🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-56699 (CVSS 10.0)：Wazuh Manager < 5.0.0-beta3 存在NDJSON注入漏洞。已注册的Agent可构造恶意DataValue.index字段，向OpenSearch Bulk API注入删除或写入操作，威胁日志系统完整性与可用性。
• CVE-2026-62422 (CVSS 10.0)：JetBrains YouTrack（多版本）因直接数据库访问绕过鉴权，未授权攻击者可获取管理员权限，完全接管项目管理实例。
• CVE-2026-56451 (CVSS 10.0)：Siemens Opcenter X (< V2604) JWT算法未严格校验，允许攻击者伪造任意JWT（如将RS256改为HS256），实现未授权远程管理员访问。
• CVE-2026-47156 (未评定)：MantisBT ≤ 2.28.3 SOAP API认证绕过，仅需已知任意有效cookie_string即可冒充任意用户（含管理员），可完全接管漏洞跟踪系统。
• GHSA-r3hx-x5rh-p9vv (High)：django-haystack Elasticsearch后端对SearchField字段返值直接调eval()，攻击者可注入Python代码实现远程代码执行。

📈 威胁趋势

• 认证/鉴权绕过（7起）：Envoy Gateway路径解析绕过、Pheditor硬编码密码、MantisBT SOAP API绕过及YouTrack/Opcenter JWT缺陷，是本日最集中类型，多有CVSS 9.0+评分。
• 远程代码执行（RCE）与注入（3起）：django-haystack因eval()导致RCE；Apache Kylin存在OS命令注入与SQL注入；Wazuh Manager NDJSON注入。
• 跨站脚本（XSS）（2起）：MantisBT安装页面/admin/install.php存在6处反射XSS，无需认证即可利用。
• 拒绝服务（DoS）与资源耗尽（2起）：pomerium zstd解压无边界限制；websocket-driver协议长度头处理缺陷可耗尽内存。
• 文件路径遍历（1起）：Cornac 缓存解压Tar文件时存在目录穿越，可导致任意文件写入。

🛡️ 缓解建议

• ⏫ 立即升级关键组件：优先更新Wazuh Manager至5.0.0-beta3+、JetBrains YouTrack至指定补丁版本、Siemens Opcenter X至V2604+，以及MantisBT至2.28.4+。
• 🔐 加强认证与默认凭据管控：检查所有Pheditor实例，立即更改默认硬编码密码；对Envoy Gateway部署，确认路径规范化规则已正确配置。
• 🛠 限制对外暴露面并启用WAF：对MantisBT、django-haystack等暴露面，临时禁用SOAP API或管理安装页面访问；在Web应用防火墙上对eval()及已知注入模式配置拦截规则。
• 🔍 检查历史日志中可疑活动：针对CVE-2026-56699与CVE-2026-56451等漏洞，审计OpenSearch/Kylin日志中是否存在异常NDJSON操作或恶意JWT使用痕迹，确认是否已被利用。

🚨 CISA-KEV（3 条）

Unknown (3 条)

• CVE-2026-39808 - Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-39808
  CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability 产品: Fortinet FortiSandbox 描述: Fortinet FortiSandbox contains an OS command injection…
• CVE-2026-25089 - Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-25089
  CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability 产品: Fortinet FortiSandbox 描述: Fortinet FortiSandbox, FortiSandbox Cloud, and…

…另有 1 条 Unknown 级漏洞（已省略）

🐙 GitHub-Advisory（71 条）

Critical (6 条)

• CVE-2026-53713 - Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExten CVE-2026-53713Critical
  Impact The `to_absolute_normalized_path` function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, `//etc/passwd` is…
• CVE-2026-55579 - Pheditor: Hardcoded default password 'admin' with no forced change enables full CVE-2026-55579Critical
  Summary Pheditor ships with a hardcoded default password `admin` (SHA-512 hash stored at `pheditor.php:11`). There is no mechanism to force a password change…
• CVE-2026-47156 - MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administra CVE-2026-47156Critical
  MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string…
• CVE-2026-52847 - MantisBT: Reflected XSS in admin/install.php CVE-2026-52847Critical
  MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping…
• CVE-2026-52881 - MantisBT: Reflected XSS in admin/install.php via unescaped printf CVE-2026-52881Critical
  MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping…
• CVE-2026-54466 - websocket-driver: Message corruption via abuse of protocol length headers CVE-2026-54466Critical
  Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a…

High (34 条)

• GHSA-r3hx-x5rh-p9vv - django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Dese High 3.1
  ## Remote Code Execution via `eval()` in Elasticsearch Result Deserialization Summary The Elasticsearch backend in django-haystack calls `eval()` on raw field…
• CVE-2026-50285 - Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Cal CVE-2026-50285High 3.1
  ## Summary The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using…
• CVE-2026-53714 - Envoy Gateway: xDS Control Plane Information Disclosure when operating in Gatewa CVE-2026-53714High
  Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a…
• CVE-2026-52833 - Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gr CVE-2026-52833High
  ## Summary Nuclio's Java runtime generates a `build.gradle` file during function builds using Go's `text/template` package. The template renders…
• CVE-2026-52870 - MCP Python SDK: Experimental task handlers allow any client to access and cancel CVE-2026-52870High
  Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check…
• CVE-2026-52869 - MCP Python SDK: HTTP transports serve session requests without verifying the aut CVE-2026-52869High
  Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session…
• CVE-2026-54540 - Pheditor has an authenticated terminal command whitelist bypass CVE-2026-54540High
  Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the…
• CVE-2026-54077 - ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authentic CVE-2026-54077High
  Impact The SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to the importer without validation. Any…
• CVE-2026-54076 - ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026 CVE-2026-54076High
  Impact The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an `UPDATE_SCHEMA` authorization check to a single schema-mutating method…
• CVE-2026-55578 - Pheditor: Incomplete command sanitization in terminal feature allows RCE via pip CVE-2026-55578High
  Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to `shell_exec()`. After…
• GHSA-48qw-824m-86pr - ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting l CVE-2026-44221CVE-2026-54076High
  Impact A user holding only `reader` (read-only) privileges on a single database could execute arbitrary JVM code by sending a `"language": "js"` command to the…
• CVE-2026-59950 - MCP Python SDK: WebSocket server transport does not support Host/Origin validati CVE-2026-59950High
  Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without…
• GHSA-x9f9-r4m8-9xc2 - ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command exec High
  ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.java:56); trigger creation is gated…
• GHSA-vwjc-v7x7-cm6g - ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DE High
  The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabase(UPDATE_SECURITY) gate on the polyglot engine…
• GHSA-x8mg-6r4p-87pf - ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handle High
  About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the engine…
• CVE-2026-47142 - MantisBT: SQL Injection via history_order Configuration Value CVE-2026-47142High
  MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated…
• CVE-2026-49273 - MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php CVE-2026-49273High
  MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature (adm_config_set.php). When setting a…
• CVE-2026-54493 - Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations CVE-2026-54493High
  Summary Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An…
• CVE-2026-54447 - garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store CVE-2026-54447High
  ## Insecure Permission Assignment for Garmin OAuth Token Store Summary `garminconnect` (≤ 0.3.4) wrote its OAuth token store to disk without restricting…
• CVE-2026-54449 - LangBot: Authenticated RCE Via MCP Configuration CVE-2026-54449High
  Summary Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO"…
• CVE-2026-54451 - Protobuf: Unbounded recursion depth in embedded-message decoding CVE-2026-54451High
  Summary Unbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `>= 0.8.0, < 0.16.1`) lets an unauthenticated attacker crash any…
• CVE-2026-54491 - Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch CVE-2026-54491High
  Summary The fix for **CVE-2026-47260** (v9.3.5) added an **initial** `isSafeUrl()` check to several fetchers (`synchronizeEpisodes`, `getStreamableUrl`,…
• CVE-2026-62944 - MantisBT: Stored XSS in print_all_bug_page_word.php CVE-2026-62944High
  A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an…
• GHSA-62gx-5q78-wrvx - obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /va High
  Summary The Local REST API's `/vault/{path}` endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path *inside the handler — after* Express has…
• CVE-2026-54457 - TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endp CVE-2026-54457High
  Impact The `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero…
• CVE-2026-54498 - ViewComponent: around_render HTML-Safety Bypass CVE-2026-54498High
  ## Summary `ViewComponent::Base#around_render` can return HTML-unsafe strings that bypass the escaping behavior applied to normal `#call` return values. This…
• CVE-2026-50270 - dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50270High
  Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on…
• CVE-2026-50271 - dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50271High
  Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on…
• CVE-2026-50272 - dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50272High
  Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on…
• CVE-2026-50273 - dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50273High
  Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on…
• CVE-2026-50274 - dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50274High
  Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on…
• CVE-2026-50276 - dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS CVE-2026-50276High
  Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on…
• CVE-2026-50289 - systeminformation: OS command injection in networkInterfaces() via interfaces(5) CVE-2026-50289High
  Summary On Linux, `systeminformation`'s `networkInterfaces()` is vulnerable to OS command injection through the Debian/Ubuntu `interfaces(5)` `source`…
• CVE-2026-54504 - @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without CVE-2026-54504High
  Summary `@andrea9293/mcp-documentation-server` v1.13.0 documents that a Web UI starts automatically on port `3080`. However, the Web UI/API appears to bind to…

Medium (27 条)

• CVE-2026-54497 - ViewComponent: Reused Component Instances Retain Stale Render Context CVE-2026-54497Medium 8.2
  # Reused Component Instances Retain Stale Render Context ## Summary `ViewComponent::Base` instances retain multiple render-scoped objects across calls to…
• CVE-2026-52832 - Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file wri CVE-2026-52832Medium 3.1
  ## Summary Nuclio Dashboard exposes `POST /api/functions` without authentication by default (NOP auth mode). The `spec.handler` field (e.g.,…
• CVE-2026-50552 - Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missin CVE-2026-50552Medium 3.1
  Summary Koel v9.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint (POST /api/radio/stations). The url…
• CVE-2026-50166 - kumactl connects to control plane without verifying TLS certificate when no CA i CVE-2026-50166Medium
  When an operator adds an HTTPS control plane profile to `kumactl` without providing a CA certificate, `kumactl` disables TLS verification and sends API tokens…
• CVE-2026-53718 - Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass CVE-2026-53718Medium
  Impact Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching…
• CVE-2026-53716 - Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit CVE-2026-53716Medium
  Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant can create…
• CVE-2026-53719 - Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec CVE-2026-53719Medium
  Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant has SecurityPolicy + TCPRoute…
• CVE-2026-53717 - Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untruste CVE-2026-53717Medium
  Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant can create…

…另有 19 条 Medium 级漏洞（已省略）

Low (4 条)

• CVE-2026-54541 - nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-len CVE-2026-54541Low
  Impact A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted `TrieChunk` whose proof contains two `TrieProofNode`s with…
• CVE-2026-54542 - nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child su CVE-2026-54542Low
  Impact A malicious peer acting as a state-sync source can crash a syncing node with a crafted `TrieChunk` whose proof contains a `TrieNodeChild` whose…
• CVE-2026-54450 - ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), al CVE-2026-54450Low
  ## Summary ToolHive's hand-rolled private/reserved-IP SSRF guard (`networking.IsPrivateIP` in `pkg/networking/utilities.go`) does not recognize the IPv6…

…另有 1 条 Low 级漏洞（已省略）

🛡️ NVD-Latest（66 条）

Critical (13 条)

• CVE-2026-56699 Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when CVE-2026-56699Critical 10.0
  CVE-2026-56699 CVSS:10.0 Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing…
• CVE-2026-62422 In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1. CVE-2026-62422Critical 10.0
  CVE-2026-62422 CVSS:10.0 In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication…
• CVE-2026-56451 A vulnerability has been identified in Opcenter X (All versions < V2604). Affect CVE-2026-56451Critical 10.0
  CVE-2026-56451 CVSS:10.0 A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm…
• CVE-2026-62392 Improper Neutralization of Special Elements used in an OS Command ('OS Command I CVE-2026-62392Critical 9.8
  CVE-2026-62392 CVSS:9.8 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API…
• CVE-2026-62390 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti CVE-2026-62390Critical 9.8
  CVE-2026-62390 CVSS:9.8 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API…
• CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= CVE-2026-15043Critical 9.8
  CVE-2026-15043 CVSS:9.8 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in…
• CVE-2026-61451 The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin CVE-2026-61451Critical 9.6
  CVE-2026-61451 CVSS:9.6 The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST…
• CVE-2026-43637 Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allo CVE-2026-43637Critical 9.1
  CVE-2026-43637 CVSS:9.1 Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the…
• CVE-2026-58319 Certain Apache Doris FE HTTP REST administrative APIs were accessible without pr CVE-2026-58319Critical 9.1
  CVE-2026-58319 CVSS:9.1 Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with…
• CVE-2026-3014 Milestone has released a new version of XProtect® (and several cumulative patch CVE-2026-3014Critical 9.1
  CVE-2026-3014 CVSS:9.1 Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management…
• CVE-2026-59084 Insufficient Technical Documentation vulnerability in Apache Tomcat since the re CVE-2026-59084Critical 9.1
  CVE-2026-59084 CVSS:9.1 Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor…
• CVE-2026-59083 Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat' CVE-2026-59083Critical 9.1
  CVE-2026-59083 CVSS:9.1 Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for…
• CVE-2026-57898 In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone CVE-2026-57898Critical 9.0
  CVE-2026-57898 CVSS:9.0 In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are…

High (53 条)

• CVE-2026-15416 A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift Gi CVE-2026-15416High 8.9
  CVE-2026-15416 CVSS:8.9 A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with…
• CVE-2026-61457 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file uploa CVE-2026-61457High 8.8
  CVE-2026-61457 CVSS:8.8 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller.…
• CVE-2026-58655 The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1 CVE-2026-58655High 8.8
  CVE-2026-58655 CVSS:8.8 The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection…
• CVE-2026-57996 phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/ CVE-2026-57996High 8.8
  CVE-2026-57996 CVSS:8.8 phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin…
• CVE-2026-35152 A SQL Injection vulnerability exists in Apache Fineract's Report Execution API ( CVE-2026-35152High 8.8
  CVE-2026-35152 CVSS:8.8 A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including…
• CVE-2026-15804 The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated r CVE-2026-15804High 8.8
  CVE-2026-15804 CVSS:8.8 The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific…
• CVE-2026-15693 A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This i CVE-2026-15693High 8.8
  CVE-2026-15693 CVSS:8.8 A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file…
• CVE-2026-15692 A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability CVE-2026-15692High 8.8
  CVE-2026-15692 CVSS:8.8 A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file…
• CVE-2026-15691 A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects CVE-2026-15691High 8.8
  CVE-2026-15691 CVSS:8.8 A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file…
• CVE-2026-61436 PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail web CVE-2026-61436High 8.6
  CVE-2026-61436 CVSS:8.6 PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge…
• CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote at CVE-2026-15583High 8.6
  CVE-2026-15583 CVSS:8.6 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's…
• CVE-2026-12512 The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and es CVE-2026-12512High 8.6
  CVE-2026-12512 CVSS:8.6 The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL…
• CVE-2026-61430 PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in CVE-2026-61430High 8.5
  CVE-2026-61430 CVSS:8.5 PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check…
• CVE-2026-61446 PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulne CVE-2026-61446High 8.4
  CVE-2026-61446 CVSS:8.4 PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and…
• CVE-2026-55723 When NGINX Ingress Controller is configured with Custom Resource Definitions (CR CVE-2026-55723High 8.3
  CVE-2026-55723 CVSS:8.3 When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability…
• CVE-2026-56400 open-webui before 0.3.14 contains a cross-origin resource sharing misconfigurati CVE-2026-56400High 8.3
  CVE-2026-56400 CVSS:8.3 open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and…
• CVE-2026-61435 PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent CVE-2026-61435High 8.2
  CVE-2026-61435 CVSS:8.2 PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints…
• CVE-2026-10672 subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI CVE-2026-10672High 8.2
  CVE-2026-10672 CVSS:8.2 subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size…
• CVE-2026-42533 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive CVE-2026-42533High 8.1
  CVE-2026-42533 CVSS:8.1 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references…
• CVE-2026-61873 Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plu CVE-2026-61873High 8.1
  CVE-2026-61873 CVSS:8.1 Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is…
• CVE-2026-61443 PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillT CVE-2026-61443High 8.1
  CVE-2026-61443 CVSS:8.1 PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without…
• CVE-2026-57821 A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET CVE-2026-57821High 8.1
  CVE-2026-57821 CVSS:8.1 A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including…
  +PoC-in-GitHu
• CVE-2026-56287 A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client S CVE-2026-56287High 8.1
  CVE-2026-56287 CVSS:8.1 A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and…
• CVE-2026-12281 The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP CVE-2026-12281High 8.1
  CVE-2026-12281 CVSS:8.1 The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an…
• CVE-2026-12583 The Newsletters WordPress plugin before 4.15 does not prevent deserialization of CVE-2026-12583High 8.1
  CVE-2026-12583 CVSS:8.1 The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form,…
• CVE-2026-58558 Permission control vulnerability in the file system. Impact: Successful exploita CVE-2026-58558High 7.8
  CVE-2026-58558 CVSS:7.8 Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service…
• CVE-2026-15809 A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) CVE-2026-15809High 7.8
  CVE-2026-15809 CVSS:7.8 A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker…
• CVE-2026-61433 PraisonAI before 4.6.78 fails to safely encode deployment configuration values w CVE-2026-61433High 7.8
  CVE-2026-61433 CVSS:7.8 PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers.…
• CVE-2026-40633 Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 throu CVE-2026-40633High 7.8
  CVE-2026-40633 CVSS:7.8 Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive…
• CVE-2026-42936 The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there i CVE-2026-42936High 7.8
  CVE-2026-42936 CVSS:7.8 The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the…
• CVE-2026-10669 On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_va CVE-2026-10669High 7.8
  CVE-2026-10669 CVSS:7.8 On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture…
• CVE-2026-14251 A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler do CVE-2026-14251High 7.7
  CVE-2026-14251 CVSS:7.7 A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling…
• CVE-2026-54560 Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until CVE-2026-54560High 7.6
  CVE-2026-54560 CVSS:7.6 Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued…
• CVE-2026-59762 When an HTTP/2 profile is configured on a virtual server, undisclosed requests c CVE-2026-59762High 7.5
  CVE-2026-59762 CVSS:7.5 When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.…
• CVE-2026-60085 PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in CVE-2026-60085High 7.5
  CVE-2026-60085 CVSS:7.5 PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where…
• CVE-2026-56339 Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerab CVE-2026-56339High 7.5
  CVE-2026-56339 CVSS:7.5 Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC…
• CVE-2026-15076 In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the CVE-2026-15076High 7.5
  CVE-2026-15076 CVSS:7.5 In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client…
• CVE-2026-15075 In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5. CVE-2026-15075High 7.5
  CVE-2026-15075 CVSS:7.5 In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core)…
• CVE-2026-10051 In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to re CVE-2026-10051High 7.5
  CVE-2026-10051 CVSS:7.5 In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over…
• CVE-2024-7708 For requests that have a body, but reading the body may end up in reading 0 byte CVE-2024-7708High 7.5
  CVE-2024-7708 CVSS:7.5 For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case…
• CVE-2026-54429 A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions) CVE-2026-54429High 7.4
  CVE-2026-54429 CVSS:7.4 A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume…
• CVE-2026-61438 PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWor CVE-2026-61438High 7.3
  CVE-2026-61438 CVSS:7.3 PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient…
• CVE-2026-61427 PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentica CVE-2026-61427High 7.3
  CVE-2026-61427 CVSS:7.3 PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to…
• CVE-2026-56398 Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in CVE-2026-56398High 7.3
  CVE-2026-56398 CVSS:7.3 Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim…
• CVE-2026-8314 A security issue exists within Arena® Simulation due to a memory corruption vuln CVE-2026-8314High 7.3
  CVE-2026-8314 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The…
• CVE-2026-8313 A security issue exists within Arena® Simulation due to a memory corruption vuln CVE-2026-8313High 7.3
  CVE-2026-8313 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The…
• CVE-2026-8312 A security issue exists within Arena® Simulation due to a memory corruption vuln CVE-2026-8312High 7.3
  CVE-2026-8312 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The…
• CVE-2026-8085 A security issue exists within Arena® Simulation due to a memory corruption vuln CVE-2026-8085High 7.3
  CVE-2026-8085 CVSS:7.3 A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The…
• CVE-2026-15677 A weakness has been identified in code-projects Online Job Portal 1.0. This affe CVE-2026-15677High 7.3
  CVE-2026-15677 CVSS:7.3 A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file…
• CVE-2026-15676 A security flaw has been discovered in code-projects Online Job Portal up to 1.0 CVE-2026-15676High 7.3
  CVE-2026-15676 CVSS:7.3 A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the…
• CVE-2026-15675 A vulnerability was identified in code-projects Online Job Portal 1.0. The affec CVE-2026-15675High 7.3
  CVE-2026-15675 CVSS:7.3 A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file…
• CVE-2026-54563 Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, CVE-2026-54563High 7.1
  CVE-2026-54563 CVSS:7.1 Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured…
• CVE-2026-10671 In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_ CVE-2026-10671High 7.1
  CVE-2026-10671 CVSS:7.1 In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ()…

⚔️ Sploitus（60 条）

Unknown (60 条)

• Exploit for Deserialization of Untrusted Data in Facebook React exploit
  Exploit for Deserialization of Untrusted Data in Facebook React exploit
• Exploit for CVE-2026-58457 exploit CVE-2026-58457
  Exploit for CVE-2026-58457 exploit

…另有 58 条 Unknown 级漏洞（已省略）

🤖 漏洞情报自动汇总 · 2026-07-17 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV