📊 2026-07-11 漏洞情报日报 · 200 条 · 高危 101
每日漏洞情报汇总 · 2026-07-11
📊 2026-07-11 漏洞情报日报
📋 共 200 条
🔥 高危/严重 101 条
🚨 CISA-KEV 2 条
🐙 GitHub-Advisory 82 条 🔥45
🛡️ NVD-Latest 56 条 🔥56
⚔️ Sploitus 60 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-54088 (Critical)： File Browser 认证钩子中的命令注入漏洞。攻击者若为管理员，可通过在用户名或密码中插入 shell 字符，利用该特性执行任意系统命令，实现远程代码执行。
- CVE-2026-54089 (Critical)： File Browser 代理认证绕过漏洞。未授权的攻击者若可直接访问配置了代理认证的服务器，只需伪造一个特定的 HTTP 请求头即可伪装成任意用户（包括管理员），完全接管系统。
- CVE-2026-56291 (CVSS 9.8)： Balbooa Forms (Joomla扩展) 未授权任意文件上传漏洞。攻击者无需登录即可上传恶意可执行文件，导致服务器被完全控制。该漏洞已被列入 CISA KEV 清单，表明已存在在野利用。
- CVE-2026-14245 (CVSS 9.8)： miniOrange OTP Login (WordPress插件) 认证绕过漏洞。攻击者可利用该漏洞绕过 OTP 验证，直接接管管理员账户，导致网站完全失陷。
- CVE-2026-54067/CVE-2026-54158 (Critical)： SiYuan 笔记软件存在多个存储型XSS至RCE的漏洞。攻击者可通过在CSS代码片段或数据库单元格中插入恶意代码，在管理员查看笔记时执行任意JavaScript，进而植入后门或窃取数据。
📈 威胁趋势
- 远程代码执行 (RCE) / 任意文件上传： 占比最高，且多个漏洞 CVSS 评分达9.8。攻击向量涵盖命令注入、未授权文件上传（如 Balbooa Forms）、PHP对象注入（如 PrestaShop模块）以及恶意依赖包（如 Rust crate）。
- 认证绕过与权限提升： 多种绕过方式活跃，包括伪造请求头（File Browser）、绕过OTP验证（miniOrange WordPress插件）、以及信任不可信来源（SiYuan无条件信任浏览器扩展源）。
- 跨站脚本 (XSS)： 存储型XSS威胁依旧严重，尤其在笔记、CMS等需要用户输入内容的系统中。攻击者能借此升级为RCE或信息窃取。
- SQL注入： 多个CMS和电商系统（如 BiEticaret、Mediküm Web）爆出高危SQL注入漏洞，可能导致数据库完全泄露或服务器被控制。
- OAuth2令牌泄露： Authorizer 组件因未校验重定向 URI，可能导致授权码或令牌被恶意第三方截获。
🛡️ 缓解建议
- 优先修补在野利用漏洞： 立即检查并升级存在CVE-2026-56291 (Balbooa Forms) 的Joomla站点，并关注后续补丁更新。同时对 CVE-2026-54088/54089 (File Browser) 进行版本检查或立即禁用其认证钩子与代理认证功能。
- 升级与配置加固： 针对所有CVSS 9.8的漏洞（如CVE-2026-14245、CVE-2026-12116等），立即升级至各自产品的最新安全版本。对 SiYuan 用户，建议检查并移除不可信的CSS片段和数据库内容，并在浏览器层面启用内容安全策略（CSP）作为深度防御。
- 阻断攻击入口： 在Web应用防火墙 (WAF) 或反向代理上，添加针对可执行文件上传、敏感请求头伪造、以及恶意SQL语句的检测与拦截规则，尤其应重点防护登录接口和文件上传功能。
- 供应链安全审查： 开发者应审查并移除已被移除的恶意 Rust crate `exploration`，并审计所有第三方依赖，避免引入含有后门的软件包。
🚨 CISA-KEV（2 条）
Unknown (2 条)
- CVE-2026-48939 - iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-48939
CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability 产品: iCagenda iCagenda 描述: iCagenda contains an unrestricted upload of… - CVE-2026-56291 - Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-56291
CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability 产品: Balbooa Forms 描述: Balbooa Forms contains an unrestricted upload…
🐙 GitHub-Advisory（82 条）
Critical (13 条)
- CVE-2026-54088 - File Browser: Command Injection via Authentication Hook Shell Substitution (Pre
CVE-2026-54088Critical 4.0
## Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied…
+PoC-in-GitHu - CVE-2026-54089 - File Browser: Authentication Bypass via Proxy Auth Header Forgery
CVE-2026-54089Critical 3.1
## Summary When FileBrowser is configured with proxy authentication (`auth.method=proxy`), any unauthenticated attacker who can reach the server directly can… - CVE-2026-54067 - SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
CVE-2026-54067Critical
Summary A CSS snippet body containing `</style>` breaks out of its surrounding `<style>` tag when `renderSnippet()` interpolates it via `insertAdjacentHTML`. A… - CVE-2026-54072 - Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attack
CVE-2026-54072Critical
## Summary The `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or… - CVE-2026-54069 - SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin
CVE-2026-54069Critical
## Summary SiYuan Note's kernel HTTP server unconditionally trusts all `chrome-extension://` origins, granting `RoleAdministrator` access to every installed… - GHSA-99j7-fhr2-xfj4 - `exploration` was removed from crates.io for malicious code Critical
A method within the `exploration` crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on… - CVE-2026-54158 - SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
CVE-2026-54158Critical
Summary The attribute-view (database) cell renderer `genAVValueHTML` interpolates cell content raw in four of its branches: `text`, `url`, `phone`, and… - CVE-2026-54159 - prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows
CVE-2026-54159Critical
Impact A PHP Object Injection vulnerability affects the PrestaShop module `ps_facetedsearch`. The module rebuilds the selected search filters from the request… - CVE-2026-50551 - SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
CVE-2026-50551Critical
SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that… - GHSA-g936-7jqj-mwv8 - TSDProxy: Internal proxy auth token forwarded to backend services enables manage Critical
## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication token to all proxied backend services. When… - CVE-2026-52766 - YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamed
CVE-2026-52766Critical
Summary The `{{erasespamedcomments}}` wiki action (`actions/EraseSpamedCommentsAction.php`) accepts a `suppr[]` array from `POST` and deletes every wiki page… - CVE-2026-52777 - YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction vi
CVE-2026-52777Critical
## Details Sink `tools/bazar/services/CSVManager.php` line 372-399: ``` public function importEntry(array $importedEntries, string $formId): ?array { if… - CVE-2026-52778 - YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execu
CVE-2026-52778Critical
Summary An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize…
High (32 条)
- CVE-2026-49866 - libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-49866High
Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with the results. There… - CVE-2026-54066 - SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode ar
CVE-2026-54066High
## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but the **identical root cause remains in the… - CVE-2026-54063 - Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Pan
CVE-2026-54063High
## Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) Summary The `checkSheet()` function in `github.com/xuri/excelize/v2` uses an… - CVE-2026-54070 - SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
CVE-2026-54070High
## Summary `renderPackageREADME` in `kernel/bazaar/readme.go` renders a Bazaar package README from Markdown to HTML with the lute engine and… - CVE-2026-54071 - BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/p
CVE-2026-54071High
## Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser… - GHSA-qv4m-m73m-8hj7 - NotrinosERP: Authenticated arbitrary file upload leads to remote code execution High
#### Summary An authenticated user with the HR "Manage Employees" permission (`SA_EMPLOYEE`) can upload a file with an arbitrary extension through the employee… - GHSA-xrmc-c5cg-rv7x - SafeInstall agent guard shell parsing can miss raw package execution High
## Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher… - GHSA-wm45-qh3g-v83f - mcp-atlassian: Arbitrary server-side file read via attachment upload High
Summary A client that can invoke MCP tools can read **arbitrary files from the server host** and exfiltrate them as Atlassian attachments. The… - GHSA-g5r6-gv6m-f5jv - mcp-atlassian: Arbitrary file read via missing path validation in confluence_upl High
Summary `confluence_upload_attachment` passes `file_path` directly to `open(file_path, "rb")` with no path validation. Any authenticated MCP client — or an AI… - GHSA-h4g2-xfmw-q2c9 - Clauster: Non-loopback deployments can serve the dashboard unauthenticated when High
Summary A Clauster instance bound to a **non-loopback** address (e.g. `0.0.0.0` or a LAN IP) can serve the entire dashboard and its API **without any… - CVE-2026-54174 - melange: Incomplete package integrity verification allows data section substitut
CVE-2026-54174High
Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual… - GHSA-387m-935m-c4vw - Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling inf High
The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a… - GHSA-52vm-mxx8-f227 - Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
CVE-2026-37555High
Impact In Phantom <= 1.3.0, when `PHANTOM_OUTPUT_DIR` was unset (the default), the MCP tools accepted arbitrary absolute output paths with no confinement.… - CVE-2026-49476 - Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
CVE-2026-49476High
Summary The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated… - CVE-2026-49477 - Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
CVE-2026-49477High
Summary The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic… - CVE-2026-50553 - Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibl
CVE-2026-50553High
## Summary Note Mark validates book and note `slug` values with the OpenAPI/huma tag `pattern:"[a-z0-9-]+"`. huma compiles this with… - CVE-2026-49485 - org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validat
CVE-2026-49485High
# Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to… - CVE-2026-53727 - Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remot
CVE-2026-53727High
## Summary `CssParser::Parser#read_remote_file` (and therefore `load_uri!`, and the `@import`-following branch of `add_block!`) issues HTTP/HTTPS requests… - GHSA-86vw-x4ww-x467 - Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPr High
The `actionRenderCardPreview()` method in `FieldsController` passes the `fieldLayoutConfig` POST parameter directly to `Fields::createLayout()` without calling… - CVE-2026-53932 - laravel-backup-restore has an OS Command Injection during database restore
CVE-2026-53932High
## Summary A crafted backup archive can trigger OS command injection during database restore. The restore workflow extracts a ZIP archive, enumerates files… - CVE-2026-52762 - YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Exe
CVE-2026-52762High
Summary YesWiki Bazar contains a stored Server-Side Template Injection (`SSTI`) vulnerability in the semantic template feature that can be escalated to… - CVE-2026-52767 - YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass
CVE-2026-52767High
## Summary `HttpSignatureService::verifySignature()` checks the result of PHP's `openssl_verify()` with a **loose boolean negation** - `if… - CVE-2026-52769 - YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signatu
CVE-2026-52769High
## Summary The `POST /api/forms/{formId}/actor/inbox` route - exposed publicly with `acl:"public"` - accepts an HTTP `Signature` header whose `keyId` parameter… - CVE-2026-52770 - YesWiki: SQL Injection possible through public Bazar entry-listing APIs via nume
CVE-2026-52770High
Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric `query` / `queries` filters. For Bazar fields… - CVE-2026-52771 - YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`
CVE-2026-52771High
## Summary `ApiController::deletePage()` interpolates a page tag retrieved from the database into a `DELETE FROM …_links WHERE to_tag = '$tag'` query without… - CVE-2026-52775 - YesWiki has Authenticated SQL Injection via ReactionManager
CVE-2026-52775High
## Summary YesWiki through the latest development branch contains a SQL injection vulnerability in `ReactionManager::deleteUserReaction()` that allows any… - CVE-2026-49754 - mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)
CVE-2026-49754High
Summary Mint's HTTP/2 client accumulates `CONTINUATION` header-block fragments into a per-connection buffer with no cap on size or frame count. A malicious or… - CVE-2026-48862 - mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS
CVE-2026-48862High
Summary Mint's HTTP/2 client accepts `PUSH_PROMISE` frames from any server it connects to and inserts every promised stream into a per-connection map without… - CVE-2026-49851 - Mistune: Potential DoS via quadratic-time parsing in parse_link_text
CVE-2026-49851High
Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. A relatively small input consisting… - CVE-2026-48594 - Tesla has decompression bomb on response body
CVE-2026-48594High
Summary Any Tesla client pipeline that includes `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` eagerly decompresses HTTP response… - CVE-2026-48595 - Tesla: Authorization header leaks on cross-origin redirect via case-sensitive fi
CVE-2026-48595High
Summary `Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs the check with a…
+PoC-in-GitHu - CVE-2026-48597 - Tesla vulnerable to atom exhaustion via untrusted URL scheme
CVE-2026-48597High
Summary In the Mint adapter for the Tesla HTTP client library, `Tesla.Adapter.Mint.open_conn/2` passes the URL scheme of every outgoing request through…
Medium (33 条)
- CVE-2026-52772 - YesWiki has stored XSS in Bazar form-field templates via unescaped field.label /
CVE-2026-52772Medium 3.1
# Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders… - CVE-2026-49858 - API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL it
CVE-2026-49858Medium
Impact `#[ApiProperty(security: ...)]` is evaluated per request to decide whether a property is exposed. The `componentsCache` arrays in… - CVE-2026-5078 - morgan vulnerable to Log Forging via unneutralized control characters in :remote
CVE-2026-5078Medium
Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing… - CVE-2026-49865 - Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Imag
CVE-2026-49865Medium
Summary Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation workflow. If an attacker can control… - CVE-2026-49977 - tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
CVE-2026-49977Medium
Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element… - GHSA-489g-7rxv-6c8q - MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
CVE-2026-27826Medium
Summary GHSA-7r34-79r5-rcc9's fix added `validate_url_for_ssrf`, which resolves the attacker-controlled `X-Atlassian-{Jira,Confluence}-Url` header host **once… - GHSA-9mqm-qcwf-5qhg - CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted Medium
Summary CredSweeper's deep scanner does not enforce `recursive_limit_size` as a hard limit. Several recursive scanners fully decompress or fully read… - CVE-2026-54068 - SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/
CVE-2026-54068Medium
Summary The `/api/icon/getDynamicIcon` endpoint is explicitly excluded from authentication in SiYuan's kernel router (`router.go`, "不需要鉴权" -- no auth needed).…
…另有 25 条 Medium 级漏洞（已省略）
Low (4 条)
- CVE-2026-48598 - Tesla vulnerable to multipart part smuggling via unescaped `content-disposition`
CVE-2026-48598Low
Summary `Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other opts) verbatim… - GHSA-c43v-4cr8-6mvp - Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.sv Low
Summary An authenticated path traversal in `assets/icon` allows local SVG file read by passing traversal sequences in the `extension` parameter. The issue is… - CVE-2026-48861 - mint has potential CRLF injection in its HTTP request line via unvalidated `meth
CVE-2026-48861Low
Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request line without character validation. An…
…另有 1 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（56 条）
Critical (11 条)
- CVE-2026-12116 A vulnerability in the Xerte Online Tools allows for RCE through the antivirus b
CVE-2026-12116Critical 9.8
CVE-2026-12116 CVSS:9.8 A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be… - CVE-2026-56291 The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary
CVE-2026-56291Critical 9.8
CVE-2026-56291 CVSS:9.8 The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and…
+CISA-KEV - CVE-2026-5955 Improper neutralization of special elements used in an SQL command ('SQL injecti
CVE-2026-5955Critical 9.8
CVE-2026-5955 CVSS:9.8 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet… - CVE-2026-15158 The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Uploa
CVE-2026-15158Critical 9.8
CVE-2026-15158 CVSS:9.8 The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the… - CVE-2026-14245 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres
CVE-2026-14245Critical 9.8
CVE-2026-14245 CVSS:9.8 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to… - CVE-2026-8307 Improper neutralization of special elements used in an SQL command ('SQL injecti
CVE-2026-8307Critical 9.8
CVE-2026-8307 CVSS:9.8 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Design Mediküm Web… - CVE-2026-14454 Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as si
CVE-2026-14454Critical 9.8
CVE-2026-14454 CVSS:9.8 Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count… - CVE-2026-2342 Improper neutralization of input during web page generation ('cross-site scripti
CVE-2026-2342Critical 9.3
CVE-2026-2342 CVSS:9.3 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems… - CVE-2026-47646 Improper neutralization of input during web page generation ('cross-site scripti
CVE-2026-47646Critical 9.3
CVE-2026-47646 CVSS:9.3 Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an… - CVE-2026-14261 A vulnerability in the Xerte Online Tools allows for authentication bypass and r
CVE-2026-14261Critical 9.1
CVE-2026-14261 CVSS:9.1 A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the… - CVE-2026-41042 Unauthenticated callers can supply a malicious H2 JDBC URL through the testConne
CVE-2026-41042Critical 9.1
CVE-2026-41042 CVSS:9.1 Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the…
High (45 条)
- CVE-2026-4275 The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPre
CVE-2026-4275High 8.8
CVE-2026-4275 CVSS:8.8 The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… - CVE-2026-47830 Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-window
CVE-2026-47830High 8.8
CVE-2026-47830 CVSS:8.8 Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated… - CVE-2026-47826 The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an at
CVE-2026-47826High 8.8
CVE-2026-47826 CVSS:8.8 The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate… - CVE-2026-5523 The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorizatio
CVE-2026-5523High 8.8
CVE-2026-5523 CVSS:8.8 The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due… - CVE-2026-56003 A heap buffer overflow due to missing size checking in the property buffer when
CVE-2026-56003High 8.5
CVE-2026-56003 CVSS:8.5 A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2… - CVE-2026-56002 A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXf
CVE-2026-56002High 8.5
CVE-2026-56002 CVSS:8.5 A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X… - CVE-2026-47829 Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbi
CVE-2026-47829High 8.3
CVE-2026-47829 CVSS:8.3 Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh… - CVE-2026-4256 Improper neutralization of special elements used in an LDAP query ('LDAP injecti
CVE-2026-4256High 8.2
CVE-2026-4256 CVSS:8.2 Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate…
+GitHub-Advis+PoC-in-GitHu - CVE-2026-33390 An Incorrect Privilege Assignment vulnerability was discovered in the synchroniz
CVE-2026-33390High 8.1
CVE-2026-33390 CVSS:8.1 An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI… - CVE-2026-31985 When the upstream Guardian or CMC was configured in the Remote Collector via n2o
CVE-2026-31985High 8.1
CVE-2026-31985 CVSS:8.1 When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS… - CVE-2026-3688 The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin
CVE-2026-3688High 8.1
CVE-2026-3688 CVSS:8.1 The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object… - CVE-2026-41857 A compromised or malicious BOSH Director can execute arbitrary shell commands on
CVE-2026-41857High 7.8
CVE-2026-41857 CVSS:7.8 A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh… - CVE-2026-22927 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalati
CVE-2026-22927High 7.8
CVE-2026-22927 CVSS:7.8 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. 产品: - CVE-2026-57260 The application opened a PDF file containing an abnormal Unity 3D object. During
CVE-2026-57260High 7.8
CVE-2026-57260 CVSS:7.8 The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a… - CVE-2026-57256 When the application opens a PDF and executes JavaScript, it performs abnormal o
CVE-2026-57256High 7.8
CVE-2026-57256 CVSS:7.8 When the application opens a PDF and executes JavaScript, it performs abnormal operations on the list box field, and this operation is… - CVE-2026-57254 There is an abnormal annotation within the PDF that is referenced by other objec
CVE-2026-57254High 7.8
CVE-2026-57254 CVSS:7.8 There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to… - CVE-2026-57252 When the application opens a PDF file, during the process of JavaScript deleting
CVE-2026-57252High 7.8
CVE-2026-57252 CVSS:7.8 When the application opens a PDF file, during the process of JavaScript deleting pages and removing attachment annotations, it will… - CVE-2026-60109 Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerbe
CVE-2026-60109High 7.5
CVE-2026-60109 CVSS:7.5 Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated… - CVE-2026-60108 Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in t
CVE-2026-60108High 7.5
CVE-2026-60108 CVSS:7.5 Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote… - CVE-2026-56292 A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered
CVE-2026-56292High 7.5
CVE-2026-56292 CVSS:7.5 A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized… - CVE-2026-59692 A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. Duri
CVE-2026-59692High 7.5
CVE-2026-59692 CVSS:7.5 A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject… - CVE-2026-1989 Authorization bypass through User-Controlled key vulnerability in PAVO Financial
CVE-2026-1989High 7.5
CVE-2026-1989 CVSS:7.5 Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation… - CVE-2026-57111 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org
CVE-2026-57111High 7.5
CVE-2026-57111 CVSS:7.5 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache… - CVE-2026-31984 A denial-of-service vulnerability caused by unbounded resource allocation was di
CVE-2026-31984High 7.5
CVE-2026-31984 CVSS:7.5 A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a… - CVE-2026-47840 A network attacker positioned between UAA and its LDAP directory can impersonate
CVE-2026-47840High 7.5
CVE-2026-47840 CVSS:7.5 A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted… - CVE-2026-47831 Use of a cryptographically weak random number generator in the GenerateRandomPas
CVE-2026-47831High 7.5
CVE-2026-47831 CVSS:7.5 Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows… - CVE-2026-11571 The Everest Forms WordPress plugin before 3.5.0 does not reliably delete tempor
CVE-2026-11571High 7.5
CVE-2026-11571 CVSS:7.5 The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification… - CVE-2026-15053 Tanium addressed a denial of service vulnerability in Tanium Server.
CVE-2026-15053High 7.5
CVE-2026-15053 CVSS:7.5 Tanium addressed a denial of service vulnerability in Tanium Server. 产品: - CVE-2026-5356 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for W
CVE-2026-5356High 7.5
CVE-2026-5356 CVSS:7.5 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in… - CVE-2026-6854 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to
CVE-2026-6854High 7.5
CVE-2026-6854 CVSS:7.5 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth'… - CVE-2026-6230 The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injectio
CVE-2026-6230High 7.5
CVE-2026-6230 CVSS:7.5 The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and… - CVE-2026-15137 A weakness has been identified in code-projects Interview Management System 1.0.
CVE-2026-15137High 7.3
CVE-2026-15137 CVSS:7.3 A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file… - CVE-2026-15135 A security flaw has been discovered in code-projects Online Food Order System 1.
CVE-2026-15135High 7.3
CVE-2026-15135 CVSS:7.3 A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file… - CVE-2026-15134 A vulnerability was determined in CodeAstro Simple Online Leave Management Syste
CVE-2026-15134High 7.3
CVE-2026-15134 CVSS:7.3 A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown… - CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (
CVE-2026-54801High 7.2
CVE-2026-54801 CVSS:7.2 A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All… - CVE-2026-9253 The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress
CVE-2026-9253High 7.2
CVE-2026-9253 CVSS:7.2 The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… - CVE-2026-13441 The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is v
CVE-2026-13441High 7.2
CVE-2026-13441 CVSS:7.2 The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… - CVE-2026-8848 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat
CVE-2026-8848High 7.2
CVE-2026-8848 CVSS:7.2 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to… - CVE-2026-15000 The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to S
CVE-2026-15000High 7.2
CVE-2026-15000 CVSS:7.2 The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field… - CVE-2026-6820 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to
CVE-2026-6820High 7.2
CVE-2026-6820 CVSS:7.2 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in… - CVE-2026-6818 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to
CVE-2026-6818High 7.2
CVE-2026-6818 CVSS:7.2 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests'… - CVE-2026-59691 A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. Whe
CVE-2026-59691High 7.1
CVE-2026-59691 CVSS:7.1 A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that… - CVE-2026-14372 The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custo
CVE-2026-14372High 7.1
CVE-2026-14372 CVSS:7.1 The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to… - CVE-2026-31982 An Open Redirect vulnerability was discovered in the SAML Single Sign-On functio
CVE-2026-31982High 7.1
CVE-2026-31982 CVSS:7.1 An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a… - CVE-2026-47828 During bosh create-env and bosh delete-env, the CLI uploads compiled CPI package
CVE-2026-47828High 7.1
CVE-2026-47828 CVSS:7.1 During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV…
⚔️ Sploitus（60 条）
Unknown (60 条)
- vuln-tracker exploit
vuln-tracker exploit - Exploit for Classic Buffer Overflow in Freefloat Freefloat_Ftp_Server exploit
Exploit for Classic Buffer Overflow in Freefloat Freefloat_Ftp_Server exploit
…另有 58 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-11 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV