📊 2026-07-07 漏洞情报日报 · 200 条 · 高危 97
每日漏洞情报汇总 · 2026-07-07
📊 2026-07-07 漏洞情报日报
📋 共 200 条
🔥 高危/严重 97 条
💣 Exploit-DB-RSS 7 条
🐙 GitHub-Advisory 50 条 🔥25
🛡️ NVD-Latest 72 条 🔥72
⚔️ Sploitus 71 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-53486 (Critical)：影响 Decompress 库（Tar/Zip 等多种格式）。漏洞存在于解压写入文件逻辑中，构造的恶意压缩包可导致目录穿越，实现越界写入或读取任意文件。
- CVE-2026-54769、CVE-2026-55615、CVE-2026-54760 (Critical)：影响 Langroid 框架。SQLChatAgent 与 Neo4jChatAgent 因正则绕过或无验证执行，导致 SQL/Cypher 注入；TableChatAgent 中 eval() 防护不完整，可造成沙箱逃逸并远程执行代码。
- GHSA-vjc7-jrh9-9j86 & CVE-2026-55500 (Critical)：影响 9Router 路由器 (<=0.4.41)。API 端点无认证即可进行完整数据库增删改查，并可直接导出/导入包含全部API密钥与OAuth令牌的数据库，数据泄露风险极高。
- CVE-2026-54424 (CVSS 8.4, PoC公开)：影响 Unity Parsec (Windows)。存在特权API滥用漏洞，攻击者可利用PoC代码从普通用户提升至SYSTEM权限，属已公开利用的高危提权漏洞。
- CVE-2025-71380 (CVSS 8.8)：影响 n8n 自动化平台。Execute Command 节点允许认证用户执行任意系统命令，若存在弱口令或越权访问，可导致横向移动与主机被控。
📈 威胁趋势
- 远程代码执行 / 注入 (RCE/Injection)：今日数量最多，涵盖Langroid框架多个组件（SQL/Cypher注入、eval逃逸）、n8n命令执行以及Pickle反序列化绕过 (CVE-2025-71375)。AI Agent组件成为攻击者关注重点。
- 权限提升：Parsec Windows 提权漏洞 (CVE-2026-54424) 已有公开PoC；Pardus-Parental-Control (CVE-2026-9085) 因权限分配错误导致DNS劫持，风险高。
- 信息泄露 / 访问控制绕过：9Router 系列漏洞暴露了未授权API密钥与数据库访问；UTT路由器 (CVE-2026-14721) 存在未授权参数修改风险。
- 加密协议安全性：ZKP领域，halo2_gadgets 发现基础点约束缺失漏洞，可能导致零知识证明伪造，影响隐私加密货币等相关应用。
🛡️ 缓解建议
- 立刻更新或下线受影响组件：升级 Decompress 库、Langroid、9Router、Unity Parsec、n8n 及 fickling、picklescan 等安全扫描工具至已修复版本；无法升级则关闭非必要API接口。
- 强化访问控制与网络隔离：对所有管理型API（如9Router的数据库端点）强制执行强认证与IP白名单；n8n 限制Execute Command节点使用权限，并审计已存在的工作流。
- 审查AI Agent安全边界：对于使用Langroid等框架的AI应用，确保对LLM输出进行严格的语句类型检查和参数化查询，切勿直接执行用户或模型返回的原始代码。
- 修补应用逻辑缺陷：修复权限分配错误（Pardus）、路由器固件Web端点认证缺失（UTT HiPER）；在halo2应用升级前，禁用依赖可变基点标量乘法的路径。
💣 Exploit-DB-RSS（7 条）
Unknown (7 条)
- [webapps] WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)
CVE-2026-49069
# Exploit Title: WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS) # Date: June 10, 2026 # Exploit Author: Kent Apostol # Vendor… - [local] Windows Defender (MsMpEng.exe) - Race Condition
# Titles: Windows Defender (MsMpEng.exe) - Race Condition # Author: nu11secur1ty # Date: 2026-06-11 # Vendor: Microsoft Corporation # Software: Windows…
…另有 5 条 Unknown 级漏洞（已省略）
🐙 GitHub-Advisory（50 条）
Critical (7 条)
- CVE-2026-53486 - Decompress: Archive extraction can create files and links outside of the target
CVE-2026-53486Critical
Impact When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the… - CVE-2026-54760 - Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted
CVE-2026-54760Critical
# SQLChatAgent `_validate_query` dangerous-pattern regex is bypassable via quoted/commented/qualified function names ## Summary The `SQLChatAgent`… - CVE-2026-54769 - Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitiga
CVE-2026-54769Critical
Advisory Details **Title**: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent **Description**: Summary Langroid is… - GHSA-vjc7-jrh9-9j86 - 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /ap Critical
--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version: <= 0.4.41 severity: critical… - CVE-2026-55615 - Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (promp
CVE-2026-55615Critical
Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. The query… - CVE-2026-54496 - Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplicat
CVE-2026-54496Critical
Summary A soundness vulnerability in the variable-base scalar multiplication gadget of `halo2_gadgets` allowed a malicious prover to produce a valid proof for… - CVE-2026-55500 - 9routers has Exposure of Sensitive Information and Unprotected Database Import/E
CVE-2026-55500Critical
## Summary The `/api/settings/database` endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full…
High (18 条)
- CVE-2026-54771 - Langroid: handle_message() executes user-supplied tool JSON without sender verif
CVE-2026-54771High
## Summary A Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are… - CVE-2026-54641 - OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
CVE-2026-54641High
Summary A realm admin of tenant B can read the profile, client roles, and realm roles of any user in any other realm (including the master realm) by supplying… - CVE-2026-54640 - OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAss
CVE-2026-54640High
Summary The fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler (`KNXProtocol`) processes user-uploaded ETS… - CVE-2026-55076 - Coder's OIDC email_verified type coercion bypass enables account takeover via un
CVE-2026-55076High
Summary Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the… - CVE-2026-55075 - Coder vulnerable to OIDC account takeover via email-based user matching and emai
CVE-2026-55075High
Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing… - CVE-2026-55077 - Coder: User-admin role can reset owner account password
CVE-2026-55077High
Summary The `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner`… - CVE-2026-55427 - Coder vulnerable to SSH config injection via unsanitized server-supplied values
CVE-2026-55427High
Summary `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing… - CVE-2026-55429 - Coder's workspace app upsert allows cross-workspace agent rebinding via user-con
CVE-2026-55429High
Summary `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp` accepts the app ID from the provisioner's… - CVE-2026-55428 - Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs i
CVE-2026-55428High
Summary The tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The… - CVE-2026-55431 - Coder's session token leaked to arbitrary hosts via `coder open app` for externa
CVE-2026-55431High
Summary `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the `$SESSION_TOKEN`… - CVE-2026-55436 - Coder's AI Bridge Proxy skips TLS certificate verification in default configurat
CVE-2026-55436High
Summary The AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true` and only assigned a secure… - CVE-2026-55426 - Linuxfabrik Monitoring Plugins have local privilege escalation using embedded co
CVE-2026-55426High
Summary When a check plugin places user provided input inside a command which is passed to `shell_exec`, an attacker can abuse this to run arbitrary commands.… - CVE-2026-55790 - Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
CVE-2026-55790High
## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When a Craft admin uses the CraftSupport… - CVE-2026-55794 - Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
CVE-2026-55794High
Requirements: * Control panel access * Permissions to edit an entry Details Control panel users with the ability to edit entries can execute unsandboxed Twig… - CVE-2026-55501 - 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
CVE-2026-55501High
## Summary The 9router dashboard login rate limiter derives the client identity from the attacker-controlled `X-Forwarded-For` HTTP header. When 9router is… - GHSA-cgfv-jrfp-2r7v - OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export High
## Summary The datapoint export API builds a PostgreSQL crosstab export query by concatenating asset display names into raw SQL. An authenticated user who can… - GHSA-qrwj-vh9x-gw5v - Coder's workspace agent API insecure redirect handling allowed cross-agent file High
Summary `agentConn.apiClient()` used the default redirect behavior of `http.Client` while its custom transport dialed the host from the request URL as long as… - CVE-2026-35341 - mkfifo: permissions of an existing file are changed after FIFO creation fails
CVE-2026-35341High
When `mkfifo()` fails (e.g. target already exists), the code shows an error but is missing a `continue;`, so it falls through to `fs::set_permissions` and…
Medium (20 条)
- CVE-2026-35363 - rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents,
CVE-2026-35363Medium
`rm -rf .` is correctly refused, but `clean_trailing_slashes` normalizes `.///` to `./` while `path_is_current_or_parent_directory` only matches `.`/`..` (and… - CVE-2026-35358 - cp: -R reads device nodes as streams, destroying device semantics
CVE-2026-35358Medium
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than… - CVE-2026-35365 - mv: symlinks expanded during cross-device move (resource exhaustion / data dupli
CVE-2026-35365Medium
When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving… - CVE-2026-35366 - printenv: environment variables with invalid UTF-8 are silently skipped (evades
CVE-2026-35366Medium
The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in… - GHSA-x76w-8c62-48mg - Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transf Medium
Summary A user with Control Panel access but without permission to view a target private asset can call `assets/preview-thumb` and receive preview HTML that… - CVE-2026-54637 - Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled
CVE-2026-54637Medium
## Summary The Dragonfly **scheduler**'s v1 gRPC service contains an unauthenticated Server-Side Request Forgery (SSRF). When a peer reports a successful… - CVE-2026-53624 - GoFiber never set HSTS header in helmet middleware due to incorrect protocol che
CVE-2026-53624Medium
Summary The `helmet` middleware in gofiber/fiber never sets the `Strict-Transport-Security` (HSTS) response header, even when `HSTSMaxAge` is explicitly… - CVE-2026-53935 - CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic
CVE-2026-53935Medium
Impact Users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, which enables hijacking traffic to…
…另有 12 条 Medium 级漏洞（已省略）
Low (5 条)
- CVE-2026-35362 - uucore: safe_traversal TOCTOU protection only enabled on Linux
CVE-2026-35362Low
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using… - CVE-2026-53759 - Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases
CVE-2026-53759Low
Summary The SQLite databases are created at predictable (static) paths in `/tmp`. Any user can therefore create a symlink at these paths in /tmp pointing to… - CVE-2026-55630 - Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (Test
CVE-2026-55630Low
## Summary In Kiwi TCMS the fields `TestCase.extra_link` and `TestPlan.extra_link` were meant to represent URLs to external resources however in versions prior…
…另有 2 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（72 条）
High (72 条)
- CVE-2026-9085 Incorrect Permission Assignment for Critical Resource, Improper Access Control v
CVE-2026-9085High 8.8
CVE-2026-9085 CVSS:8.8 Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies… - CVE-2026-14721 A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Th
CVE-2026-14721High 8.8
CVE-2026-14721 CVSS:8.8 A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file… - CVE-2026-14535 In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImports
CVE-2026-14535High 8.8
CVE-2026-14535 CVSS:8.8 In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls… - CVE-2026-14534 Trail of Bits fickling versions up to and including 0.1.10 do not include the Py
CVE-2026-14534High 8.8
CVE-2026-14534 CVSS:8.8 Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site,… - CVE-2025-71380 The Execute Command node in n8n allows authenticated users to execute arbitrary
CVE-2025-71380High 8.8
CVE-2025-71380 CVSS:8.8 The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers… - CVE-2026-54424 An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hos
CVE-2026-54424High 8.4
CVE-2026-54424 CVSS:8.4 An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This…
+PoC-in-GitHu - CVE-2026-14637 A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter
CVE-2026-14637High 8.2
CVE-2026-14637 CVSS:8.2 A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to… - CVE-2025-71375 picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in fun
CVE-2025-71375High 8.1
CVE-2025-71375 CVSS:8.1 picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code.… - CVE-2025-71373 picklescan before 0.0.33 fails to detect operator.methodcaller function calls in
CVE-2025-71373High 8.1
CVE-2025-71373 CVSS:8.1 picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security… - CVE-2025-71372 Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef
CVE-2025-71372High 8.1
CVE-2025-71372 CVSS:8.1 Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary… - CVE-2025-71369 picklescan before 0.0.28 fails to detect malicious pickle files that use torch.u
CVE-2025-71369High 8.1
CVE-2025-71369 CVSS:8.1 picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in… - CVE-2025-71367 picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in
CVE-2025-71367High 8.1
CVE-2025-71367 CVSS:8.1 picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security… - CVE-2025-71366 picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main
CVE-2025-71366High 8.1
CVE-2025-71366 CVSS:8.1 picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files,… - CVE-2025-71364 picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocess
CVE-2025-71364High 8.1
CVE-2025-71364 CVSS:8.1 picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods,… - CVE-2025-71362 picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.
CVE-2025-71362High 8.1
CVE-2025-71362 CVSS:8.1 picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings.… - CVE-2025-71360 picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.ca
CVE-2025-71360High 8.1
CVE-2025-71360 CVSS:8.1 picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers… - CVE-2025-71359 picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize
CVE-2025-71359High 8.1
CVE-2025-71359 CVSS:8.1 picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce… - CVE-2025-71356 picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symboli
CVE-2025-71356High 8.1
CVE-2025-71356 CVSS:8.1 picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function… - CVE-2025-71353 picklescan before 0.0.28 fails to detect malicious pickle files that exploit tor
CVE-2025-71353High 8.1
CVE-2025-71353 CVSS:8.1 picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce… - CVE-2025-71347 picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py
CVE-2025-71347High 8.1
CVE-2025-71347 CVSS:8.1 picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods,… - CVE-2025-71345 picklescan before 0.0.30 fails to detect malicious pickle files that invoke torc
CVE-2025-71345High 8.1
CVE-2025-71345 CVSS:8.1 picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function.… - CVE-2025-71343 picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib
CVE-2025-71343High 8.1
CVE-2025-71343 CVSS:8.1 picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in… - CVE-2025-71342 picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.ru
CVE-2025-71342High 8.1
CVE-2025-71342 CVSS:8.1 picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can… - CVE-2026-12250 Invocation of process using visible sensitive information vulnerability in TUBIT
CVE-2026-12250High 7.9
CVE-2026-12250 CVSS:7.9 Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute… - CVE-2026-6509 Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Rese
CVE-2026-6509High 7.8
CVE-2026-6509 CVSS:7.8 Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege… - CVE-2026-12252 In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (Stanfo
CVE-2026-12252High 7.8
CVE-2026-12252 CVSS:7.8 In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser,… - CVE-2026-14570 Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private
CVE-2026-14570High 7.5
CVE-2026-14570 CVSS:7.5 Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to… - CVE-2026-14778 A security vulnerability has been detected in SourceCodester Onlne Examination &
CVE-2026-14778High 7.3
CVE-2026-14778 CVSS:7.3 A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an… - CVE-2026-14772 A vulnerability has been found in SourceCodester Class and Exam Timetabling Syst
CVE-2026-14772High 7.3
CVE-2026-14772 CVSS:7.3 A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown… - CVE-2026-14771 A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.
CVE-2026-14771High 7.3
CVE-2026-14771 CVSS:7.3 A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the… - CVE-2026-14770 A vulnerability was detected in SourceCodester Class and Exam Timetabling System
CVE-2026-14770High 7.3
CVE-2026-14770 CVSS:7.3 A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file… - CVE-2026-14769 A security vulnerability has been detected in code-projects Real State Services
CVE-2026-14769High 7.3
CVE-2026-14769 CVSS:7.3 A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affects some unknown processing of the… - CVE-2026-14768 A weakness has been identified in code-projects Real State Services 1.0. This vu
CVE-2026-14768High 7.3
CVE-2026-14768 CVSS:7.3 A weakness has been identified in code-projects Real State Services 1.0. This vulnerability affects unknown code of the file… - CVE-2026-14764 A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.
CVE-2026-14764High 7.3
CVE-2026-14764 CVSS:7.3 A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. This impacts an unknown function of the file… - CVE-2026-14763 A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. This a
CVE-2026-14763High 7.3
CVE-2026-14763 CVSS:7.3 A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. This affects an unknown function of the file… - CVE-2026-14762 A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0.
CVE-2026-14762High 7.3
CVE-2026-14762 CVSS:7.3 A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the… - CVE-2026-14756 A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Af
CVE-2026-14756High 7.3
CVE-2026-14756 CVSS:7.3 A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of… - CVE-2026-14755 A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.
CVE-2026-14755High 7.3
CVE-2026-14755 CVSS:7.3 A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown… - CVE-2026-14754 A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affect
CVE-2026-14754High 7.3
CVE-2026-14754 CVSS:7.3 A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affected is an unknown function of the file… - CVE-2026-14753 A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8e
CVE-2026-14753High 7.3
CVE-2026-14753 CVSS:7.3 A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of… - CVE-2026-14750 A security flaw has been discovered in mjperpinosa stumasy up to 327d1b0f2915ba7
CVE-2026-14750High 7.3
CVE-2026-14750 CVSS:7.3 A security flaw has been discovered in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The affected element is the… - CVE-2026-14749 A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef
CVE-2026-14749High 7.3
CVE-2026-14749 CVSS:7.3 A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of… - CVE-2026-14747 A vulnerability was detected in code-projects Real State Services 1.0. Affected
CVE-2026-14747High 7.3
CVE-2026-14747 CVSS:7.3 A vulnerability was detected in code-projects Real State Services 1.0. Affected by this vulnerability is an unknown functionality of… - CVE-2026-14746 A security vulnerability has been detected in code-projects Real State Services
CVE-2026-14746High 7.3
CVE-2026-14746 CVSS:7.3 A security vulnerability has been detected in code-projects Real State Services 1.0. Affected is an unknown function of the file… - CVE-2026-14745 A weakness has been identified in code-projects Real State Services 1.0. This im
CVE-2026-14745High 7.3
CVE-2026-14745 CVSS:7.3 A weakness has been identified in code-projects Real State Services 1.0. This impacts an unknown function of the file… - CVE-2026-14744 A security flaw has been discovered in code-projects Real State Services 1.0. Th
CVE-2026-14744High 7.3
CVE-2026-14744 CVSS:7.3 A security flaw has been discovered in code-projects Real State Services 1.0. This affects an unknown function of the file… - CVE-2026-14743 A vulnerability was identified in code-projects Real State Services 1.0. The imp
CVE-2026-14743High 7.3
CVE-2026-14743 CVSS:7.3 A vulnerability was identified in code-projects Real State Services 1.0. The impacted element is an unknown function of the file… - CVE-2026-14737 A vulnerability was identified in Hanwang e-Face General Management Platform 6.3
CVE-2026-14737High 7.3
CVE-2026-14737 CVSS:7.3 A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file… - CVE-2026-14736 A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted ele
CVE-2026-14736High 7.3
CVE-2026-14736 CVSS:7.3 A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file… - CVE-2026-14735 A vulnerability has been found in code-projects Smart Parking System 1.0. The af
CVE-2026-14735High 7.3
CVE-2026-14735 CVSS:7.3 A vulnerability has been found in code-projects Smart Parking System 1.0. The affected element is an unknown function of the file… - CVE-2026-14734 A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. I
CVE-2026-14734High 7.3
CVE-2026-14734 CVSS:7.3 A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file… - CVE-2026-14733 A vulnerability was detected in SourceCodester Class and Exam Timetabling System
CVE-2026-14733High 7.3
CVE-2026-14733 CVSS:7.3 A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the… - CVE-2026-14732 A security vulnerability has been detected in SourceCodester Class and Exam Time
CVE-2026-14732High 7.3
CVE-2026-14732 CVSS:7.3 A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown… - CVE-2026-14722 A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impa
CVE-2026-14722High 7.3
CVE-2026-14722 CVSS:7.3 A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file… - CVE-2026-14719 A flaw has been found in SourceCodester Onlne Examination & Learning Management
CVE-2026-14719High 7.3
CVE-2026-14719 CVSS:7.3 A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function… - CVE-2026-14713 A security flaw has been discovered in SourceCodester Pizzafy E-Commerce System
CVE-2026-14713High 7.3
CVE-2026-14713 CVSS:7.3 A security flaw has been discovered in SourceCodester Pizzafy E-Commerce System 1.0. This vulnerability affects unknown code of the… - CVE-2026-14705 A vulnerability was determined in code-projects Online Examination 1.0. Affected
CVE-2026-14705High 7.3
CVE-2026-14705 CVSS:7.3 A vulnerability was determined in code-projects Online Examination 1.0. Affected by this issue is some unknown functionality of the… - CVE-2026-14700 A security vulnerability has been detected in code-projects Internship Managemen
CVE-2026-14700High 7.3
CVE-2026-14700 CVSS:7.3 A security vulnerability has been detected in code-projects Internship Management System 1.0. The impacted element is an unknown… - CVE-2026-14695 A vulnerability was found in SourceCodester Multi-Vendor Online Grocery Manageme
CVE-2026-14695High 7.3
CVE-2026-14695 CVSS:7.3 A vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_client of… - CVE-2026-14690 A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Man
CVE-2026-14690High 7.3
CVE-2026-14690 CVSS:7.3 A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function… - CVE-2026-14688 A vulnerability was identified in itsourcecode Online Hotel Management System 1.
CVE-2026-14688High 7.3
CVE-2026-14688 CVSS:7.3 A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. The affected element is an unknown function of the… - CVE-2026-14660 A vulnerability was found in code-projects Online Job Portal 1.0. The affected e
CVE-2026-14660High 7.3
CVE-2026-14660 CVSS:7.3 A vulnerability was found in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file login.php.… - CVE-2026-14654 A vulnerability was identified in SourceCodester Simple and Nice Shopping Cart S
CVE-2026-14654High 7.3
CVE-2026-14654 CVSS:7.3 A vulnerability was identified in SourceCodester Simple and Nice Shopping Cart Script 1.0. Affected is an unknown function of the file… - CVE-2026-14653 A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart S
CVE-2026-14653High 7.3
CVE-2026-14653 CVSS:7.3 A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file… - CVE-2026-14652 A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script
CVE-2026-14652High 7.3
CVE-2026-14652 CVSS:7.3 A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown function of the file… - CVE-2026-14649 A vulnerability was detected in code-projects Online Voting System 1.0. Impacted
CVE-2026-14649High 7.3
CVE-2026-14649 CVSS:7.3 A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is the function test_input of the file /saveVote.php.… - CVE-2026-14648 A security vulnerability has been detected in code-projects Online Voting System
CVE-2026-14648High 7.3
CVE-2026-14648 CVSS:7.3 A security vulnerability has been detected in code-projects Online Voting System up to 0.x/1.0. This issue affects the function… - CVE-2026-14642 A vulnerability was identified in SourceCodester Class and Exam Timetabling Syst
CVE-2026-14642High 7.3
CVE-2026-14642 CVSS:7.3 A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown… - CVE-2026-14641 A vulnerability was determined in SourceCodester Class and Exam Timetabling Syst
CVE-2026-14641High 7.3
CVE-2026-14641 CVSS:7.3 A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown… - CVE-2026-14640 A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0.
CVE-2026-14640High 7.3
CVE-2026-14640 CVSS:7.3 A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php… - CVE-2026-14635 A security flaw has been discovered in kirilkirkov Ecommerce-CodeIgniter-Bootstr
CVE-2026-14635High 7.3
CVE-2026-14635 CVSS:7.3 A security flaw has been discovered in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 222ff31c06687b1c6d0e1ab63953f82c3674c52b. This… - CVE-2026-14622 A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 5214
CVE-2026-14622High 7.3
CVE-2026-14622 CVSS:7.3 A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This…
⚔️ Sploitus（71 条）
Unknown (71 条)
- ai-soc-simulator exploit
ai-soc-simulator exploit - Exploit for Deserialization of Untrusted Data in Facebook React exploit
Exploit for Deserialization of Untrusted Data in Facebook React exploit
…另有 69 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-07 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV