📊 2026-07-04 漏洞情报日报 · 200 条 · 高危 121
每日漏洞情报汇总 · 2026-07-04
📊 2026-07-04 漏洞情报日报
📋 共 200 条
🔥 高危/严重 121 条
🐙 GitHub-Advisory 50 条 🔥29
🛡️ NVD-Latest 92 条 🔥92
⚔️ Sploitus 58 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-9558 (Mautic，CVSS 9.9)： 服务端模板注入(SSTI)漏洞，位于主题引擎中。拥有上传权限的认证用户可通过上传恶意Twig模板实现远程代码执行，直接威胁CMS平台安全。
- CVE-2026-9559 (Mautic，CVSS 9.9)： 路径遍历漏洞，位于活动导入功能中。攻击者通过构造恶意ZIP文件，可在解压过程中实现目录穿越，导致任意文件写入或代码执行。
- CVE-2026-11387 (WordPress SMS Alert插件，CVSS 9.8)： 账户接管漏洞，影响所有版本至3.9.5。未经身份验证的攻击者可利用此漏洞提升权限并接管管理员账户，已出现公开PoC，需紧急处置。
- CVE-2026-49352 & GHSA-g6g7-pvmx-m74p (9router npm包)： 组合高危。前者因硬编码JWT密钥导致认证绕过；后者存在未经授权的RCE（通过向Tailscale安装接口注入命令）。攻击者可直接获取服务器控制权。
📈 威胁趋势
- 远程代码执行 (RCE) 与命令注入： 本日最突出威胁类别。覆盖Mautic (SSTI)、9router (命令注入)、Five Star Business Profile插件（编辑器原语），以及 WordPress BusinessDirectory 的任意文件删除漏洞。攻击者可通过网络请求或上传恶意文件直接执行任意系统命令。
- 权限提升与认证绕过： 威胁数量多且严重。WordPress SMS Alert插件出现账户接管漏洞，可导致前台用户提权至管理员。9router因硬编码JWT密钥可导致身份验证完全失效。UltraVNC repeater存在硬编码默认密码漏洞。
- 信息泄露与路径遍历： 多个漏洞涉及任意文件读取。LaunchServer文件服务器存在未授权路径遍历，可读取任意系统文件；fast-mcp-telegram 通过路径遍历绕过令牌验证。Mautic及fastify/middie的解码不一致也导致路径遍历风险。
- 拒绝服务与会话劫持： 虽然本日此类漏洞较少，但 UltraVNC repeater 的全局缓冲区溢出漏洞 (CVE-2026-7840) 可能导致服务崩溃或代码执行，Grackle的授权失效可能造成敏感数据泄露。
🛡️ 缓解建议
- 立即修补Mautic (CVE-2026-9558 & CVE-2026-9559)： 请优先升级Mautic至最新版本。在补丁未发布前，建议立即禁用“主题模板上传”及“ZIP活动导入”功能，并严格审查具有管理员权限的用户。
- 限制WordPress插件漏洞 (CVE-2026-11387 & CVE-2026-6070)： 立即将“SMS Alert – SMS & OTP for WooCommerce”升级至3.9.5以上版本，并检查所有用户账户是否存在异常。同时将“WP-BusinessDirectory”升级至4.0.1以上，以防任意文件删除。
- 修复或隔离9router及快速应用框架： 立即设置环境变量
JWT_SECRET替换硬编码默认密钥，并检查/api/tunnel/tailscale-install接口是否能被外部访问。对于@fastify/middie (CVE-2026-14198)，请升级到9.3.2以上版本。 - 检查UltraVNC及基础设施配置： 针对UltraVNC repeater，务必删除旧的配置文件和默认密码，并启用强密码策略。同时，检查所有对外暴露的Zcash网络节点 (zebrad)，确认已升级至v4.4.1以上版本。
🐙 GitHub-Advisory（50 条）
Critical (7 条)
- CVE-2026-52735 - zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled
CVE-2026-52735Critical
Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node validates blocks on mainnet, testnet, or any… - CVE-2026-9558 - Mautic has Server-Side Template Injection (SSTI) in Theme Templates
CVE-2026-9558Critical
Summary A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox…
+NVD-Latest - CVE-2026-9559 - Mautic vulnerable to Path Traversal via Campaign Import
CVE-2026-9559Critical
Summary A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in…
+NVD-Latest - GHSA-g6g7-pvmx-m74p - 9router: Missing Authorization and OS Command Injection Critical
# Unauthenticated RCE via `/api/tunnel/tailscale-install` **Affected:** `9router` (npm package) — current master (`v0.4.39`). Summary `POST… - CVE-2026-52830 - fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram sessio
CVE-2026-52830Critical
## Summary fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved… - CVE-2026-54617 - LaunchServer FileServerHandler has an unauthenticated path traversal issue
CVE-2026-54617Critical
Summary An unauthenticated path traversal in the LaunchServer HTTP file server (`FileServerHandler`) lets any remote actor read **any file** readable by the… - CVE-2026-49352 - 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
CVE-2026-49352Critical
Summary 9router uses a publicly known hardcoded string `"9router-default-secret-change-me"` as the fallback of JWT secret for all Dashboard session JWTs when…
High (22 条)
- GHSA-f9ff-5x35-7gfw - Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perfor High
## Summary Authorization for scoped (agent) MCP callers is enforced **inline, per tool**, and is applied inconsistently — several mutating tools silently omit… - CVE-2026-52736 - Zebra has block suppression via NU5 same-header body poisoning of sent-hash cach
CVE-2026-52736High
## Description Am I affected You are affected if: 1. You run any version of `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections… - CVE-2026-9808 - Mautic has an Authorization Bypass in API v2 Endpoints
CVE-2026-9808High
Summary An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with…
+NVD-Latest - CVE-2026-9809 - Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
CVE-2026-9809High
Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on…
+NVD-Latest - CVE-2026-50281 - Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwr
CVE-2026-50281High
## Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an… - CVE-2026-50282 - Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forc
CVE-2026-50282High
We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete… - CVE-2026-52746 - jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-52746High
Impact In JSONata `<v2.2.0`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function… - GHSA-322x-v876-g883 - @asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows ar High
## Summary The `matchFileSnapshot` function in `src/assertions/snapshots.ts` accepted a `filePath` parameter with zero validation. When snapshot update mode… - CVE-2026-52817 - Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalati
CVE-2026-52817High
Summary In the [Debian.sudoers](https://github.com/Linuxfabrik/monitoring-plugins/blob/main/assets/sudoers/Debian.sudoers) file, `apt-get` is allowed for the… - CVE-2026-49283 - SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authenticat
CVE-2026-49283High
## Summary SimpleSAMLphp's HTTP-Artifact receive path can treat an unsigned embedded SAML `Response` as cryptographically valid for the wrong IdP. In the… - CVE-2026-52829 - Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update
CVE-2026-52829High
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node listens on the default `[::]` address on a Linux host (the… - CVE-2026-49289 - SimpleSAMLphp has Possible DoS via XPath Transform
CVE-2026-49289High
## Summary This library turned out to be vulnerable to Denial-of-Service attacks using XPath transforms. A mitigation has been put in place to restrict the… - CVE-2026-50194 - Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
CVE-2026-50194High
Summary When Steeltoe management endpoints are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware… - CVE-2026-50196 - Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire regis
CVE-2026-50196High
Summary `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification… - CVE-2026-50200 - Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
CVE-2026-50200High
Summary The `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The… - CVE-2026-2092 - Keycloak: Unauthorized access via improper validation of encrypted SAML assertio
CVE-2026-2092High
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed… - CVE-2026-52834 - jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
CVE-2026-52834High
Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test… - CVE-2026-52792 - Algernon vulnerable to server-side script source disclosure on Windows via NTFS
CVE-2026-52792High
Summary Algernon selects its file handler from `filepath.Ext()` (engine/handlers.go:134), which does not treat the NTFS-equivalent names `x.lua::$DATA`,… - CVE-2026-49284 - SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Respon
CVE-2026-49284High
## Summary SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login. If a saved SP state contains `ExpectedIssuer = IdP A`,… - CVE-2026-46599 - golang.org/x/image/tiff has excessive resource consumption in PackBits decompres
CVE-2026-46599High
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in… - CVE-2026-49353 - 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host
CVE-2026-49353High
## Summary The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only access gate in `src/dashboardGuard.js`… - CVE-2026-49360 - Recce server has unauthenticated SQL execution that allows local file read/write
CVE-2026-49360High
Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution…
Medium (16 条)
- GHSA-c8w6-x74f-vmg3 - zebrad vulnerable to full node denial of service via crafted Sapling receiver in Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your `zebrad.toml` sets `rpc.listen_addr` to a TCP address (RPC server… - CVE-2026-52732 - zebrad has mempool transaction admission denial via single-peer inbound queue sa
CVE-2026-52732Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections (`network.listen_addr` is… - CVE-2026-52737 - Zebra has sync restart poisoning from single unauthenticated peer via above-look
CVE-2026-52737Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections and is syncing or catching up… - CVE-2026-52738 - Zebra: Finalized address balance credit-first overflow on consensus-valid blocks
CVE-2026-52738Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks on any Zcash network. Summary The finalized… - CVE-2026-52739 - Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate
CVE-2026-52739Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node processes blocks past the checkpoint height (non-finalized… - CVE-2026-9557 - Mautic Focus component Vulnerable to SSRF
CVE-2026-9557Medium
Summary A Server-Side Request Forgery (SSRF) vulnerability exists in the Mautic Focus component (`MauticFocusBundle`). Under certain conditions, insufficiency… - CVE-2026-9811 - Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
CVE-2026-9811Medium
Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating… - CVE-2026-52733 - zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after
CVE-2026-52733Medium
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node participates in a network where chain forks occur (mainnet,…
…另有 8 条 Medium 级漏洞（已省略）
Low (5 条)
- GHSA-443g-gwgp-49x4 - zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped Low
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections. Summary The `read_getblocks`… - GHSA-h72h-ppcx-998p - Zebra has pre-handshake buffer capacity reservation based on attacker-claimed bo Low
Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections (`network.listen_addr` is… - CVE-2026-50268 - Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
CVE-2026-50268Low
Summary Configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the `OAEP` setting…
…另有 2 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（92 条）
Critical (8 条)
- CVE-2026-27419 Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.
CVE-2026-27419Critical 9.9
CVE-2026-27419 CVSS:9.9 Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. 产品: - CVE-2026-11387 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart
CVE-2026-11387Critical 9.8
CVE-2026-11387 CVSS:9.8 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to…
+PoC-in-GitHu - CVE-2026-7840 UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embed
CVE-2026-7840Critical 9.8
CVE-2026-7840 CVSS:9.8 UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions… - CVE-2026-27436 Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.
CVE-2026-27436Critical 9.1
CVE-2026-27436 CVSS:9.1 Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions. 产品: - CVE-2026-14198 @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside
CVE-2026-14198Critical 9.1
CVE-2026-14198 CVSS:9.1 @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware… - CVE-2026-7839 UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server wit
CVE-2026-7839Critical 9.1
CVE-2026-7839 CVSS:9.1 UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In… - CVE-2026-6070 The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated A
CVE-2026-6070Critical 9.1
CVE-2026-6070 CVSS:9.1 The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including… - CVE-2026-10539 A Control-M/Server communication command does not sufficiently filter or sanitiz
CVE-2026-10539Critical 9.0
CVE-2026-10539 CVSS:9.0 A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this…
High (84 条)
- CVE-2026-56037 Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows
CVE-2026-56037High 8.8
CVE-2026-56037 CVSS:8.8 Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup:… - CVE-2026-27414 Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.
CVE-2026-27414High 8.8
CVE-2026-27414 CVSS:8.8 Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. 产品: - CVE-2026-27060 Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.
CVE-2026-27060High 8.8
CVE-2026-27060 CVSS:8.8 Contributor PHP Object Injection in ARMember Premium <= 7.0 versions. 产品: - CVE-2026-13125 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-13125High 8.8
CVE-2026-13125 CVSS:8.8 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-13228 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for W
CVE-2026-13228High 8.8
CVE-2026-13228 CVSS:8.8 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to… - CVE-2026-12224 The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via upd
CVE-2026-12224High 8.8
CVE-2026-12224 CVSS:8.8 The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to,… - CVE-2026-12158 The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is v
CVE-2026-12158High 8.8
CVE-2026-12158 CVSS:8.8 The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions… - CVE-2026-7838 UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap b
CVE-2026-7838High 8.8
CVE-2026-7838 CVSS:8.8 UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap buffer overflow in the RFB protocol failure-response… - CVE-2025-69094 Subscriber SQL Injection in Unicamp <= 2.2.2 versions.
CVE-2025-69094High 8.5
CVE-2025-69094 CVSS:8.5 Subscriber SQL Injection in Unicamp <= 2.2.2 versions. 产品: - CVE-2026-57278 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57278High 8.3
CVE-2026-57278 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57277 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57277High 8.3
CVE-2026-57277 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57276 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57276High 8.3
CVE-2026-57276 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57275 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57275High 8.3
CVE-2026-57275 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57274 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57274High 8.3
CVE-2026-57274 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57273 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57273High 8.3
CVE-2026-57273 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57272 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57272High 8.3
CVE-2026-57272 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57271 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57271High 8.3
CVE-2026-57271 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57270 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57270High 8.3
CVE-2026-57270 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57269 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57269High 8.3
CVE-2026-57269 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57268 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57268High 8.3
CVE-2026-57268 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57267 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57267High 8.3
CVE-2026-57267 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57266 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57266High 8.3
CVE-2026-57266 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57265 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57265High 8.3
CVE-2026-57265 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-57264 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-57264High 8.3
CVE-2026-57264 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-13132 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-13132High 8.3
CVE-2026-13132 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-13131 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe
CVE-2026-13131High 8.3
CVE-2026-13131 CVSS:8.3 GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed… - CVE-2026-14336 PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (
CVE-2026-14336High 8.2
CVE-2026-14336 CVSS:8.2 PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in… - CVE-2026-42382 Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.
CVE-2026-42382High 8.1
CVE-2026-42382 CVSS:8.1 Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. 产品: - CVE-2026-27412 Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 ver
CVE-2026-27412High 8.1
CVE-2026-27412 CVSS:8.1 Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. 产品: - CVE-2025-58902 Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
CVE-2025-58902High 8.1
CVE-2025-58902 CVSS:8.1 Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. 产品: - CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, th
CVE-2026-8147High 8.1
CVE-2026-8147 CVSS:8.1 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization… - CVE-2026-5821 The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletio
CVE-2026-5821High 8.1
CVE-2026-5821 CVSS:8.1 The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to… - CVE-2026-11794 The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin befo
CVE-2026-11794High 8.1
CVE-2026-11794 CVSS:8.1 The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned… - CVE-2026-10750 The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks
CVE-2026-10750High 8.1
CVE-2026-10750 CVSS:8.1 The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token… - CVE-2026-10538 Messaging consumer functionality allows deserialization of user-controlled data
CVE-2026-10538High 8.0
CVE-2026-10538 CVSS:8.0 Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types… - CVE-2026-7831 UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in
CVE-2026-7831High 7.6
CVE-2026-7831 CVSS:7.6 UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. In… - CVE-2026-39448 Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 ve
CVE-2026-39448High 7.5
CVE-2026-39448 CVSS:7.5 Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions. 产品: - CVE-2026-11946 An unauthenticated remote attacker can exhaust server memory via the GetEndpoint
CVE-2026-11946High 7.5
CVE-2026-11946 CVSS:7.5 An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field… - CVE-2025-69134 Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Hel
CVE-2025-69134High 7.5
CVE-2025-69134 CVSS:7.5 Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. 产品: - CVE-2025-69133 Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
CVE-2025-69133High 7.5
CVE-2025-69133 CVSS:7.5 Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. 产品: - CVE-2026-8441 The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via
CVE-2026-8441High 7.5
CVE-2026-8441 CVSS:7.5 The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs… - CVE-2026-13369 The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary F
CVE-2026-13369High 7.5
CVE-2026-13369 CVSS:7.5 The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up… - CVE-2026-13251 The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all
CVE-2026-13251High 7.5
CVE-2026-13251 CVSS:7.5 The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's'… - CVE-2026-9563 In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the J
CVE-2026-9563High 7.5
CVE-2026-9563 CVSS:7.5 In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the… - CVE-2026-33592 An unauthenticated remote attacker can exhaust server memory via the FindServers
CVE-2026-33592High 7.5
CVE-2026-33592 CVSS:7.5 An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field… - CVE-2026-14249 The Request a Quote plugin for WordPress is vulnerable to Code Injection in vers
CVE-2026-14249High 7.5
CVE-2026-14249 CVSS:7.5 The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the… - CVE-2026-14181 @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization
CVE-2026-14181High 7.5
CVE-2026-14181 CVSS:7.5 @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming… - CVE-2026-12576 DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a
CVE-2026-12576High 7.5
CVE-2026-12576 CVSS:7.5 DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability. 产品: - CVE-2026-12575 DVP80ES3 with Improper Resource Shutdown or Release vulnerability.
CVE-2026-12575High 7.5
CVE-2026-12575 CVSS:7.5 DVP80ES3 with Improper Resource Shutdown or Release vulnerability. 产品: - CVE-2026-1239 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr
CVE-2026-1239High 7.5
CVE-2026-1239 CVSS:7.5 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to… - CVE-2026-14193 DVP80ES300T with Improper Validation of Array Index Vulnerability
CVE-2026-14193High 7.5
CVE-2026-14193 CVSS:7.5 DVP80ES300T with Improper Validation of Array Index Vulnerability 产品: - CVE-2026-11823 The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to S
CVE-2026-11823High 7.5
CVE-2026-11823 CVSS:7.5 The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of… - CVE-2026-11568 The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not
CVE-2026-11568High 7.5
CVE-2026-11568 CVSS:7.5 The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before… - CVE-2026-13468 The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for W
CVE-2026-13468High 7.5
CVE-2026-13468 CVSS:7.5 The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all… - CVE-2026-12923 The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Ca
CVE-2026-12923High 7.5
CVE-2026-12923 CVSS:7.5 The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due… - CVE-2026-20458 In Modem, there is a possible memory corruption due to a missing bounds check. T
CVE-2026-20458High 7.5
CVE-2026-20458 CVSS:7.5 In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a… - CVE-2026-12579 AS228T with Authentication Bypass Vulnerability
CVE-2026-12579High 7.4
CVE-2026-12579 CVSS:7.4 AS228T with Authentication Bypass Vulnerability 产品: - CVE-2026-7830 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authent
CVE-2026-7830High 7.4
CVE-2026-7830 CVSS:7.4 UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogonIIAuth). In… - CVE-2026-57348 Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions
CVE-2026-57348High 7.2
CVE-2026-57348 CVSS:7.2 Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions. 产品: - CVE-2026-9834 The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plug
CVE-2026-9834High 7.2
CVE-2026-9834 CVSS:7.2 The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection… - CVE-2026-12142 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln
CVE-2026-12142High 7.2
CVE-2026-12142 CVSS:7.2 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]'… - CVE-2026-50043 Improper neutralization of special elements used in an OS command ('OS Command I
CVE-2026-50043High 7.2
CVE-2026-50043 CVSS:7.2 Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-A100/MB-A110.… - CVE-2026-11883 The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not corr
CVE-2026-11883High 7.2
CVE-2026-11883 CVSS:7.2 The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication… - CVE-2026-7829 UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds w
CVE-2026-7829High 7.2
CVE-2026-7829 CVSS:7.2 UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In… - CVE-2026-7517 The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable t
CVE-2026-7517High 7.2
CVE-2026-7517 CVSS:7.2 The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… - CVE-2026-13731 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for
CVE-2026-13731High 7.2
CVE-2026-13731 CVSS:7.2 The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting… - CVE-2026-57356 Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19
CVE-2026-57356High 7.1
CVE-2026-57356 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions. 产品: - CVE-2026-57351 Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 version
CVE-2026-57351High 7.1
CVE-2026-57351 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions. 产品: - CVE-2026-57350 Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.
CVE-2026-57350High 7.1
CVE-2026-57350 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions. 产品: - CVE-2026-57349 Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.
CVE-2026-57349High 7.1
CVE-2026-57349 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions. 产品: - CVE-2026-57345 Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 ve
CVE-2026-57345High 7.1
CVE-2026-57345 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions. 产品: - CVE-2026-57344 Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versio
CVE-2026-57344High 7.1
CVE-2026-57344 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. 产品: - CVE-2026-57343 Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.
CVE-2026-57343High 7.1
CVE-2026-57343 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. 产品: - CVE-2026-27430 Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.
CVE-2026-27430High 7.1
CVE-2026-27430 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. 产品: - CVE-2026-27426 Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business
CVE-2026-27426High 7.1
CVE-2026-27426 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions. 产品: - CVE-2026-27425 Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versio
CVE-2026-27425High 7.1
CVE-2026-27425 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions. 产品: - CVE-2026-27408 Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.
CVE-2026-27408High 7.1
CVE-2026-27408 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions. 产品: - CVE-2026-27404 Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.
CVE-2026-27404High 7.1
CVE-2026-27404 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. 产品: - CVE-2026-27402 Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPr
CVE-2026-27402High 7.1
CVE-2026-27402 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions. 产品: - CVE-2025-69156 Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress The
CVE-2025-69156High 7.1
CVE-2025-69156 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions. 产品: - CVE-2025-69155 Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.
CVE-2025-69155High 7.1
CVE-2025-69155 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions. 产品: - CVE-2025-69154 Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Th
CVE-2025-69154High 7.1
CVE-2025-69154 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions. 产品: - CVE-2025-69153 Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.
CVE-2025-69153High 7.1
CVE-2025-69153 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions. 产品: - CVE-2025-69152 Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordP
CVE-2025-69152High 7.1
CVE-2025-69152 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions. 产品:
⚔️ Sploitus（58 条）
Unknown (58 条)
- Exploit for Insecure Default Initialization of Resource in Apache Solr exploit
Exploit for Insecure Default Initialization of Resource in Apache Solr exploit - VulnClaw exploit
VulnClaw exploit
…另有 56 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-04 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV