📊 2026-07-15 漏洞情报日报 · 200 条 · 高危 100
每日漏洞情报汇总 · 2026-07-15
📊 2026-07-15 漏洞情报日报
📋 共 200 条
🔥 高危/严重 100 条
🚨 CISA-KEV 5 条
🐙 GitHub-Advisory 72 条 🔥43
🛡️ NVD-Latest 57 条 🔥57
⚔️ Sploitus 66 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-47677 (FacturaScripts): 关键身份认证绕过漏洞。攻击者可对2FA验证接口进行暴力破解，无需密码即可接管任何启用了双因素认证的用户账户，且接口缺乏CSRF保护，利用条件极低。
- CVE-2026-52824 (Kimai Docker): 关键默认密钥漏洞。官方Docker镜像使用了硬编码的默认`APP_SECRET`，攻击者可轻易伪造会话Cookie，直接接管整个实例，影响所有未修改此配置的容器化部署。
- CVE-2026-45262 (FacturaScripts): 关键SQL注入漏洞。即使API密钥被限制为仅可读访问，攻击者仍可通过REST API端点执行恶意SQL语句，导致数据泄露或进一步提权。
- CVE-2026-4769 (WAGO PLC): 关键未授权访问漏洞。WAGO I/O Field系列设备启动时启用内部诊断功能，无需认证即可通过网络远程访问，可能导致工业控制系统被完全控制。
- CVE-2026-50006 (Anyquery): 关键任意文件写入漏洞。其MySQL兼容服务器模式未限制原生SQLite命令，未授权攻击者可通过`ATTACH DATABASE`命令在服务器上写入文件，进而实现远程代码执行。
📈 威胁趋势
- 远程代码执行 (RCE) / 任意文件写入: 今日威胁最严重的类型。涉及Anyquery (CVE-2026-50006)、TidGi、DIRAC (CVE-2026-45579)、Crawl4AI (CVE-2026-56260) 等多个产品，攻击者多通过非预期功能或输入验证缺陷实现代码执行。
- 身份认证绕过与权限提升: FacturaScripts (CVE-2026-47677) 和Kimai (CVE-2026-52824) 暴露了认证机制的严重缺陷，前者允许对2FA进行暴力破解，后者因默认密钥导致Cookie伪造，均能导致账户完全接管。
- SQL注入: 关键SQL注入漏洞 (CVE-2026-45262) 出现在企业级ERP系统FacturaScripts中，即使受限的API密钥也无法防御，威胁数据安全。
- 信息泄露与路径遍历: n8n-MCP (CVE-2026-54052) 存在租户隔离缺陷，可导致工作版本历史越权访问；FacturaScripts (CVE-2026-7xxx) 文件上传功能存在路径遍历，可造成文件被覆盖或写入。
- 工业控制系统 (ICS) 风险: WAGO PLC (CVE-2026-4769) 漏洞表明OT环境中的设备固件存在隐蔽后门式功能，一旦被利用将造成严重物理后果。
- Web应用与CMS弱点: Joomla Helix Ultimate (CVE-2026-57830) 和WordPress User Registration插件 (CVE-2026-11964) 分别存在未授权文件删除和支付通知伪造漏洞，威胁网站完整性。
🛡️ 缓解建议
- 立即更新与替换默认密钥: 针对Kimai (CVE-2026-52824) 和Flowise (CVE-2026-56271)，务必立即检查并替换所有硬编码的默认`APP_SECRET`和JWT密钥，并重新生成所有会话令牌。
- 严格限制网络暴露面: 对Anyquery (CVE-2026-50006) 和WAGO PLC (CVE-2026-4769)，应立即将服务器端口（如MySQL协议端口）和PLC管理接口限制在内网或VPN内，禁止暴露在公网，并启用防火墙白名单。
- 升级至修复版本或应用补丁: 优先升级FacturaScripts、Gravitino (CVE-2026-41041) 和 Centreon (CVE-2026-14453) 至最新安全版本。对于无法立即更新的FacturaScripts系统，可临时禁用REST API或启用严格的WAF规则以缓解SQL注入和认证绕过。
- 加强输入验证与最小权限原则: 针对Crawl4AI和Joomla Helix等应用，部署Web应用防火墙 (WAF) 过滤恶意路径遍历和文件删除请求。对所有API接口实施严格的用户输入校验和输出编码，并定期审计API密钥权限，遵循最小权限原则。
🚨 CISA-KEV（5 条）
Unknown (5 条)
- CVE-2026-15410 - SonicWall SMA1000 Appliances Code Injection Vulnerability
CVE-2026-15410
CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability 产品: SonicWall SMA1000 Appliances 描述: SonicWall SMA1000 Appliances contain a code… - CVE-2026-15409 - SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
CVE-2026-15409
CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability 产品: SonicWall SMA1000 Appliances 描述: SonicWall SMA1000 Appliances contain…
…另有 3 条 Unknown 级漏洞（已省略）
🐙 GitHub-Advisory（72 条）
Critical (9 条)
- CVE-2026-47677 - FacturaScripts: Account takeover of any 2FA-enabled user
CVE-2026-47677Critical 4.0
# Authentication bypass in FacturaScripts: `/login?action=two-factor-validation` accepts brute-forceable TOTP without password or CSRF protection ## Summary… - CVE-2026-52824 - Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Tak
CVE-2026-52824Critical
Summary The official Kimai Docker image ships with `APP_SECRET=change_this_to_something_unique` as the default environment variable. The Docker entrypoint does… - CVE-2026-45262 - FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filte
CVE-2026-45262Critical
## Summary > **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A scoped `ApiKey` with `fullaccess=0` and an… - CVE-2026-50006 - Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (
CVE-2026-50006Critical
## Summary Anyquery's `server` mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the… - CVE-2026-54052 - n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP de
CVE-2026-54052Critical
## Impact In multi-tenant HTTP deployments — where a single n8n-mcp server serves several tenants — the locally stored workflow version history (the automatic… - GHSA-9hc2-hjx8-q6pv - TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Critical
## Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a single Git repository import. The… - GHSA-hgjx-r89m-m7v4 - FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName Critical
## Summary `FacturaScripts\Core\UploadedFile::move($destiny, $destinyName)` concatenates `$destiny` and `$destinyName` without normalizing the resulting path.… - CVE-2026-45579 - DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
CVE-2026-45579Critical
Summary An remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input that allows any authenticated user to run… - CVE-2026-61667 - DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eva
CVE-2026-61667Critical
Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which…
High (34 条)
- CVE-2026-50158 - yutu: Arbitrary File Write via MCP `caption-download` Tool
CVE-2026-50158High 7.7
## Arbitrary File Write via MCP `caption-download` Tool Summary The `caption-download` MCP tool in yutu passes the caller-supplied `file` parameter directly to… - GHSA-xf7x-x43h-rpqh - json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS High 7.5
## Circular JSON Schema `$ref` causes unbounded CPU DoS in `json_repair` Summary `SchemaRepairer.resolve_schema()` in `json_repair` follows JSON Schema `$ref`… - CVE-2026-54629 - Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in
CVE-2026-54629High 3.1
## Summary Anyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`,… - CVE-2026-54446 - NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTT
CVE-2026-54446High 3.1
## Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When `netlicensing-mcp` is run in HTTP transport mode, the `ApiKeyMiddleware`… - CVE-2026-52827 - Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, b
CVE-2026-52827High
Summary Two-factor authentication (TOTP) can be fully bypassed for the REST API. The `KIMAI_SESSION` cookie returned in the response to the login request;… - CVE-2026-44300 - OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
CVE-2026-44300High
## Summary OpenCost contains an unauthenticated file write vulnerability in the `/serviceKey` endpoint that allows remote attackers to overwrite the GCP… - CVE-2026-45693 - FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads
CVE-2026-45693High
Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem… - CVE-2026-45263 - FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv
CVE-2026-45263High
## Summary > **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A low-privilege user (`lowpriv`) created a customer… - CVE-2026-50013 - Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
CVE-2026-50013High
Summary: When Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When… - CVE-2026-50125 - MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Cau
CVE-2026-50125High
## Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion Summary The MKP (Model Context Protocol for Kubernetes)… - CVE-2026-50131 - Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePubl
CVE-2026-50131High
Summary Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media…
+PoC-in-GitHu - CVE-2026-50141 - Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonati
CVE-2026-50141High
Impact A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged… - GHSA-pqg7-v6wh-3pfp - TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied request High
## Description The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For (or X-Real-IP) header from incoming requests before calling… - CVE-2026-54087 - EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in
CVE-2026-54087High
EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s… - CVE-2026-54448 - Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
CVE-2026-54448High
## Summary When Trivy scans a Helm chart archive (`.tgz`), its custom tar unpacker reads each entry with `io.ReadAll(tr)` and no size limit. An attacker who… - GHSA-mqxv-9rm6-w8qc - Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification vi
CVE-2022-32149High
Summary Ech0's i18n middleware runs on every HTTP request and constructs a fresh `*goi18n.Localizer` from the raw `Accept-Language` header without imposing any… - CVE-2026-54628 - Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Tab
CVE-2026-54628High
## Summary Anyquery's `server` mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules (e.g., `json_reader`,… - CVE-2026-53604 - nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
CVE-2026-53604High
## Impact The web handler `renderMobileBundle` (`internal/web/handlers.go:1325`) passes the real `*pki.CAResolver` directly into `mobilebundle.Build`. Inside… - CVE-2026-44891 - Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
CVE-2026-44891High
Summary The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an… - CVE-2026-53603 - nebula-mesh: Operator session tokens stored in plaintext in the database
CVE-2026-53603High
## Impact Operator session tokens are stored in plaintext in the `operator_sessions` table (the `token` column is the PRIMARY KEY). The session token is a… - CVE-2026-61699 - nebula-mesh: Certificate revocation is never enforced at the mesh
CVE-2026-61699High
Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll.… - GHSA-7rx3-5wx3-5v76 - Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `a High
Summary Non-admin operators (role `user`) can set `allow_private: true` on their own managed webhook subscription (`POST`/`PATCH… - CVE-2026-61549 - Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kube
CVE-2026-61549High
Impact A privilege escalation vulnerability affects Woodpecker instances using the **Kubernetes backend**. The pipeline option… - CVE-2026-45378 - Decidim: Verification documents can be downloaded through reusable links
CVE-2026-45378High
## Description Scanned identity-document images provided by participants and shown in the verification admin workflow are exposed through signed… - CVE-2026-45414 - Decidim: JWT-backed authentication can be replayed across organizations
CVE-2026-45414High
## Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL `participantDetails` field for an Org 2… - CVE-2026-48118 - NukeViet: Unauthenticated Reflected XSS in Comment Module
CVE-2026-48118High
## Summary Reflected XSS in the Comment module via the `status_comment` URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript… - CVE-2026-49259 - NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-si
CVE-2026-49259High
## Summary A stored cross-site scripting (XSS) vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store… - CVE-2026-54064 - NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
CVE-2026-54064High
## Summary Two filter-bypass techniques in `NukeViet\Core\Request::filterAttr()` and `NukeViet\Core\Request::unhtmlentities()` allow a low-privileged user (any… - CVE-2026-54065 - NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
CVE-2026-54065High
## Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the… - CVE-2026-55372 - NukeViet: Pre-authentication SSRF via X-Forwarded-Host
CVE-2026-55372High
## Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by spoofing the `X Forwarded-Host` (and… - CVE-2026-59954 - Apollo ConfigService access key authentication bypass via appId parsing and non
CVE-2026-59954High
Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key authentication is enabled and ConfigService… - CVE-2026-59955 - Apollo ConfigService access key authentication bypass via raw config file appId
CVE-2026-59955High
Summary Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because… - CVE-2026-61668 - DIRAC: Pilot code downloaded over unverified HTTPS connection
CVE-2026-61668High
Summary The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the… - GHSA-7xw9-549r-8jrc - DIRAC: SQL injection and lack of access control in PilotManager service High
Details A number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the…
Medium (26 条)
- CVE-2026-52822 - Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Times
CVE-2026-52822Medium
Summary Kimai 2.56.0 contains an authenticated authorization bypass in the timesheet `restart` and `duplicate` workflows. After a user loses access to a… - CVE-2026-52823 - Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unautho
CVE-2026-52823Medium
Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API endpoints. The application reuses the… - CVE-2026-52825 - Kimai has Improper Authorization in Team Member and Team Activity Assignment API
CVE-2026-52825Medium
Summary Kimai contains an authenticated improper authorization vulnerability in Team-related assignment APIs. A Teamlead who can edit their own team can use… - CVE-2026-52826 - Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpo
CVE-2026-52826Medium
Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows for projects, customers, and activities. A… - CVE-2026-52828 - Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAML
CVE-2026-52828Medium
Summary The `ExportController` web routes for creating and editing export templates are gated only by the class-level `create_export` permission, which is… - CVE-2026-54250 - K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
CVE-2026-54250Medium
#### Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously… - CVE-2026-50018 - Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
CVE-2026-50018Medium
Summary: Remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow… - CVE-2026-50157 - Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
CVE-2026-50157Medium
Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer…
…另有 18 条 Medium 级漏洞（已省略）
Low (3 条)
- CVE-2026-45710 - FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via
CVE-2026-45710Low
## Summary `WidgetVariante::renderVariantList` (`Core/Lib/Widget/WidgetVariante.php:298-330`) and `WidgetSubcuenta::renderSubaccountList`… - CVE-2025-61670 - Wasmtime: Memory leak in C API with `externref` and `anyref` types
CVE-2025-61670Low
Impact Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by… - CVE-2026-54335 - Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
CVE-2026-54335Low
Impact The `_.merge(target, source)` utility exported by `@feathersjs/commons` recursively merges `source` into `target` by iterating `Object.keys(source)`.…
🛡️ NVD-Latest（57 条）
Critical (8 条)
- CVE-2026-4769 Certain devices in the WAGO System I/O Field series activate an internal diagnos
CVE-2026-4769Critical 9.8
CVE-2026-4769 CVSS:9.8 Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This…
+GitHub-Advis - CVE-2026-15511 A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected
CVE-2026-15511Critical 9.8
CVE-2026-15511 CVSS:9.8 A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function… - CVE-2026-56271 Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded
CVE-2026-56271Critical 9.8
CVE-2026-56271 CVSS:9.8 Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and… - CVE-2026-14453 This vulnerability is a critical Server-Side Template Injection (SSTI) in Centre
CVE-2026-14453Critical 9.6
CVE-2026-14453 CVSS:9.6 This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-tickets module that leads to Remote… - CVE-2026-41041 URL path injection via unencoded user-supplied identifiers vulnerability in Apac
CVE-2026-41041Critical 9.1
CVE-2026-41041 CVSS:9.1 URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from… - CVE-2026-57830 The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrar
CVE-2026-57830Critical 9.1
CVE-2026-57830 CVSS:9.1 The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion. 产品: ollyo helix_ultimate
+PoC-in-GitHu - CVE-2026-11964 The User Registration & Membership WordPress plugin before 5.2.2 does not verif
CVE-2026-11964Critical 9.1
CVE-2026-11964 CVSS:9.1 The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook… - CVE-2026-56260 Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Dock
CVE-2026-56260Critical 9.1
CVE-2026-56260 CVSS:9.1 Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The…
High (49 条)
- CVE-2026-57386 Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allo
CVE-2026-57386High 8.8
CVE-2026-57386 CVSS:8.8 Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks:… - CVE-2026-57371 Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-ba
CVE-2026-57371High 8.8
CVE-2026-57371 CVSS:8.8 Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM… - CVE-2026-15548 A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. Thi
CVE-2026-15548High 8.8
CVE-2026-15548 CVSS:8.8 A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the… - CVE-2026-15545 A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by thi
CVE-2026-15545High 8.8
CVE-2026-15545 CVSS:8.8 A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of the file… - CVE-2026-15544 A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the
CVE-2026-15544High 8.8
CVE-2026-15544 CVSS:8.8 A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file… - CVE-2026-15543 A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formC
CVE-2026-15543High 8.8
CVE-2026-15543 CVSS:8.8 A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertListInfo. The… - CVE-2026-61876 LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in
CVE-2026-61876High 8.8
CVE-2026-61876 CVSS:8.8 LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to… - CVE-2026-61875 luci-app-upnp contains a stored cross-site scripting vulnerability that allows u
CVE-2026-61875High 8.8
CVE-2026-61875 CVSS:8.8 luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via… - CVE-2026-59260 OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd,
CVE-2026-59260High 8.8
CVE-2026-59260 CVSS:8.8 OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the… - CVE-2026-12582 The Library Management System WordPress plugin before 3.5.8 does not sanitize an
CVE-2026-12582High 8.6
CVE-2026-12582 CVSS:8.6 The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a… - CVE-2026-57385 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2026-57385High 8.5
CVE-2026-57385 CVSS:8.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite… - CVE-2026-58596 Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unaut
CVE-2026-58596High 8.3
CVE-2026-58596 CVSS:8.3 Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.… - CVE-2026-56241 Capgo before 12.128.2 contains a privilege escalation vulnerability where demote
CVE-2026-56241High 8.3
CVE-2026-56241 CVSS:8.3 Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to… - CVE-2026-56259 Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Do
CVE-2026-56259High 8.2
CVE-2026-56259 CVSS:8.2 Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM… - CVE-2026-11963 The User Registration & Membership WordPress plugin before 5.2.2 does not perfo
CVE-2026-11963High 8.1
CVE-2026-11963 CVSS:8.1 The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade… - CVE-2026-10666 parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for string
CVE-2026-10666High 8.1
CVE-2026-10666 CVSS:8.1 parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring… - CVE-2026-56313 Capgo before 12.128.2 contains a cross-organization account disruption vulnerabi
CVE-2026-56313High 8.1
CVE-2026-56313 CVSS:8.1 Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise… - CVE-2026-9492 The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC)
CVE-2026-9492High 7.8
CVE-2026-9492 CVSS:7.8 The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access… - CVE-2026-7162 Successful exploitation of the integer overflow vulnerability could allow an att
CVE-2026-7162High 7.8
CVE-2026-7162 CVSS:7.8 Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected… - CVE-2026-15506 A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3.
CVE-2026-15506High 7.8
CVE-2026-15506 CVSS:7.8 A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the… - CVE-2026-10667 Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly
CVE-2026-10667High 7.8
CVE-2026-10667 CVSS:7.8 Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list… - CVE-2026-57378 Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms
CVE-2026-57378High 7.5
CVE-2026-57378 CVSS:7.5 Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control… - CVE-2026-15574 A flaw was found in the vllm-orchestrator-gateway component. The system's produc
CVE-2026-15574High 7.5
CVE-2026-15574 CVSS:7.5 A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and… - CVE-2026-14165 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule
CVE-2026-14165High 7.5
CVE-2026-14165 CVSS:7.5 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could… - CVE-2026-56238 Capgo before 12.128.2 contains an information disclosure vulnerability in the Su
CVE-2026-56238High 7.5
CVE-2026-56238 CVSS:7.5 Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows… - CVE-2026-10665 In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_mess
CVE-2026-10665High 7.4
CVE-2026-10665 CVSS:7.4 In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound… - CVE-2026-15557 A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this
CVE-2026-15557High 7.3
CVE-2026-15557 CVSS:7.3 A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function… - CVE-2026-15542 A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an
CVE-2026-15542High 7.3
CVE-2026-15542 CVSS:7.3 A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the… - CVE-2026-15541 A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is
CVE-2026-15541High 7.3
CVE-2026-15541 CVSS:7.3 A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file… - CVE-2026-15537 A security flaw has been discovered in SourceCodester Online Book Store System 1
CVE-2026-15537High 7.3
CVE-2026-15537 CVSS:7.3 A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file… - CVE-2026-15517 A flaw has been found in Jinher OA 1.0. The affected element is an unknown funct
CVE-2026-15517High 7.3
CVE-2026-15517 CVSS:7.3 A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file… - CVE-2026-15514 A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This
CVE-2026-15514High 7.3
CVE-2026-15514 CVSS:7.3 A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of… - CVE-2026-56308 Capgo before 12.128.2 allows email address changes without requiring current pas
CVE-2026-56308High 7.3
CVE-2026-56308 CVSS:7.3 Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing… - CVE-2026-15498 A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b6
CVE-2026-15498High 7.3
CVE-2026-15498 CVSS:7.3 A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown… - CVE-2026-15497 A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This af
CVE-2026-15497High 7.3
CVE-2026-15497 CVSS:7.3 A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file… - CVE-2026-57372 Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-b
CVE-2026-57372High 7.2
CVE-2026-57372 CVSS:7.2 Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.This issue… - CVE-2026-57388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57388High 7.1
CVE-2026-57388 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking… - CVE-2026-57387 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57387High 7.1
CVE-2026-57387 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored… - CVE-2026-57383 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57383High 7.1
CVE-2026-57383 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch… - CVE-2026-57382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57382High 7.1
CVE-2026-57382 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List… - CVE-2026-57381 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57381High 7.1
CVE-2026-57381 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive… - CVE-2026-57380 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57380High 7.1
CVE-2026-57380 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map… - CVE-2026-57379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57379High 7.1
CVE-2026-57379 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat… - CVE-2026-57376 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57376High 7.1
CVE-2026-57376 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader… - CVE-2026-57369 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57369High 7.1
CVE-2026-57369 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder… - CVE-2026-57368 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57368High 7.1
CVE-2026-57368 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster… - CVE-2026-57363 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57363High 7.1
CVE-2026-57363 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot… - CVE-2026-12275 The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki p
CVE-2026-12275High 7.1
CVE-2026-12275 CVSS:7.1 The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment,… - CVE-2026-15515 A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301.
CVE-2026-15515High 7.0
CVE-2026-15515 CVSS:7.0 A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the…
⚔️ Sploitus（66 条）
Unknown (66 条)
- Exploit for CVE-2026-50338 exploit
CVE-2026-50338
Exploit for CVE-2026-50338 exploit - trinity-2.0-lpe exploit
trinity-2.0-lpe exploit
…另有 64 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-15 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV