📊 2026-07-16 漏洞情报日报 · 200 条 · 高危 103
每日漏洞情报汇总 · 2026-07-16
📊 2026-07-16 漏洞情报日报
📋 共 200 条
🔥 高危/严重 103 条
🚨 CISA-KEV 2 条
🐙 GitHub-Advisory 88 条 🔥53
🛡️ NVD-Latest 50 条 🔥50
⚔️ Sploitus 60 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-62422 (YouTrack, CVSS 10.0)：JetBrains YouTrack 存在认证绕过漏洞，攻击者通过直接数据库访问即可获取管理员权限。影响范围广，危害评级最高。
- CVE-2026-56451 (Opcenter X, CVSS 10.0)：西门子 Opcenter X 未正确验证 JWT 算法，未认证远程攻击者可构造恶意令牌绕过认证，直接接管系统。
- CVE-2026-47156 (MantisBT)：MantisBT SOAP API 存在认证绕过，知晓任意有效 cookie_string 的攻击者可冒充任意用户（包括管理员），实现权限提升。
- CVE-2026-52824 (Kimai Docker)：Kimai 官方 Docker 镜像存在硬编码默认 APP_SECRET，导致 Cookie 可伪造，攻击者可远程劫持任意用户会话。
- CVE-2026-62392 / CVE-2026-62390 (Apache Kylin, CVSS 9.8)：Apache Kylin 存在 OS 命令注入与 SQL 注入漏洞，利用后端 API 即可实现远程代码执行或数据泄漏。
📈 威胁趋势
- 权限提升与认证绕过：今日最突出的威胁，涉及 YouTrack、MantisBT、Opcenter X、Kimai 等多个产品，攻击者可未经授权获取管理员权限。
- 注入类攻击 (SQLi / 命令注入)：Apache Kylin 曝出 OS 命令注入与 SQL 注入漏洞；FacturaScripts 存在认证后的 SQL 注入；DBI::SQL::Nano 存在逻辑错误。
- 跨站脚本 (XSS)：MantisBT 安装脚本存在多个未认证的反射型 XSS 漏洞，利用门槛极低，但受 CSP 限制。
- 文件操作与远程代码执行：Anyquery 的服务器模式允许未认证攻击者通过 ATTACH DATABASE 写入恶意文件；WordPress 插件存在任意文件删除漏洞。
- 逻辑缺陷与数据泄露：n8n-MCP 跨租户访问备份数据；Apache Doris REST API 未授权访问；WebSocket-driver 存在消息损坏风险。
🛡️ 缓解建议
- 立即升级受影响产品：优先处理 CVSS 10.0 漏洞，请升级 JetBrains YouTrack 至 2026.1.13757 或更高版本；升级西门子 Opcenter X 至 V2604；升级 MantisBT、Apache Kylin 至最新修复版。
- 修补配置与部署缺陷：针对 Kimai Docker 镜像，立即替换默认 APP_SECRET 为强随机字符串；检查 Anyquery 服务器端口是否对外暴露，禁用 ATTACH DATABASE 等危险 SQL 命令。
- 强化访问控制与监控：限制对 MantisBT SOAP API 及 Apache Doris FE HTTP API 的访问源；审查 n8n-MCP 多租户隔离策略；为 WordPress 插件启用最小权限原则。
- 启用 Web 应用防火墙与 CSP：针对 MantisBT 的 XSS 漏洞，在升级前可配置严格的内容安全策略（CSP）；对 Web 应用部署 WAF 以拦截注入类攻击。
🚨 CISA-KEV（2 条）
Unknown (2 条)
- CVE-2023-4346 - KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
CVE-2023-4346
CVE-2023-4346 KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability 产品: KNX Association KNX… - CVE-2026-46817 - Oracle E-Business Suite Improper Privilege Management Vulnerability
CVE-2026-46817
CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability 产品: Oracle E-Business Suite 描述: Oracle E-Business Suite contains an improper…
🐙 GitHub-Advisory（88 条）
Critical (10 条)
- CVE-2026-47156 - MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administra
CVE-2026-47156Critical
MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string… - CVE-2026-52847 - MantisBT: Reflected XSS in admin/install.php
CVE-2026-52847Critical
MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping… - CVE-2026-52881 - MantisBT: Reflected XSS in admin/install.php via unescaped printf
CVE-2026-52881Critical
MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping… - CVE-2026-54466 - websocket-driver: Message corruption via abuse of protocol length headers
CVE-2026-54466Critical
Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a… - CVE-2026-52824 - Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Tak
CVE-2026-52824Critical
Summary The official Kimai Docker image ships with `APP_SECRET=change_this_to_something_unique` as the default environment variable. The Docker entrypoint does… - CVE-2026-45262 - FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filte
CVE-2026-45262Critical
## Summary > **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A scoped `ApiKey` with `fullaccess=0` and an… - CVE-2026-50006 - Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (
CVE-2026-50006Critical
## Summary Anyquery's `server` mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the… - CVE-2026-54052 - n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP de
CVE-2026-54052Critical
## Impact In multi-tenant HTTP deployments — where a single n8n-mcp server serves several tenants — the locally stored workflow version history (the automatic… - GHSA-9hc2-hjx8-q6pv - TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Critical
## Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a single Git repository import. The… - GHSA-hgjx-r89m-m7v4 - FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName Critical
## Summary `FacturaScripts\Core\UploadedFile::move($destiny, $destinyName)` concatenates `$destiny` and `$destinyName` without normalizing the resulting path.…
High (43 条)
- CVE-2026-50158 - yutu: Arbitrary File Write via MCP `caption-download` Tool
CVE-2026-50158High 7.7
## Arbitrary File Write via MCP `caption-download` Tool Summary The `caption-download` MCP tool in yutu passes the caller-supplied `file` parameter directly to… - GHSA-r3hx-x5rh-p9vv - django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Dese High 3.1
## Remote Code Execution via `eval()` in Elasticsearch Result Deserialization Summary The Elasticsearch backend in django-haystack calls `eval()` on raw field… - CVE-2026-50285 - Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Cal
CVE-2026-50285High 3.1
## Summary The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using… - CVE-2026-54629 - Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in
CVE-2026-54629High 3.1
## Summary Anyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`,… - CVE-2026-54446 - NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTT
CVE-2026-54446High 3.1
## Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When `netlicensing-mcp` is run in HTTP transport mode, the `ApiKeyMiddleware`… - CVE-2026-47142 - MantisBT: SQL Injection via history_order Configuration Value
CVE-2026-47142High
MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated… - CVE-2026-49273 - MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php
CVE-2026-49273High
MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature (adm_config_set.php). When setting a… - CVE-2026-54493 - Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
CVE-2026-54493High
Summary Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An… - CVE-2026-54447 - garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store
CVE-2026-54447High
## Insecure Permission Assignment for Garmin OAuth Token Store Summary `garminconnect` (≤ 0.3.4) wrote its OAuth token store to disk without restricting… - CVE-2026-54449 - LangBot: Authenticated RCE Via MCP Configuration
CVE-2026-54449High
Summary Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO"… - CVE-2026-54451 - Protobuf: Unbounded recursion depth in embedded-message decoding
CVE-2026-54451High
Summary Unbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `>= 0.8.0, < 0.16.1`) lets an unauthenticated attacker crash any… - CVE-2026-54491 - Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch
CVE-2026-54491High
Summary The fix for **CVE-2026-47260** (v9.3.5) added an **initial** `isSafeUrl()` check to several fetchers (`synchronizeEpisodes`, `getStreamableUrl`,… - CVE-2026-62944 - MantisBT: Stored XSS in print_all_bug_page_word.php
CVE-2026-62944High
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an… - GHSA-62gx-5q78-wrvx - obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /va High
Summary The Local REST API's `/vault/{path}` endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path *inside the handler — after* Express has… - CVE-2026-54457 - TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endp
CVE-2026-54457High
Impact The `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero… - CVE-2026-54498 - ViewComponent: around_render HTML-Safety Bypass
CVE-2026-54498High
## Summary `ViewComponent::Base#around_render` can return HTML-unsafe strings that bypass the escaping behavior applied to normal `#call` return values. This… - CVE-2026-50270 - dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50270High
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on… - CVE-2026-50271 - dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50271High
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on… - CVE-2026-50272 - dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50272High
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on… - CVE-2026-50273 - dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50273High
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on… - CVE-2026-50274 - dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50274High
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on… - CVE-2026-50276 - dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50276High
Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on… - CVE-2026-50289 - systeminformation: OS command injection in networkInterfaces() via interfaces(5)
CVE-2026-50289High
Summary On Linux, `systeminformation`'s `networkInterfaces()` is vulnerable to OS command injection through the Debian/Ubuntu `interfaces(5)` `source`… - CVE-2026-54504 - @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without
CVE-2026-54504High
Summary `@andrea9293/mcp-documentation-server` v1.13.0 documents that a Web UI starts automatically on port `3080`. However, the Web UI/API appears to bind to… - CVE-2026-52827 - Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, b
CVE-2026-52827High
Summary Two-factor authentication (TOTP) can be fully bypassed for the REST API. The `KIMAI_SESSION` cookie returned in the response to the login request;… - CVE-2026-44300 - OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
CVE-2026-44300High
## Summary OpenCost contains an unauthenticated file write vulnerability in the `/serviceKey` endpoint that allows remote attackers to overwrite the GCP… - CVE-2026-45693 - FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads
CVE-2026-45693High
Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem… - CVE-2026-45263 - FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv
CVE-2026-45263High
## Summary > **Live PoC verified 2026-04-30** against a stock FacturaScripts master at `127.0.0.1:8081`. A low-privilege user (`lowpriv`) created a customer… - CVE-2026-50013 - Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
CVE-2026-50013High
Summary: When Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When… - CVE-2026-50125 - MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Cau
CVE-2026-50125High
## Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion Summary The MKP (Model Context Protocol for Kubernetes)… - CVE-2026-50131 - Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePubl
CVE-2026-50131High
Summary Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media…
+PoC-in-GitHu - CVE-2026-50141 - Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonati
CVE-2026-50141High
Impact A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged… - GHSA-pqg7-v6wh-3pfp - TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied request High
## Description The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For (or X-Real-IP) header from incoming requests before calling… - CVE-2026-54087 - EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in
CVE-2026-54087High
EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s… - CVE-2026-54448 - Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
CVE-2026-54448High
## Summary When Trivy scans a Helm chart archive (`.tgz`), its custom tar unpacker reads each entry with `io.ReadAll(tr)` and no size limit. An attacker who… - GHSA-mqxv-9rm6-w8qc - Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification vi
CVE-2022-32149High
Summary Ech0's i18n middleware runs on every HTTP request and constructs a fresh `*goi18n.Localizer` from the raw `Accept-Language` header without imposing any… - CVE-2026-54628 - Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Tab
CVE-2026-54628High
## Summary Anyquery's `server` mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules (e.g., `json_reader`,… - CVE-2026-53604 - nebula-mesh: CA private key not zeroized on web mobile-bundle error paths
CVE-2026-53604High
## Impact The web handler `renderMobileBundle` (`internal/web/handlers.go:1325`) passes the real `*pki.CAResolver` directly into `mobilebundle.Build`. Inside… - CVE-2026-44891 - Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
CVE-2026-44891High
Summary The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an… - CVE-2026-53603 - nebula-mesh: Operator session tokens stored in plaintext in the database
CVE-2026-53603High
## Impact Operator session tokens are stored in plaintext in the `operator_sessions` table (the `token` column is the PRIMARY KEY). The session token is a… - CVE-2026-61699 - nebula-mesh: Certificate revocation is never enforced at the mesh
CVE-2026-61699High
Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll.… - GHSA-7rx3-5wx3-5v76 - Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `a High
Summary Non-admin operators (role `user`) can set `allow_private: true` on their own managed webhook subscription (`POST`/`PATCH… - CVE-2026-61549 - Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kube
CVE-2026-61549High
Impact A privilege escalation vulnerability affects Woodpecker instances using the **Kubernetes backend**. The pipeline option…
Medium (30 条)
- CVE-2026-54497 - ViewComponent: Reused Component Instances Retain Stale Render Context
CVE-2026-54497Medium 8.2
# Reused Component Instances Retain Stale Render Context ## Summary `ViewComponent::Base` instances retain multiple render-scoped objects across calls to… - CVE-2026-50552 - Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missin
CVE-2026-50552Medium 3.1
Summary Koel v9.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url… - CVE-2026-49280 - MantisBT: REST API unauthorized Issue status change
CVE-2026-49280Medium
A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the *$g_set_status_threshold*… - CVE-2026-54492 - Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
CVE-2026-54492Medium
Summary Koel `v9.6.0` protects the regular podcast subscription API with `SafeUrl`, but the Subsonic-compatible `createPodcastChannel.view` route does not… - GHSA-8q6q-m837-fv64 - Koel has SSRF through Authenticated Subsonic podcast feed URLs Medium
## Summary Koel's Subsonic `createPodcastChannel.view` endpoint accepts a user supplied podcast feed URL and fetches it server-side before applying the safe… - CVE-2026-54494 - Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard
CVE-2026-54494Medium
## Summary Koel's outbound-URL guard `App\Helpers\Network::isPublicHost()` classifies an IP as "public" using PHP's `filter_var($ip, FILTER_VALIDATE_IP,… - CVE-2026-52882 - MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions Fro
CVE-2026-52882Medium
Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions. Patches -… - CVE-2026-52883 - MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
CVE-2026-52883Medium
Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied…
…另有 22 条 Medium 级漏洞（已省略）
Low (5 条)
- CVE-2026-54450 - ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), al
CVE-2026-54450Low
## Summary ToolHive's hand-rolled private/reserved-IP SSRF guard (`networking.IsPrivateIP` in `pkg/networking/utilities.go`) does not recognize the IPv6… - CVE-2026-58196 - ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasse
CVE-2026-58196Low
# Security Advisory: SSRF in remote MCP server authentication discovery **Severity:** High. **CWE:** CWE-918. **Affected:** ToolHive through the latest release… - CVE-2026-45710 - FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via
CVE-2026-45710Low
## Summary `WidgetVariante::renderVariantList` (`Core/Lib/Widget/WidgetVariante.php:298-330`) and `WidgetSubcuenta::renderSubaccountList`…
…另有 2 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（50 条）
Critical (14 条)
- CVE-2026-62422 In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.
CVE-2026-62422Critical 10.0
CVE-2026-62422 CVSS:10.0 In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication… - CVE-2026-56451 A vulnerability has been identified in Opcenter X (All versions < V2604). Affect
CVE-2026-56451Critical 10.0
CVE-2026-56451 CVSS:10.0 A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm… - CVE-2026-44747 SAP NetWeaver Application Server ABAP allows an authenticated attacker to levera
CVE-2026-44747Critical 9.9
CVE-2026-44747 CVSS:9.9 SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a… - CVE-2026-62392 Improper Neutralization of Special Elements used in an OS Command ('OS Command I
CVE-2026-62392Critical 9.8
CVE-2026-62392 CVSS:9.8 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API… - CVE-2026-62390 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2026-62390Critical 9.8
CVE-2026-62390 CVSS:9.8 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API… - CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >=
CVE-2026-15043Critical 9.8
CVE-2026-15043 CVSS:9.8 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in… - CVE-2026-11563 The Word Count and Social Shares WordPress plugin through 1.0 does not validate
CVE-2026-11563Critical 9.6
CVE-2026-11563 CVSS:9.6 The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it… - CVE-2026-58319 Certain Apache Doris FE HTTP REST administrative APIs were accessible without pr
CVE-2026-58319Critical 9.1
CVE-2026-58319 CVSS:9.1 Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with… - CVE-2026-3014 Milestone has released a new version of XProtect® (and several cumulative patch
CVE-2026-3014Critical 9.1
CVE-2026-3014 CVSS:9.1 Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management… - CVE-2026-59084 Insufficient Technical Documentation vulnerability in Apache Tomcat since the re
CVE-2026-59084Critical 9.1
CVE-2026-59084 CVSS:9.1 Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor… - CVE-2026-59083 Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat'
CVE-2026-59083Critical 9.1
CVE-2026-59083 CVSS:9.1 Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for… - CVE-2026-44761 SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented
CVE-2026-44761Critical 9.1
CVE-2026-44761 CVSS:9.1 SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample… - CVE-2026-27690 Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthentica
CVE-2026-27690Critical 9.1
CVE-2026-27690 CVSS:9.1 Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP… - CVE-2026-57898 In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone
CVE-2026-57898Critical 9.0
CVE-2026-57898 CVSS:9.0 In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are…
High (36 条)
- CVE-2026-15416 A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift Gi
CVE-2026-15416High 8.9
CVE-2026-15416 CVSS:8.9 A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with… - CVE-2026-15693 A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This i
CVE-2026-15693High 8.8
CVE-2026-15693 CVSS:8.8 A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file… - CVE-2026-15692 A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability
CVE-2026-15692High 8.8
CVE-2026-15692 CVSS:8.8 A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file… - CVE-2026-15691 A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects
CVE-2026-15691High 8.8
CVE-2026-15691 CVSS:8.8 A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file… - CVE-2026-57386 Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allo
CVE-2026-57386High 8.8
CVE-2026-57386 CVSS:8.8 Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This issue affects aBlocks:… - CVE-2026-57385 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2026-57385High 8.5
CVE-2026-57385 CVSS:8.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite… - CVE-2026-0487 SAProuter on Microsoft Windows allows an unauthenticated attacker to load librar
CVE-2026-0487High 8.4
CVE-2026-0487 CVSS:8.4 SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them… - CVE-2026-10672 subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI
CVE-2026-10672High 8.2
CVE-2026-10672 CVSS:8.2 subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size… - CVE-2026-44752 SAP NetWeaver Application Server Java allows an unauthenticated attacker to inje
CVE-2026-44752High 8.2
CVE-2026-44752 CVSS:8.2 SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a… - CVE-2026-12583 The Newsletters WordPress plugin before 4.15 does not prevent deserialization of
CVE-2026-12583High 8.1
CVE-2026-12583 CVSS:8.1 The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form,… - CVE-2026-12511 The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied f
CVE-2026-12511High 8.1
CVE-2026-12511 CVSS:8.1 The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file,… - CVE-2026-44745 SAP Approuter does not properly validate incoming request headers during the OAu
CVE-2026-44745High 8.1
CVE-2026-44745 CVSS:8.1 SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This… - CVE-2026-10669 On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_va
CVE-2026-10669High 7.8
CVE-2026-10669 CVSS:7.8 On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture… - CVE-2026-58233 SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated
CVE-2026-58233High 7.6
CVE-2026-58233 CVSS:7.6 SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file… - CVE-2026-15076 In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the
CVE-2026-15076High 7.5
CVE-2026-15076 CVSS:7.5 In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client… - CVE-2026-15075 In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.
CVE-2026-15075High 7.5
CVE-2026-15075 CVSS:7.5 In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core)… - CVE-2026-10051 In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to re
CVE-2026-10051High 7.5
CVE-2026-10051 CVSS:7.5 In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over… - CVE-2024-7708 For requests that have a body, but reading the body may end up in reading 0 byte
CVE-2024-7708High 7.5
CVE-2024-7708 CVSS:7.5 For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case… - CVE-2026-57378 Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms
CVE-2026-57378High 7.5
CVE-2026-57378 CVSS:7.5 Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control… - CVE-2026-54429 A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions)
CVE-2026-54429High 7.4
CVE-2026-54429 CVSS:7.4 A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume… - CVE-2026-8314 A security issue exists within Arena® Simulation due to a memory corruption vuln
CVE-2026-8314High 7.3
CVE-2026-8314 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The… - CVE-2026-8313 A security issue exists within Arena® Simulation due to a memory corruption vuln
CVE-2026-8313High 7.3
CVE-2026-8313 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The… - CVE-2026-8312 A security issue exists within Arena® Simulation due to a memory corruption vuln
CVE-2026-8312High 7.3
CVE-2026-8312 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The… - CVE-2026-8085 A security issue exists within Arena® Simulation due to a memory corruption vuln
CVE-2026-8085High 7.3
CVE-2026-8085 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The… - CVE-2026-15677 A weakness has been identified in code-projects Online Job Portal 1.0. This affe
CVE-2026-15677High 7.3
CVE-2026-15677 CVSS:7.3 A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file… - CVE-2026-15676 A security flaw has been discovered in code-projects Online Job Portal up to 1.0
CVE-2026-15676High 7.3
CVE-2026-15676 CVSS:7.3 A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the… - CVE-2026-15675 A vulnerability was identified in code-projects Online Job Portal 1.0. The affec
CVE-2026-15675High 7.3
CVE-2026-15675 CVSS:7.3 A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file… - CVE-2026-10671 In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_
CVE-2026-10671High 7.1
CVE-2026-10671 CVSS:7.1 In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ()… - CVE-2026-57388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57388High 7.1
CVE-2026-57388 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking… - CVE-2026-57387 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57387High 7.1
CVE-2026-57387 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored… - CVE-2026-57383 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57383High 7.1
CVE-2026-57383 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch… - CVE-2026-57382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57382High 7.1
CVE-2026-57382 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Bennis Simple File List… - CVE-2026-57381 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57381High 7.1
CVE-2026-57381 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive… - CVE-2026-57380 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57380High 7.1
CVE-2026-57380 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map… - CVE-2026-57379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57379High 7.1
CVE-2026-57379 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat… - CVE-2026-57376 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
CVE-2026-57376High 7.1
CVE-2026-57376 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader…
⚔️ Sploitus（60 条）
Unknown (60 条)
- Exploit for CVE-2026-21045 exploit
CVE-2026-21045
Exploit for CVE-2026-21045 exploit - Exploit for CVE-2026-48909 exploit
CVE-2026-48909
Exploit for CVE-2026-48909 exploit
…另有 58 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-16 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV