🤖 今日安全态势分析

🎯 今日重点关注

• Discuz! X5.0 - 认证绕过 (CVE-2026-49952, CVSS 9.1)：影响广泛使用的开源论坛系统，攻击者无需凭证即可绕过身份验证，直接接管管理员权限或访问敏感数据。利用公开可用，风险极高。
• Nuclio & Coolify - 多组件RCE链：Nuclio 的 cron 触发器注入 (CVE-2026-52831) 与 Coolify 的终端 WebSocket 授权缺失 (CVE-2026-34047/8, CVSS 9.9) 构成重大威胁。攻击者可利用未授权访问，在云原生环境或服务器管理面板中执行任意命令。
• Esri Portal for ArcGIS - 未认证API访问 (CVE-2026-13019, CVSS 9.8)：影响GIS关键基础设施。远程、未认证攻击者可访问核心API，可能导致数据泄露、服务中断或权限提升。
• Dell PowerProtect Data Domain - 多重高危漏洞 (CVE-2026-53481/3, CVSS 9.8)：影响企业级备份存储设备。多个不当权限控制漏洞可使攻击者远程获得完全控制权，直接威胁备份数据的完整性与可用性。
• Joro - 未认证插件上传致RCE (CVE-2026-53649, CVSS 9.6)：代理模式下的 Joro 可被绕过认证的跨源攻击，上传恶意插件导致远程代码执行。利用条件低，攻击面广。

📈 威胁趋势

• 远程代码执行 (RCE) 与未授权访问：今日漏洞主力。多个CVE（如 Coolify、Joro、EGroupware Goploy）因认证缺失或权限校验不严直接导致RCE。攻击者正从单纯利用内存破坏转向逻辑漏洞链。
• 身份验证与授权缺陷：认证绕过（Discuz!）、未授权API访问（Esri）、IDOR（Goploy）及OAuth刷新令牌重放（Better Auth）频发。身份认证体系的薄弱环节仍是主要突破口。
• 软件供应链与配置风险：Nuclio 的 cron注入、Skipper 的OPA策略绕过、Perl 模块加载漏洞（CVE-2011-10043）提醒我们，开源组件的配置缺陷和旧版依赖依然是企业安全的黑洞。
• 注入攻击多样化：除传统SQL注入（Nessus）外，出现了利用命名空间属性注入（lxml_html_clean）及反序列化注入（Airflow）的新型攻击向量，攻击面持续扩大。

🛡️ 缓解建议

• 紧急修补：立即对 Discuz! X5.0、Coolify (≥4.0.0-beta.471)、Nuclio、Dell Data Domain 及 Esri Portal 进行版本升级或应用厂商补丁，阻断最高危入口。
• 强化访问控制：对所有面向公网或关键内部网络的管理系统（如 Coolify、Joro）启用多因素认证（MFA），并严格审查API接口及WebSocket的路由认证与授权逻辑。
• 隔离与监控：检查并隔离运行中的 Joro、EGroupware 及 Docker/K8s 环境。部署 Web应用防火墙（WAF）并开启针对 OPA 策略绕过、反序列化和SSRF的专项检测规则。
• 代码与依赖审计：针对 Perl 运行时及 Python 的 lxml 库进行版本排查。对所有使用 OIDC/OAuth2 的认证库更新至最新版，并验证自定义插件或 cron 任务是否接受不受信任的输入。

💣 Exploit-DB-RSS（12 条）

Critical (1 条)

• [webapps] Discuz! X5.0 - Authentication Bypass CVE-2026-49952Critical 9.1
  # Exploit Title: Discuz! X5.0 - Authentication Bypass # CVE: CVE-2026-49952 # Date: 2026-06-26 # Exploit Author: …

High (1 条)

• [remote] Hydra - Stack Buffer Overflow CVE-2026-56766High 7.5
  # Exploit Title: Hydra - Stack Buffer Overflow # CVE: CVE-2026-56766 # Date: 2026-06-26 # Exploit Author: Mohammed…

Medium (1 条)

• [webapps] Tenable Nessus 10.12.1 - SQL Injection CVE-2026-57588cve-2026-57588Medium 4.3
  # Exploit Title: Tenable Nessus 10.12.1 - SQL Injection # CVE: CVE-2026-57588 # Date: 2026-06-26 # Exploit Author: …

Low (1 条)

• [webapps] Flowise 3.1.3 - arbitrary code execution CVE-2026-58057Low 2.3
  # Exploit Title: Flowise 3.1.3 - arbitrary code execution # CVE: CVE-2026-58057 # Date: 2026-06-29 # Exploit Author: …

Unknown (8 条)

• [webapps] Joomla Page Builder CK 3.5.10 - Arbitrary File Upload CVE-2026-56290
  # Exploit Title: Joomla Page Builder CK 3.5.10 - Arbitrary File Upload # Google Dork: inurl:com_pagebuilderck OR…
• [webapps] Langflow 1.9.0 - RCE CVE-2026-33017
  # Exploit Title: Langflow 1.9.0 - RCE # Exploit Author: Diamorphine # Vendor Homepage: https://www.langflow.org/ # Software Link:…

…另有 6 条 Unknown 级漏洞（已省略）

🐙 GitHub-Advisory（58 条）

Critical (6 条)

• CVE-2026-52831 - Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell CVE-2026-52831Critical 3.1
  ## Summary Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a Kubernetes CronJob container (`/bin/sh`,…
• CVE-2026-53649 - Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE CVE-2026-53649Critical
  # Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)…
• CVE-2026-27823 - EGroupware has a Remote Code Execution Vulnerability CVE-2026-27823Critical
  ## Summary A critical vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker…
• CVE-2026-53512 - Better Auth: OAuth refresh-token replay via missing client authentication on oid CVE-2026-53512Critical
  Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` and has enabled at least one of: `oidcProvider()`…
• CVE-2026-53513 - @better-auth/sso provider registration has server-side request forgery via unval CVE-2026-53513Critical
  Am I affected? Users are affected if all of the following are true: - Their application uses `@better-auth/sso` at a version `>= 0.1.0, < 1.6.11` on the stable…
• CVE-2026-53552 - Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and pro CVE-2026-53552Critical
  Summary `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/handler.go` accept a project or project-file…

High (21 条)

• CVE-2026-49825 - `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL CVE-2026-49825High
  # `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`) **Reporter:** Guillem Lefait <guillem@datamq.com> ·…
• CVE-2026-50197 - Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Enco CVE-2026-50197High
  Summary `zalando/skipper`'s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 `Transfer-Encoding: chunked` and HTTP/2 requests…
• CVE-2026-49832 - DSpace has possible Remote Code Execution (RCE) through Velocity Templates used CVE-2026-49832High
  ## Overview Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for [COAR Notify/LDN…
• CVE-2026-49464 - NL Portal: IDOR allows any authenticated user to complete and tamper with anothe CVE-2026-49464High
  ## Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper with another user's open task by submitting…
• CVE-2026-49471 - Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → me CVE-2026-49471High
  Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 24282, hardcoded as `0x5EDA` in `constants.py`).…
• CVE-2026-33655 - New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVE-2026-33655High
  ## Summary The default SSRF protection configuration did not apply IP filtering to hostnames. With `ApplyIPFilterForDomain` disabled by default, URL validation…
• CVE-2026-34151 - XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in J CVE-2026-34151High
  Impact With Jetty 12+ a user can craft a URL to access any resource the Jetty instance is allowed to access. For example…
• CVE-2026-40187 - EGroupware has Authenticated RCE via Malicious eTemplate Upload CVE-2026-40187High
  ## Summary An authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS…
• CVE-2025-46719 - Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownToke CVE-2025-46719High
  Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The…
• CVE-2026-26192 - Open WebUI vulnerable to Stored XSS via iFrame in citations model CVE-2026-26192High
  Summary Manually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats…
• CVE-2026-26193 - Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages CVE-2026-26193High
  Summary Manually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a…
• GHSA-fqf6-gxhh-2xhw - uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (s High
  `determine_backup_mode` in `src/uucore/src/lib/features/backup_control.rs` only checks `--backup`/`-b` and returns `BackupMode::None` when only `--suffix` is…
• CVE-2026-53514 - Better Auth vulnerable to unauthorized invitation acceptance via unverified emai CVE-2026-53514High
  Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` with the `organization` plugin (`import {…
• CVE-2026-53516 - Better Auth has an account takeover issue via OAuth auto-link to unverified pre CVE-2026-53516High
  Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` at a version `< 1.6.11` on the stable line, or any…
• GHSA-86j7-9j95-vpqj - Better Auth has stored XSS in the auth-server origin via javascript: redirect_ur High
  Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the `oidc-provider` plugin or the `mcp`…
• GHSA-9h47-pqcx-hjr4 - Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advert High
  Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` at a version below the patched release. - Their…
• CVE-2026-53517 - Better Auth: OAuth refresh-token rotation forks the token family on concurrent r CVE-2026-53517High
  Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth-provider` at a version `>= 1.6.0, < 1.6.11`,…
• CVE-2026-53518 - @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent r CVE-2026-53518High
  Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth-provider` at a version `>= 1.6.0, < 1.6.11`,…
• GHSA-j8v8-g9cx-5qf4 - @better-auth/scim: Account/provider takeover via missing owner binding on non-or High
  Am I affected? Users are affected if all of these hold: - They install and register the `@better-auth/scim` plugin (`plugins: [scim()]`). - They create SCIM…
• CVE-2026-53530 - ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary s CVE-2026-53530High
  Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter…
• CVE-2026-53553 - Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote CVE-2026-53553High
  > [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File Read Vulnerability ## Basic…

Medium (25 条)

• GHSA-mxwc-wh95-pw4g - Trapster Community: Unauthenticated malformed DNS compression pointers crash per Medium 3.1
  ## Summary `trapster.libs.dns.decode_labels()` decodes DNS names from attacker-supplied UDP packets and recurses **once per RFC 1035 compression pointer** with…
• CVE-2026-53600 - async-tar PAX extension-header desync enables tar entry/content smuggling CVE-2026-53600Medium
  ## Summary `async-tar` v0.6.0 mis-applies a buffered PAX `size` extension to an intermediary extension header (a GNU longname `L`, a GNU longlink `K`, or a PAX…
• CVE-2026-53634 - Sharp Missing Authorization Check in Quick Creation Command Endpoints CVE-2026-53634Medium
  Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create…
• CVE-2026-49831 - DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter CVE-2026-49831Medium
  ## Overview The [Curation Task](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126845/Curation+Tasks) feature allows an output path to be used by the…
• CVE-2026-49830 - DSpace: ORE resource URI does not validate scheme for non-web resources CVE-2026-49830Medium
  ## Overview When ingesting an aggregated ORE resource by URI (using the [OAI-ORE…
• CVE-2026-49833 - DSpace: Path Traversal is possible through LDN message generation CVE-2026-49833Medium
  ## Overview A path traversal vulnerability is possible via the [COAR Notify / LDN](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126679/COAR+Notify) service…
• GHSA-q95x-7g78-rccv - OneRingBuf has a Use After Free Vulnerability Medium
  Affected versions of `oneringbuf` exposed the obsolete `IntoRef::into_ref` method through the public `IntoRef` trait. For heap-backed ring buffers, this method…
• CVE-2026-49455 - Waku: Cross-Origin CSRF on RSC Server Action Dispatch CVE-2026-49455Medium
  ## Summary Waku's RSC request dispatcher invokes server actions without validating the request's `Origin` (or `Sec-Fetch-Site`) header. A cross-origin web…

…另有 17 条 Medium 级漏洞（已省略）

Low (6 条)

• CVE-2026-49456 - Waku has an Open Redirect via `unstable_redirect` Helper CVE-2026-49456Low
  ## Summary The `unstable_redirect()` helper exported from `waku/router/server` (`packages/waku/src/router/define-router.tsx:156–161`) accepts an arbitrary…
• GHSA-3g4q-2f67-2gvh - netfoil has a resource leak in LRU cache Low
  Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. Impact A local attacker can get netfoil to…
• GHSA-7856-g3gv-9wq8 - netfoil: Attacker controlled data written to logs Low
  Summary Domain names were written to the log without first being validated to contain allowed characters. Impact Depends on how the logs were used.

…另有 3 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（70 条）

Critical (18 条)

• CVE-2026-34048 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34048Critical 9.9
  CVE-2026-34048 CVSS:9.9 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal…
• CVE-2026-34047 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34047Critical 9.9
  CVE-2026-34047 CVSS:9.9 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal…
• CVE-2026-34037 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34037Critical 9.9
  CVE-2026-34037 CVSS:9.9 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the…
• CVE-2026-13019 Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernete CVE-2026-13019Critical 9.8
  CVE-2026-13019 CVSS:9.8 Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function…
• CVE-2026-53483 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver CVE-2026-53483Critical 9.8
  CVE-2026-53483 CVSS:9.8 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version…
• CVE-2026-53481 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver CVE-2026-53481Critical 9.8
  CVE-2026-53481 CVSS:9.8 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version…
• CVE-2011-10043 Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @I CVE-2011-10043Critical 9.8
  CVE-2011-10043 CVSS:9.8 Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could…
• CVE-2026-33264 A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string() CVE-2026-33264Critical 9.8
  CVE-2026-33264 CVSS:9.8 A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler…
• CVE-2026-14345 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell CVE-2026-14345Critical 9.8
  CVE-2026-14345 CVSS:9.8 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code…
• CVE-2026-12375 The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with m CVE-2026-12375Critical 9.8
  CVE-2026-12375 CVSS:9.8 The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro…
• CVE-2026-56140 Improper Input Validation vulnerability in Apache Camel AWS SNS component. The CVE-2026-56140Critical 9.8
  CVE-2026-56140 CVSS:9.8 Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a…
• CVE-2026-53913 Improper Authentication, Missing Authentication for Critical Function, Not Faili CVE-2026-53913Critical 9.8
  CVE-2026-53913 CVSS:9.8 Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache…
• CVE-2026-48204 Improper Input Validation, Improper Access Control vulnerability in Apache Camel CVE-2026-48204Critical 9.8
  CVE-2026-48204 CVSS:9.8 Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The…
• CVE-2025-53830 Anti-Virus for ownCloud is an anti-virus application for file storage, synchroni CVE-2025-53830Critical 9.1
  CVE-2025-53830 CVSS:9.1 Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of…
• CVE-2025-53827 ownCloud Core is the server-side component of the file storage, synchronization, CVE-2025-53827Critical 9.1
  CVE-2025-53827 CVSS:9.1 ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions…
• CVE-2026-48205 Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in A CVE-2026-48205Critical 9.1
  CVE-2026-48205 CVSS:9.1 Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read…
• CVE-2026-48203 Improper Neutralization of Special Elements in Output Used by a Downstream Compo CVE-2026-48203Critical 9.1
  CVE-2026-48203 CVSS:9.1 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation,…
• CVE-2026-4375 The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin t CVE-2026-4375Critical 9.0
  CVE-2026-4375 CVSS:9.0 The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE,…

High (52 条)

• CVE-2026-23697 Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that CVE-2026-23697High 8.8
  CVE-2026-23697 CVSS:8.8 Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code…
  +PoC-in-GitHu
• CVE-2026-44938 A vulnerability has been identified in Fleet's agent-side deployer, which did no CVE-2026-44938High 8.8
  CVE-2026-44938 CVSS:8.8 A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels…
  +GitHub-Advis
• CVE-2026-13696 Improper neutralization of special elements used in an LDAP query ('LDAP injecti CVE-2026-13696High 8.8
  CVE-2026-13696 CVSS:8.8 Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows…
• CVE-2026-14474 A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base op CVE-2026-14474High 8.8
  CVE-2026-14474 CVSS:8.8 A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the…
• CVE-2026-11610 A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Ser CVE-2026-11610High 8.8
  CVE-2026-11610 CVSS:8.8 A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with…
• CVE-2026-34158 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34158High 8.8
  CVE-2026-34158 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the…
• CVE-2026-42200 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-42200High 8.8
  CVE-2026-42200 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL…
• CVE-2026-42143 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-42143High 8.8
  CVE-2026-42143 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471,…
• CVE-2026-34168 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34168High 8.8
  CVE-2026-34168 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the…
• CVE-2026-34152 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34152High 8.8
  CVE-2026-34152 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471,…
• CVE-2026-34058 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34058High 8.8
  CVE-2026-34058 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the…
• CVE-2026-34057 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34057High 8.8
  CVE-2026-34057 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the…
• CVE-2026-34035 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34035High 8.8
  CVE-2026-34035 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain…
• CVE-2026-34034 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34034High 8.8
  CVE-2026-34034 CVSS:8.8 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the…
• CVE-2026-46590 Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. CVE-2026-46590High 8.8
  CVE-2026-46590 CVSS:8.8 Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key…
• CVE-2026-12277 The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate CVE-2026-12277High 8.7
  CVE-2026-12277 CVSS:8.7 The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting…
  +PoC-in-GitHu
• CVE-2026-4249 The throttling event handling mechanism in multiple WSO2 products accepts user-s CVE-2026-4249High 8.6
  CVE-2026-4249 CVSS:8.6 The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of…
• CVE-2025-53828 SharePoint for ownCloud is an application for using SharePoint with the file sto CVE-2025-53828High 8.5
  CVE-2025-53828 CVSS:8.5 SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud…
• CVE-2026-11340 Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing CVE-2026-11340High 8.3
  CVE-2026-11340 CVSS:8.3 Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This…
• CVE-2026-8377 Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. CVE-2026-8377High 8.2
  CVE-2026-8377 CVSS:8.2 Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Collect Data from…
• CVE-2026-59195 pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package nam CVE-2026-59195High 8.2
  CVE-2026-59195 CVSS:8.2 pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and…
• CVE-2026-46591 Improper Neutralization of Special Elements in Data Query Logic vulnerability in CVE-2026-46591High 8.2
  CVE-2026-46591 CVSS:8.2 Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer…
• CVE-2026-13020 A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal CVE-2026-13020High 8.1
  CVE-2026-13020 CVSS:8.1 A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux…
• CVE-2026-11348 Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. CVE-2026-11348High 8.1
  CVE-2026-11348 CVSS:8.1 Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue…
• CVE-2026-49297 Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanF CVE-2026-49297High 8.1
  CVE-2026-49297 CVSS:8.1 Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned…
• CVE-2026-14476 A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_sm CVE-2026-14476High 8.0
  CVE-2026-14476 CVSS:8.0 A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences…
• CVE-2026-34171 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34171High 8.0
  CVE-2026-34171 CVSS:8.0 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET…
• CVE-2025-53829 ownCloud is a file storage, synchronization, and sharing application. In ownClou CVE-2025-53829High 8.0
  CVE-2025-53829 CVSS:8.0 ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with…
• CVE-2026-57851 MSI Feature Manager contains a local privilege escalation vulnerability in the K CVE-2026-57851High 7.8
  CVE-2026-57851 CVSS:7.8 MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally…
• CVE-2026-34044 Coolify is an open-source and self-hostable tool for managing servers, applicati CVE-2026-34044High 7.7
  CVE-2026-34044 CVSS:7.7 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the…
• CVE-2026-6901 Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. Th CVE-2026-6901High 7.7
  CVE-2026-6901 CVSS:7.7 Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5. 产品:
• CVE-2026-9165 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Ce CVE-2026-9165High 7.7
  CVE-2026-9165 CVSS:7.7 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served…
• CVE-2026-6101 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to CVE-2026-6101High 7.5
  CVE-2026-6101 CVSS:7.5 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including…
• CVE-2026-5799 Authorization bypass through User-Controlled key vulnerability in Idvlabs Softwa CVE-2026-5799High 7.5
  CVE-2026-5799 CVSS:7.5 Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows…
• CVE-2026-5730 Authorization bypass through User-Controlled key vulnerability in Idvlabs Softwa CVE-2026-5730High 7.5
  CVE-2026-5730 CVSS:7.5 Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows…
• CVE-2026-13708 Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading CVE-2026-13708High 7.5
  CVE-2026-13708 CVSS:7.5 Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol.…
• CVE-2026-55994 Improper Input Validation, Exposure of Sensitive Information to an Unauthorized CVE-2026-55994High 7.5
  CVE-2026-55994 CVSS:7.5 Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability…
• CVE-2026-55993 Improper Input Validation, Exposure of Sensitive Information to an Unauthorized CVE-2026-55993High 7.5
  CVE-2026-55993 CVSS:7.5 Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability…
• CVE-2026-46726 Improper Input Validation, Exposure of Sensitive Information to an Unauthorized CVE-2026-46726High 7.5
  CVE-2026-46726 CVSS:7.5 Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability…
• CVE-2026-46592 Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') CVE-2026-46592High 7.5
  CVE-2026-46592 CVSS:7.5 Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The…
• CVE-2026-46585 Improper Input Validation, Authorization Bypass Through User-Controlled Key vuln CVE-2026-46585High 7.5
  CVE-2026-46585 CVSS:7.5 Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The…
• CVE-2026-6900 Improper certificate validation vulnerability in B&R Industrial Automation GmbH CVE-2026-6900High 7.4
  CVE-2026-6900 CVSS:7.4 Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5. 产品:
• CVE-2026-58384 A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() CVE-2026-58384High 7.3
  CVE-2026-58384 CVSS:7.3 A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE…
• CVE-2026-58380 A flaw was found in GIMP's PNM file format parser. When parsing a specially craf CVE-2026-58380High 7.3
  CVE-2026-58380 CVSS:7.3 A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes…
• CVE-2026-49042 Improper Input Validation vulnerability in Apache Camel. This issue affects Apa CVE-2026-49042High 7.3
  CVE-2026-49042 CVSS:7.3 Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0…
• CVE-2026-46588 Improper Input Validation vulnerability in Apache Camel. This issue affects Apa CVE-2026-46588High 7.3
  CVE-2026-46588 CVSS:7.3 Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2,…
• CVE-2026-46587 Improper Input Validation vulnerability in Apache Camel. This issue affects Apa CVE-2026-46587High 7.3
  CVE-2026-46587 CVSS:7.3 Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2,…
• CVE-2026-23698 Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnera CVE-2026-23698High 7.2
  CVE-2026-23698 CVSS:7.2 Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows…
  +PoC-in-GitHu
• CVE-2026-53479 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver CVE-2026-53479High 7.2
  CVE-2026-53479 CVSS:7.2 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version…
• CVE-2026-59196 pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias CVE-2026-59196High 7.1
  CVE-2026-59196 CVSS:7.1 pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules…
• CVE-2026-59194 pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry co CVE-2026-59194High 7.1
  CVE-2026-59194 CVSS:7.1 pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory…
• CVE-2026-13705 Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bund CVE-2026-13705High 7.1
  CVE-2026-13705 CVSS:7.1 Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal…

⚔️ Sploitus（60 条）

Unknown (60 条)

• exploitfa exploit
  exploitfa exploit
• Cybersecurity-Challenges-Exploits exploit
  Cybersecurity-Challenges-Exploits exploit

…另有 58 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-07-09 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV