.1
CVE-2026-14198 CVSS:9.1 @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware… - CVE-2026-7839 UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server wit
CVE-2026-7839Critical 9.1
CVE-2026-7839 CVSS:9.1 UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In… - CVE-2026-6070 The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated A
CVE-2026-6070Critical 9.1
CVE-2026-6070 CVSS:9.1 The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including… - CVE-2026-6556 @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for m
CVE-2026-6556Critical 9.1
CVE-2026-6556 CVSS:9.1 @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a… - CVE-2026-10539 A Control-M/Server communication command does not sufficiently filter or sanitiz
CVE-2026-10539Critical 9.0
CVE-2026-10539 CVSS:9.0 A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this…
High (38 条)
- CVE-2026-13228 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for W
CVE-2026-13228High 8.8
CVE-2026-13228 CVSS:8.8 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to… - CVE-2026-12224 The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via upd
CVE-2026-12224High 8.8
CVE-2026-12224 CVSS:8.8 The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to,… - CVE-2026-12158 The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is v
CVE-2026-12158High 8.8
CVE-2026-12158 CVSS:8.8 The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions… - CVE-2026-7838 UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap b
CVE-2026-7838High 8.8
CVE-2026-7838 CVSS:8.8 UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response… - CVE-2026-53488 containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3
CVE-2026-53488High 8.8
CVE-2026-53488 CVSS:8.8 containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates… - CVE-2026-27957 Coolify is an open-source and self-hostable tool for managing servers, applicati
CVE-2026-27957High 8.8
CVE-2026-27957 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an… - CVE-2026-41053 Incorrect authentication caching in the team member ship expansion of the Ranche
CVE-2026-41053High 8.8
CVE-2026-41053 CVSS:8.8 Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting… - CVE-2026-11794 The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin befo
CVE-2026-11794High 8.1
CVE-2026-11794 CVSS:8.1 The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned… - CVE-2026-10750 The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks
CVE-2026-10750High 8.1
CVE-2026-10750 CVSS:8.1 The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token… - CVE-2026-10538 Messaging consumer functionality allows deserialization of user-controlled data
CVE-2026-10538High 8.0
CVE-2026-10538 CVSS:8.0 Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types… - CVE-2026-14191 An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in
CVE-2026-14191High 7.8
CVE-2026-14191 CVSS:7.8 An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in… - CVE-2026-7831 UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in
CVE-2026-7831High 7.6
CVE-2026-7831 CVSS:7.6 UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In… - CVE-2026-14181 @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization
CVE-2026-14181High 7.5
CVE-2026-14181 CVSS:7.5 @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming… - CVE-2026-12576 DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a
CVE-2026-12576High 7.5
CVE-2026-12576 CVSS:7.5 DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability. 产品: - CVE-2026-12575 DVP80ES3 with Improper Resource Shutdown or Release vulnerability.
CVE-2026-12575High 7.5
CVE-2026-12575 CVSS:7.5 DVP80ES3 with Improper Resource Shutdown or Release vulnerability. 产品: - CVE-2026-1239 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr
CVE-2026-1239High 7.5
CVE-2026-1239 CVSS:7.5 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to… - CVE-2026-14193 DVP80ES300T with Improper Validation of Array Index Vulnerability
CVE-2026-14193High 7.5
CVE-2026-14193 CVSS:7.5 DVP80ES300T with Improper Validation of Array Index Vulnerability 产品: - CVE-2026-11823 The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to S
CVE-2026-11823High 7.5
CVE-2026-11823 CVSS:7.5 The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of… - CVE-2026-11568 The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not
CVE-2026-11568High 7.5
CVE-2026-11568 CVSS:7.5 The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before… - CVE-2026-13468 The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for W
CVE-2026-13468High 7.5
CVE-2026-13468 CVSS:7.5 The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all… - CVE-2026-12923 The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Ca
CVE-2026-12923High 7.5
CVE-2026-12923 CVSS:7.5 The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due… - CVE-2026-20458 In Modem, there is a possible memory corruption due to a missing bounds check. T
CVE-2026-20458High 7.5
CVE-2026-20458 CVSS:7.5 In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a… - CVE-2026-54592 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby ge
CVE-2026-54592High 7.5
CVE-2026-54592 CVSS:7.5 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child,… - CVE-2026-8451 Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to
CVE-2026-8451High 7.5
CVE-2026-8451 CVSS:7.5 Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is… - CVE-2026-58016 A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new
CVE-2026-58016High 7.5
CVE-2026-58016 CVSS:7.5 A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when… - CVE-2026-57081 Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion v
CVE-2026-57081High 7.5
CVE-2026-57081 CVSS:7.5 Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once… - CVE-2026-57080 Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion v
CVE-2026-57080High 7.5
CVE-2026-57080 CVSS:7.5 Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The… - CVE-2026-14161 Hospital Quening Management developed by Advantech has a Sensitive Data Exposure
CVE-2026-14161High 7.5
CVE-2026-14161 CVSS:7.5 Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote… - CVE-2026-54475 Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ A
CVE-2026-54475High 7.5
CVE-2026-54475 CVSS:7.5 Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary… - CVE-2026-12579 AS228T with Authentication Bypass Vulnerability
CVE-2026-12579High 7.4
CVE-2026-12579 CVSS:7.4 AS228T with Authentication Bypass Vulnerability 产品: - CVE-2026-7830 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authent
CVE-2026-7830High 7.4
CVE-2026-7830 CVSS:7.4 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In… - CVE-2026-58014 A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_lo
CVE-2026-58014High 7.3
CVE-2026-58014 CVSS:7.3 A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when… - CVE-2026-12142 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln
CVE-2026-12142High 7.2
CVE-2026-12142 CVSS:7.2 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]'… - CVE-2026-50043 Improper neutralization of special elements used in an OS command ('OS Command I
CVE-2026-50043High 7.2
CVE-2026-50043 CVSS:7.2 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-A100/MB-A110.… - CVE-2026-11883 The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not corr
CVE-2026-11883High 7.2
CVE-2026-11883 CVSS:7.2 The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication… - CVE-2026-7829 UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds w
CVE-2026-7829High 7.2
CVE-2026-7829 CVSS:7.2 UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In… - CVE-2026-7517 The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable t
CVE-2026-7517High 7.2
CVE-2026-7517 CVSS:7.2 The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… - CVE-2026-13731 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for
CVE-2026-13731High 7.2
CVE-2026-13731 CVSS:7.2 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting…
⚔️ Sploitus（46 条）
Unknown (46 条)
- Exploit for CVE-2026-56782 exploit
CVE-2026-56782
Exploit for CVE-2026-56782 exploit - self-signed-cert-poc-python exploit
self-signed-cert-poc-python exploit
…另有 44 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-03 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV