📊 2026-07-12 漏洞情报日报 · 200 条 · 高危 94
每日漏洞情报汇总 · 2026-07-12
📊 2026-07-12 漏洞情报日报
📋 共 200 条
🔥 高危/严重 94 条
🚨 CISA-KEV 2 条
🐙 GitHub-Advisory 40 条 🔥26
🛡️ NVD-Latest 68 条 🔥68
⚔️ Sploitus 90 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-54088 / CVE-2026-54089 (File Browser)：两大致命漏洞组合。命令注入允许管理员通过认证钩子执行任意命令；代理认证绕过允许攻击者伪造HTTP头直接获取管理员权限。产品多用于企业内部文件管理，攻击面极大，PoC已公开。
- CVE-2026-54769 (Langroid)：基于LLM的应用框架存在沙箱逃逸漏洞，CVSS 10.0。攻击者可利用
TableChatAgent的eval()缺陷实现远程代码执行，严重影响AI产品安全边界。 - CVE-2026-56291 (Balbooa Forms)：Joomla扩展中未经验证的文件上传漏洞，已列入CISA KEV。攻击者可直接上传WebShell获得服务器控制权，实际利用风险极高。
- CVE-2026-54067 / CVE-2026-54158 (SiYuan Note)：两款存储型XSS可演化至RCE，分别通过CSS片段与属性视图注入恶意代码。配合CVE-2026-54069中浏览器扩展未授权API访问，危害巨大。
📈 威胁趋势
- 远程代码执行（RCE）与文件上传：今日7个漏洞涉及RCE或任意文件上传，占比最高。攻击路径包括未授权上传（Balbooa/WordPress插件）、命令注入（File Browser）、反序列化（PrestaShop）和沙箱逃逸（Langroid）。
- 认证绕过与授权缺陷：File Browser代理认证绕过、Apache IoTDB会话缓存复用、SiYuan跨源信任机制缺陷，暴露出产品在认证与授权逻辑上的薄弱环节。
- 跨站脚本(XSS)与数据注入：SiYuan的CSS与属性视图均出现XSS转RCE的攻击链，显示笔记或协作类应用对富内容输入的检查仍需加强。
- 供应链与恶意代码：Rust crate
exploration被发现包含远程下载执行payload的后门代码，尽管未被广泛使用，但再次警示开源组件的审查重要性。
🛡️ 缓解建议
- 立即修补File Browser与Langroid：优先升级至官方修复版本。如无法立即更新，建议禁用File Browser的Hook Authentication与代理认证功能，或将其置于防火墙之后。
- 阻断已知活跃利用：针对CVE-2026-56291 (Balbooa Forms)，监控Web服务器访问日志，检查是否存在异常文件上传请求，并参考CISA KEV指南采取阻断措施。
- 加固SiYuan安全配置：关闭默认空密码的WebUI访问，审查并限制浏览器扩展获取本地API权限，启用内容安全策略(CSP)以缓解XSS类攻击。
- 审查第三方组件与文件上传逻辑：对所有WordPress/Joomla插件及自定义上传点进行文件类型与路径验证，禁用不必要的远程依赖或隔离运行。
🚨 CISA-KEV（2 条）
Unknown (2 条)
- CVE-2026-48939 - iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-48939
CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability 产品: iCagenda iCagenda 描述: iCagenda contains an unrestricted upload of… - CVE-2026-56291 - Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-56291
CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability 产品: Balbooa Forms 描述: Balbooa Forms contains an unrestricted upload…
🐙 GitHub-Advisory（40 条）
Critical (10 条)
- CVE-2026-54088 - File Browser: Command Injection via Authentication Hook Shell Substitution (Pre
CVE-2026-54088Critical 4.0
## Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied…
+PoC-in-GitHu - CVE-2026-54089 - File Browser: Authentication Bypass via Proxy Auth Header Forgery
CVE-2026-54089Critical 3.1
## Summary When FileBrowser is configured with proxy authentication (`auth.method=proxy`), any unauthenticated attacker who can reach the server directly can… - CVE-2026-54067 - SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
CVE-2026-54067Critical
Summary A CSS snippet body containing `</style>` breaks out of its surrounding `<style>` tag when `renderSnippet()` interpolates it via `insertAdjacentHTML`. A… - CVE-2026-54072 - Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attack
CVE-2026-54072Critical
## Summary The `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or… - CVE-2026-54069 - SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin
CVE-2026-54069Critical
## Summary SiYuan Note's kernel HTTP server unconditionally trusts all `chrome-extension://` origins, granting `RoleAdministrator` access to every installed… - GHSA-99j7-fhr2-xfj4 - `exploration` was removed from crates.io for malicious code Critical
A method within the `exploration` crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on… - CVE-2026-54158 - SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
CVE-2026-54158Critical
Summary The attribute-view (database) cell renderer `genAVValueHTML` interpolates cell content raw in four of its branches: `text`, `url`, `phone`, and… - CVE-2026-54159 - prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows
CVE-2026-54159Critical
Impact A PHP Object Injection vulnerability affects the PrestaShop module `ps_facetedsearch`. The module rebuilds the selected search filters from the request… - CVE-2026-50551 - SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
CVE-2026-50551Critical
SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that… - GHSA-g936-7jqj-mwv8 - TSDProxy: Internal proxy auth token forwarded to backend services enables manage Critical
## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication token to all proxied backend services. When…
High (16 条)
- CVE-2026-49866 - libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
CVE-2026-49866High
Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with the results. There… - CVE-2026-54066 - SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode ar
CVE-2026-54066High
## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but the **identical root cause remains in the… - CVE-2026-54063 - Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Pan
CVE-2026-54063High
## Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) Summary The `checkSheet()` function in `github.com/xuri/excelize/v2` uses an… - CVE-2026-54070 - SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
CVE-2026-54070High
## Summary `renderPackageREADME` in `kernel/bazaar/readme.go` renders a Bazaar package README from Markdown to HTML with the lute engine and… - CVE-2026-54071 - BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/p
CVE-2026-54071High
## Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser… - GHSA-qv4m-m73m-8hj7 - NotrinosERP: Authenticated arbitrary file upload leads to remote code execution High
#### Summary An authenticated user with the HR "Manage Employees" permission (`SA_EMPLOYEE`) can upload a file with an arbitrary extension through the employee… - GHSA-xrmc-c5cg-rv7x - SafeInstall agent guard shell parsing can miss raw package execution High
## Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher… - GHSA-wm45-qh3g-v83f - mcp-atlassian: Arbitrary server-side file read via attachment upload High
Summary A client that can invoke MCP tools can read **arbitrary files from the server host** and exfiltrate them as Atlassian attachments. The… - GHSA-g5r6-gv6m-f5jv - mcp-atlassian: Arbitrary file read via missing path validation in confluence_upl High
Summary `confluence_upload_attachment` passes `file_path` directly to `open(file_path, "rb")` with no path validation. Any authenticated MCP client — or an AI… - GHSA-h4g2-xfmw-q2c9 - Clauster: Non-loopback deployments can serve the dashboard unauthenticated when High
Summary A Clauster instance bound to a **non-loopback** address (e.g. `0.0.0.0` or a LAN IP) can serve the entire dashboard and its API **without any… - CVE-2026-54174 - melange: Incomplete package integrity verification allows data section substitut
CVE-2026-54174High
Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual… - GHSA-387m-935m-c4vw - Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling inf High
The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a… - GHSA-52vm-mxx8-f227 - Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
CVE-2026-37555High
Impact In Phantom <= 1.3.0, when `PHANTOM_OUTPUT_DIR` was unset (the default), the MCP tools accepted arbitrary absolute output paths with no confinement.… - CVE-2026-49476 - Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists
CVE-2026-49476High
Summary The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) allocates unbounded memory when compiling large comma-separated… - CVE-2026-49477 - Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser
CVE-2026-49477High
Summary The CSS selector parser in soupsieve (the CSS selector engine for Beautiful Soup 4) contains a regular expression vulnerable to catastrophic… - CVE-2026-50553 - Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibl
CVE-2026-50553High
## Summary Note Mark validates book and note `slug` values with the OpenAPI/huma tag `pattern:"[a-z0-9-]+"`. huma compiles this with…
Medium (13 条)
- CVE-2026-49858 - API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL it
CVE-2026-49858Medium
Impact `#[ApiProperty(security: ...)]` is evaluated per request to decide whether a property is exposed. The `componentsCache` arrays in… - CVE-2026-5078 - morgan vulnerable to Log Forging via unneutralized control characters in :remote
CVE-2026-5078Medium
Impact Morgan's `:remote-user` token extracts the Basic auth username from the `Authorization` header and writes it to the log stream without neutralizing… - CVE-2026-49865 - Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Imag
CVE-2026-49865Medium
Summary Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation workflow. If an attacker can control… - CVE-2026-49977 - tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
CVE-2026-49977Medium
Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element… - GHSA-489g-7rxv-6c8q - MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)
CVE-2026-27826Medium
Summary GHSA-7r34-79r5-rcc9's fix added `validate_url_for_ssrf`, which resolves the attacker-controlled `X-Atlassian-{Jira,Confluence}-Url` header host **once… - GHSA-9mqm-qcwf-5qhg - CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted Medium
Summary CredSweeper's deep scanner does not enforce `recursive_limit_size` as a hard limit. Several recursive scanners fully decompress or fully read… - CVE-2026-54068 - SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/
CVE-2026-54068Medium
Summary The `/api/icon/getDynamicIcon` endpoint is explicitly excluded from authentication in SiYuan's kernel router (`router.go`, "不需要鉴权" -- no auth needed).… - CVE-2026-54136 - Windmill: Resource-scoped API tokens can read script contents outside their allo
CVE-2026-54136Medium
Summary A resource-scoped API token can read script contents outside its allowed path scope via `GET /api/w/{workspace}/scripts/list_search`. This appears to…
…另有 5 条 Medium 级漏洞（已省略）
Low (1 条)
- CVE-2026-48598 - Tesla vulnerable to multipart part smuggling via unescaped `content-disposition`
CVE-2026-48598Low
Summary `Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other opts) verbatim…
🛡️ NVD-Latest（68 条）
Critical (16 条)
- CVE-2026-54769 Langroid is a framework for building large-language-model-powered applications.
CVE-2026-54769Critical 10.0
CVE-2026-54769 CVSS:10.0 Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical…
+GitHub-Advis - CVE-2026-40008 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection
CVE-2026-40008Critical 9.8
CVE-2026-40008 CVSS:9.8 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor… - CVE-2026-28564 Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnera
CVE-2026-28564Critical 9.8
CVE-2026-28564 CVSS:9.8 Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication… - CVE-2026-15282 The Instant Appointment plugin for WordPress is vulnerable to arbitrary file upl
CVE-2026-15282Critical 9.8
CVE-2026-15282 CVSS:9.8 The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the…
+PoC-in-GitHu - CVE-2026-14894 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to
CVE-2026-14894Critical 9.8
CVE-2026-14894 CVSS:9.8 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and…
+PoC-in-GitHu - CVE-2026-12116 A vulnerability in the Xerte Online Tools allows for RCE through the antivirus b
CVE-2026-12116Critical 9.8
CVE-2026-12116 CVSS:9.8 A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be… - CVE-2026-56291 The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary
CVE-2026-56291Critical 9.8
CVE-2026-56291 CVSS:9.8 The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and…
+CISA-KEV - CVE-2026-5955 Improper neutralization of special elements used in an SQL command ('SQL injecti
CVE-2026-5955Critical 9.8
CVE-2026-5955 CVSS:9.8 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet… - CVE-2026-15158 The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Uploa
CVE-2026-15158Critical 9.8
CVE-2026-15158 CVSS:9.8 The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the… - CVE-2026-14245 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres
CVE-2026-14245Critical 9.8
CVE-2026-14245 CVSS:9.8 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to… - CVE-2026-15378 A flaw was found in the `guardrails-detectors` component. This vulnerability all
CVE-2026-15378Critical 9.3
CVE-2026-15378 CVSS:9.3 A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side… - CVE-2026-2342 Improper neutralization of input during web page generation ('cross-site scripti
CVE-2026-2342Critical 9.3
CVE-2026-2342 CVSS:9.3 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems… - CVE-2026-47646 Improper neutralization of input during web page generation ('cross-site scripti
CVE-2026-47646Critical 9.3
CVE-2026-47646 CVSS:9.3 Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an… - CVE-2026-40005 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v
CVE-2026-40005Critical 9.1
CVE-2026-40005 CVSS:9.1 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write… - CVE-2026-15300 The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'dist
CVE-2026-15300Critical 9.1
CVE-2026-15300 CVSS:9.1 The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to,… - CVE-2026-14261 A vulnerability in the Xerte Online Tools allows for authentication bypass and r
CVE-2026-14261Critical 9.1
CVE-2026-14261 CVSS:9.1 A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the…
High (52 条)
- CVE-2026-15070 The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cr
CVE-2026-15070High 8.8
CVE-2026-15070 CVSS:8.8 The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… - CVE-2026-4275 The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPre
CVE-2026-4275High 8.8
CVE-2026-4275 CVSS:8.8 The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… - CVE-2026-47830 Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-window
CVE-2026-47830High 8.8
CVE-2026-47830 CVSS:8.8 Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated… - CVE-2026-47826 The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an at
CVE-2026-47826High 8.8
CVE-2026-47826 CVSS:8.8 The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate… - CVE-2026-5523 The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorizatio
CVE-2026-5523High 8.8
CVE-2026-5523 CVSS:8.8 The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due… - CVE-2026-47829 Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbi
CVE-2026-47829High 8.3
CVE-2026-47829 CVSS:8.3 Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh… - CVE-2026-54423 In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nod
CVE-2026-54423High 8.2
CVE-2026-54423 CVSS:8.2 In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously… - CVE-2026-4256 Improper neutralization of special elements used in an LDAP query ('LDAP injecti
CVE-2026-4256High 8.2
CVE-2026-4256 CVSS:8.2 Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate…
+GitHub-Advis+PoC-in-GitHu - CVE-2026-54771 Langroid is a framework for building large-language-model-powered applications.
CVE-2026-54771High 8.1
CVE-2026-54771 CVSS:8.1 Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application…
+GitHub-Advis - CVE-2026-12598 The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass i
CVE-2026-12598High 8.1
CVE-2026-12598 CVSS:8.1 The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify… - CVE-2026-12597 The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass v
CVE-2026-12597High 8.1
CVE-2026-12597 CVSS:8.1 The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and… - CVE-2026-12595 The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass v
CVE-2026-12595High 8.1
CVE-2026-12595 CVSS:8.1 The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and… - CVE-2026-33390 An Incorrect Privilege Assignment vulnerability was discovered in the synchroniz
CVE-2026-33390High 8.1
CVE-2026-33390 CVSS:8.1 An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI… - CVE-2026-31985 When the upstream Guardian or CMC was configured in the Remote Collector via n2o
CVE-2026-31985High 8.1
CVE-2026-31985 CVSS:8.1 When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS… - CVE-2026-15293 The WP Business Intelligence Lite plugin for WordPress is vulnerable to authoriz
CVE-2026-15293High 8.0
CVE-2026-15293 CVSS:8.0 The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,… - CVE-2026-41857 A compromised or malicious BOSH Director can execute arbitrary shell commands on
CVE-2026-41857High 7.8
CVE-2026-41857 CVSS:7.8 A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh… - CVE-2026-40454 Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++
CVE-2026-40454High 7.5
CVE-2026-40454 CVSS:7.5 Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock… - CVE-2026-40452 Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB.
CVE-2026-40452High 7.5
CVE-2026-40452 CVSS:7.5 Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes… - CVE-2026-40007 Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apach
CVE-2026-40007High 7.5
CVE-2026-40007 CVSS:7.5 Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the… - CVE-2026-40006 Memory Allocation with Excessive Size Value, Allocation of Resources Without Lim
CVE-2026-40006High 7.5
CVE-2026-40006 CVSS:7.5 Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical… - CVE-2026-13347 The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in
CVE-2026-13347High 7.5
CVE-2026-13347 CVSS:7.5 The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js… - CVE-2026-12685 The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendo
CVE-2026-12685High 7.5
CVE-2026-12685 CVSS:7.5 The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an… - CVE-2026-15291 The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable t
CVE-2026-15291High 7.5
CVE-2026-15291 CVSS:7.5 The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,… - CVE-2026-15290 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte
CVE-2026-15290High 7.5
CVE-2026-15290 CVSS:7.5 The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress… - CVE-2026-15288 The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is
CVE-2026-15288High 7.5
CVE-2026-15288 CVSS:7.5 The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all… - CVE-2026-60109 Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerbe
CVE-2026-60109High 7.5
CVE-2026-60109 CVSS:7.5 Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows unauthenticated… - CVE-2026-60108 Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in t
CVE-2026-60108High 7.5
CVE-2026-60108 CVSS:7.5 Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote… - CVE-2026-56292 A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered
CVE-2026-56292High 7.5
CVE-2026-56292 CVSS:7.5 A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized… - CVE-2026-59692 A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. Duri
CVE-2026-59692High 7.5
CVE-2026-59692 CVSS:7.5 A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject… - CVE-2026-1989 Authorization bypass through User-Controlled key vulnerability in PAVO Financial
CVE-2026-1989High 7.5
CVE-2026-1989 CVSS:7.5 Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation… - CVE-2026-57111 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org
CVE-2026-57111High 7.5
CVE-2026-57111 CVSS:7.5 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache… - CVE-2026-31984 A denial-of-service vulnerability caused by unbounded resource allocation was di
CVE-2026-31984High 7.5
CVE-2026-31984 CVSS:7.5 A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a… - CVE-2026-47840 A network attacker positioned between UAA and its LDAP directory can impersonate
CVE-2026-47840High 7.5
CVE-2026-47840 CVSS:7.5 A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted… - CVE-2026-47831 Use of a cryptographically weak random number generator in the GenerateRandomPas
CVE-2026-47831High 7.5
CVE-2026-47831 CVSS:7.5 Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-stemcell-builder allows… - CVE-2026-11571 The Everest Forms WordPress plugin before 3.5.0 does not reliably delete tempor
CVE-2026-11571High 7.5
CVE-2026-11571 CVSS:7.5 The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification… - CVE-2026-15330 A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the
CVE-2026-15330High 7.3
CVE-2026-15330 CVSS:7.3 A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of… - CVE-2026-15319 A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This
CVE-2026-15319High 7.3
CVE-2026-15319 CVSS:7.3 A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file… - CVE-2026-15137 A weakness has been identified in code-projects Interview Management System 1.0.
CVE-2026-15137High 7.3
CVE-2026-15137 CVSS:7.3 A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file… - CVE-2026-15135 A security flaw has been discovered in code-projects Online Food Order System 1.
CVE-2026-15135High 7.3
CVE-2026-15135 CVSS:7.3 A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file… - CVE-2026-15134 A vulnerability was determined in CodeAstro Simple Online Leave Management Syste
CVE-2026-15134High 7.3
CVE-2026-15134 CVSS:7.3 A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown… - CVE-2026-15298 The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripti
CVE-2026-15298High 7.2
CVE-2026-15298 CVSS:7.2 The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This… - CVE-2026-13430 The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrar
CVE-2026-13430High 7.2
CVE-2026-13430 CVSS:7.2 The Post Export Import with Media plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,… - CVE-2026-54801 A vulnerability has been identified in CPCI85 Central Processing/Communication (
CVE-2026-54801High 7.2
CVE-2026-54801 CVSS:7.2 A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All… - CVE-2026-9253 The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress
CVE-2026-9253High 7.2
CVE-2026-9253 CVSS:7.2 The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… - CVE-2026-13441 The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is v
CVE-2026-13441High 7.2
CVE-2026-13441 CVSS:7.2 The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… - CVE-2026-8848 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimat
CVE-2026-8848High 7.2
CVE-2026-8848 CVSS:7.2 The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to… - CVE-2026-15000 The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to S
CVE-2026-15000High 7.2
CVE-2026-15000 CVSS:7.2 The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field… - CVE-2026-50181 Langroid is a framework for building large-language-model-powered applications.
CVE-2026-50181High 7.1
CVE-2026-50181 CVSS:7.1 Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and…
+PoC-in-GitHu - CVE-2026-59691 A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. Whe
CVE-2026-59691High 7.1
CVE-2026-59691 CVSS:7.1 A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that… - CVE-2026-14372 The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custo
CVE-2026-14372High 7.1
CVE-2026-14372 CVSS:7.1 The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to… - CVE-2026-31982 An Open Redirect vulnerability was discovered in the SAML Single Sign-On functio
CVE-2026-31982High 7.1
CVE-2026-31982 CVSS:7.1 An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a… - CVE-2026-47828 During bosh create-env and bosh delete-env, the CLI uploads compiled CPI package
CVE-2026-47828High 7.1
CVE-2026-47828 CVSS:7.1 During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV…
⚔️ Sploitus（90 条）
Unknown (90 条)
- Exploit for CVE-2026-13768 exploit
CVE-2026-13768
Exploit for CVE-2026-13768 exploit - Exploit for Protection Mechanism Failure in Jenkins Pipeline\:_Groovy exploit
Exploit for Protection Mechanism Failure in Jenkins Pipeline\:_Groovy exploit
…另有 88 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-12 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV