📊 2026-07-18 漏洞情报日报 · 200 条 · 高危 96
每日漏洞情报汇总 · 2026-07-18
📊 2026-07-18 漏洞情报日报
📋 共 200 条
🔥 高危/严重 96 条
🚨 CISA-KEV 3 条
🐙 GitHub-Advisory 52 条 🔥27
🛡️ NVD-Latest 69 条 🔥69
⚔️ Sploitus 76 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-56699 (CVSS 10.0，Wazuh Manager)： 严重级别最高。未转义字段导致NDJSON注入，已注册代理可任意删除/索引数据，直接威胁SIEM日志完整性。
- CVE-2026-45695 (CVSS 9.8，Kopia备份工具)： 无密码启动HTTP服务时，攻击者可未经认证直接访问备份仓库，导致敏感数据全量泄露。
- CVE-2026-55579 (Pheditor编辑器)： 硬编码默认密码“admin”，且存在公开PoC利用脚本，可导致未认证远程代码执行，风险扩散极快。
- CVE-2026-12492 (WooCommerce OTP插件) & CVE-2026-15013 (WordPress SAML SSO插件)： 两起高严重性认证绕过漏洞，分别通过OTP验证缺失和签名算法混淆实现，影响大量在线商店与登录集成。
- CVE-2026-22752 (Spring Authorization Server)： 影响主流身份认证框架，利用对主密钥的绕过攻击，可导致整个授权服务失陷，需紧急排查版本。
📈 威胁趋势
- 认证绕过 / 权限提升 (占比最高)： 今日捕获7起相关漏洞。除上述重点外，Envoy Gateway路径归一化缺陷、AWS-JDBC Wrapper权限提升、Shell辅助组未清除问题均属此类。攻击链条短、利用成本低。
- 远程代码执行 (RCE)： 典型代表为Pheditor硬编码密码导致RCE，以及两份2023年（CVE-2023-49900等）旧漏洞数据再次出现，说明用户修补滞后问题严重。
- 服务端请求伪造 / 注入： meta-ads-mcp SSRF允许攻击者利用`image_url`发起内网探测；Flask-Reuploaded存在扩展名黑名单绕过，威胁文件上传功能安全性。
- 拒绝服务（DoS）： vLLM项目出现2个漏洞：远程DoS（非法token注入）和ReDoS（正则编译无超时），对AI推理服务稳定性构成威胁。
🛡️ 缓解建议
- 立即更新或配置受影响产品： 升级Wazuh Manager至5.0.0-beta3或更高版本；Kopia升级至0.23.0；禁用或更改Pheditor默认口令；确保WooCommerce OTP和SAML SSO插件更新至最新。
- 开展凭证与密码审查： 针对Pheditor及所有硬编码/默认密码应用，执行全量扫描并强制修改。检查Spring Authorization Server使用的主密钥配置。
- 强化网络隔离与输入验证： 限制Kopia HTTP服务的对外暴露；对Envoy Gateway及meta-ads-mcp中的路径/URL参数实施严格的规范化校验。为所有正则编译操作添加超时机制。
- 资产盘点与补丁回溯： 确认是否仍使用存在CVE-2023-49899/CVE-2023-49900的旧版资产，立即下线或打补丁，避免因旧漏洞被批量扫描利用。
🚨 CISA-KEV（3 条）
Unknown (3 条)
- CVE-2026-39808 - Fortinet FortiSandbox OS Command Injection Vulnerability
CVE-2026-39808
CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability 产品: Fortinet FortiSandbox 描述: Fortinet FortiSandbox contains an OS command injection… - CVE-2026-25089 - Fortinet FortiSandbox OS Command Injection Vulnerability
CVE-2026-25089
CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability 产品: Fortinet FortiSandbox 描述: Fortinet FortiSandbox, FortiSandbox Cloud, and…
…另有 1 条 Unknown 级漏洞（已省略）
🐙 GitHub-Advisory（52 条）
Critical (2 条)
- CVE-2026-53713 - Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExten
CVE-2026-53713Critical
Impact The `to_absolute_normalized_path` function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, `//etc/passwd` is… - CVE-2026-55579 - Pheditor: Hardcoded default password 'admin' with no forced change enables full
CVE-2026-55579Critical
Summary Pheditor ships with a hardcoded default password `admin` (SHA-512 hash stored at `pheditor.php:11`). There is no mechanism to force a password change…
+PoC-in-GitHu
High (25 条)
- CVE-2026-54549 - meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrest
CVE-2026-54549High 3.1
## Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch Summary The `upload_ad_image` MCP tool in `meta-ads-mcp` v1.0.113… - CVE-2026-54567 - Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-o
CVE-2026-54567High 3.1
## 1. Header | Field | Value | |---|---| | **Title** | Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of… - CVE-2026-54234 - vLLM has Remote DoS via Invalid Recovered Token Reinjection
CVE-2026-54234High
## Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to `vocab_size`, convert that… - CVE-2026-55574 - vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar an
CVE-2026-55574High
## Summary The `structured_outputs.regex` API parameter passes a user-supplied regex string directly to grammar compiler backends with no compilation timeout.… - CVE-2026-11400 - AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
CVE-2026-11400High
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identified CVE-2026-11400, an issue in Aurora… - CVE-2026-54552 - sh _uid does not drop supplementary groups (incomplete privilege drop)
CVE-2026-54552High
Impact The `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems. When `sh` was run from a process with elevated privileges, such as… - CVE-2026-54547 - meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
CVE-2026-54547High
## X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary `AuthInjectionMiddleware` in `meta-ads-mcp` rejects HTTP MCP requests only when… - CVE-2026-27771 - Gitea has insufficient permission checks for Composer package source links
CVE-2026-27771High
CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or…
+PoC-in-GitHu - CVE-2026-53598 - Prompty: Arbitrary file read via file reference expansion
CVE-2026-53598High
## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized…
+NVD-Latest - CVE-2026-53597 - Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loade
CVE-2026-53597High
## Summary The TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-matter` supports JavaScript frontmatter… - CVE-2026-55177 - CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlle
CVE-2026-55177High
# Authenticated full-read SSRF in CloudTAK `/api/esri*` routes — user-controlled URL fetched with no IP-classification guard ## Summary Every route in the ESRI… - GHSA-8qqm-fp2q-v734 - Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA den
CVE-2026-50197High
Summary A wrong policy can be an open door. You have to check `input.attributes.request.http.truncated_body` in your policy. Description Incomplete fix for… - CVE-2026-53714 - Envoy Gateway: xDS Control Plane Information Disclosure when operating in Gatewa
CVE-2026-53714High
Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a… - CVE-2026-52833 - Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gr
CVE-2026-52833High
## Summary Nuclio's Java runtime generates a `build.gradle` file during function builds using Go's `text/template` package. The template renders… - CVE-2026-52870 - MCP Python SDK: Experimental task handlers allow any client to access and cancel
CVE-2026-52870High
Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check… - CVE-2026-52869 - MCP Python SDK: HTTP transports serve session requests without verifying the aut
CVE-2026-52869High
Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session… - CVE-2026-54540 - Pheditor has an authenticated terminal command whitelist bypass
CVE-2026-54540High
Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the… - CVE-2026-54077 - ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authentic
CVE-2026-54077High
Impact The SQL `IMPORT DATABASE` statement did not require administrative privileges and passed its source URL to the importer without validation. Any… - CVE-2026-54076 - ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026
CVE-2026-54076High
Impact The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an `UPDATE_SCHEMA` authorization check to a single schema-mutating method… - CVE-2026-55578 - Pheditor: Incomplete command sanitization in terminal feature allows RCE via pip
CVE-2026-55578High
Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to `shell_exec()`. After… - GHSA-48qw-824m-86pr - ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting l
CVE-2026-44221CVE-2026-54076High
Impact A user holding only `reader` (read-only) privileges on a single database could execute arbitrary JVM code by sending a `"language": "js"` command to the… - CVE-2026-59950 - MCP Python SDK: WebSocket server transport does not support Host/Origin validati
CVE-2026-59950High
Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without… - GHSA-x9f9-r4m8-9xc2 - ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command exec High
ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.java:56); trigger creation is gated… - GHSA-vwjc-v7x7-cm6g - ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DE High
The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabase(UPDATE_SECURITY) gate on the polyglot engine… - GHSA-x8mg-6r4p-87pf - ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handle High
About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the engine…
Medium (22 条)
- CVE-2026-52832 - Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file wri
CVE-2026-52832Medium 3.1
## Summary Nuclio Dashboard exposes `POST /api/functions` without authentication by default (NOP auth mode). The `spec.handler` field (e.g.,… - CVE-2026-34760 - vLLM: Processing differential in multi-channel audio downmixing enables hidden-i
CVE-2026-34760Medium
## Issue Description Librosa defaults to using `numpy.mean` for mono downmixing (`to_mono`), while the international standard ITU-R BS.775-4 specifies a… - CVE-2026-55646 - vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
CVE-2026-55646Medium
## Summary Current-head vLLM documents `VLLM_MAX_AUDIO_CLIP_FILESIZE_MB` as the maximum audio file size accepted by the speech-to-text APIs. The default is 25… - CVE-2026-54247 - Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhausti
CVE-2026-54247Medium
## Summary The Kubernetes admission webhook handler reads the entire request body using `io.ReadAll(r.Body)` without any size limit. Any client that can reach… - CVE-2026-54503 - plone.app.textfield: Stored XSS by spoofing mime type
CVE-2026-54503Medium
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the… - GHSA-8rqh-vxpr-x77p - plone.restapi: Stored XSS by spoofing mime type Medium
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the… - CVE-2026-54546 - TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PU
CVE-2026-54546Medium
Summary `PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSRF protection whatsoever**. Any authenticated… - GHSA-cvpc-hccg-wmw4 - Formie: Missing authorization in administrative settings allows low-privileged C Medium
Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited…
…另有 14 条 Medium 级漏洞（已省略）
Low (3 条)
- GHSA-rjwr-m7qx-3fjr - oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Inject
CVE-2026-22785Low
## Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI… - CVE-2026-54541 - nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-len
CVE-2026-54541Low
Impact A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted `TrieChunk` whose proof contains two `TrieProofNode`s with… - CVE-2026-54542 - nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child su
CVE-2026-54542Low
Impact A malicious peer acting as a state-sync source can crash a syncing node with a crafted `TrieChunk` whose proof contains a `TrieNodeChild` whose…
🛡️ NVD-Latest（69 条）
Critical (11 条)
- CVE-2026-56699 Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when
CVE-2026-56699Critical 10.0
CVE-2026-56699 CVSS:10.0 Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing… - CVE-2026-45695 Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast in
CVE-2026-45695Critical 9.8
CVE-2026-45695 CVSS:9.8 Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption,…
+GitHub-Advis - CVE-2023-49900 An unauthenticated remote attacker is able to perform remote code execution due
CVE-2023-49900Critical 9.8
CVE-2023-49900 CVSS:9.8 An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter… - CVE-2023-49899 An unauthenticated remote attacker can execute any command on the affected devic
CVE-2023-49899Critical 9.8
CVE-2023-49899 CVSS:9.8 An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a… - CVE-2026-12492 The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not
CVE-2026-12492Critical 9.8
CVE-2026-12492 CVSS:9.8 The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated… - CVE-2026-15013 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authen
CVE-2026-15013Critical 9.8
CVE-2026-15013 CVSS:9.8 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion… - CVE-2026-22752 Authentication bypass by primary weakness vulnerability in Spring Security Sprin
CVE-2026-22752Critical 9.6
CVE-2026-22752 CVSS:9.6 Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring… - CVE-2026-61451 The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin
CVE-2026-61451Critical 9.6
CVE-2026-61451 CVSS:9.6 The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST… - CVE-2026-14890 SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socke
CVE-2026-14890Critical 9.1
CVE-2026-14890 CVSS:9.1 SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain… - CVE-2026-43637 Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allo
CVE-2026-43637Critical 9.1
CVE-2026-43637 CVSS:9.1 Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the… - CVE-2026-11386 An input validation and injection vulnerability exists in Canonical ubuntu-pro-c
CVE-2026-11386Critical 9.0
CVE-2026-11386 CVSS:9.0 An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client…
High (58 条)
- CVE-2026-5674 A flaw was found in PipeWire, a multimedia server. This vulnerability allows an
CVE-2026-5674High 8.8
CVE-2026-5674 CVSS:8.8 A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as… - CVE-2026-15103 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
CVE-2026-15103High 8.8
CVE-2026-15103 CVSS:8.8 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege… - CVE-2026-15005 The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forg
CVE-2026-15005High 8.8
CVE-2026-15005 CVSS:8.8 The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This… - CVE-2026-13741 The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vul
CVE-2026-13741High 8.8
CVE-2026-13741 CVSS:8.8 The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,… - CVE-2026-12525 The Redux Framework WordPress plugin before 4.5.13 does not restrict which user
CVE-2026-12525High 8.8
CVE-2026-12525 CVSS:8.8 The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile… - CVE-2026-61457 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file uploa
CVE-2026-61457High 8.8
CVE-2026-61457 CVSS:8.8 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller.… - CVE-2026-58655 The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1
CVE-2026-58655High 8.8
CVE-2026-58655 CVSS:8.8 The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection… - CVE-2026-57996 phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/
CVE-2026-57996High 8.8
CVE-2026-57996 CVSS:8.8 phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin… - CVE-2026-35152 A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (
CVE-2026-35152High 8.8
CVE-2026-35152 CVSS:8.8 A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including… - CVE-2026-15804 The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated r
CVE-2026-15804High 8.8
CVE-2026-15804 CVSS:8.8 The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific… - CVE-2026-63306 stoatchat before 0.13.5 contains an unauthenticated server-side request forgery
CVE-2026-63306High 8.6
CVE-2026-63306 CVSS:8.6 stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that… - CVE-2026-61436 PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail web
CVE-2026-61436High 8.6
CVE-2026-61436 CVSS:8.6 PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge… - CVE-2026-15583 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote at
CVE-2026-15583High 8.6
CVE-2026-15583 CVSS:8.6 A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's… - CVE-2026-12512 The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and es
CVE-2026-12512High 8.6
CVE-2026-12512 CVSS:8.6 The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL… - CVE-2026-61430 PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in
CVE-2026-61430High 8.5
CVE-2026-61430 CVSS:8.5 PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check… - CVE-2026-61446 PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulne
CVE-2026-61446High 8.4
CVE-2026-61446 CVSS:8.4 PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and… - CVE-2026-55723 When NGINX Ingress Controller is configured with Custom Resource Definitions (CR
CVE-2026-55723High 8.3
CVE-2026-55723 CVSS:8.3 When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability… - CVE-2026-56400 open-webui before 0.3.14 contains a cross-origin resource sharing misconfigurati
CVE-2026-56400High 8.3
CVE-2026-56400 CVSS:8.3 open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and… - CVE-2026-35149 HCL DFXServer is affected by an Authentication Bypass vulnerability via server r
CVE-2026-35149High 8.2
CVE-2026-35149 CVSS:8.2 HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without… - CVE-2026-35147 HCL DFXServer is affected by a Broken Authentication vulnerability via direct AP
CVE-2026-35147High 8.2
CVE-2026-35147 CVSS:8.2 HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's… - CVE-2026-61435 PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent
CVE-2026-61435High 8.2
CVE-2026-61435 CVSS:8.2 PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints… - CVE-2026-63305 AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg
CVE-2026-63305High 8.1
CVE-2026-63305 CVSS:8.1 AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback… - CVE-2026-63304 AVideo through 29.0 contains an OS command injection vulnerability in plugin/API
CVE-2026-63304High 8.1
CVE-2026-63304 CVSS:8.1 AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the… - CVE-2026-15008 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builde
CVE-2026-15008High 8.1
CVE-2026-15008 CVSS:8.1 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to… - CVE-2026-12585 The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not p
CVE-2026-12585High 8.1
CVE-2026-12585 CVSS:8.1 The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or… - CVE-2026-1609 A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant
CVE-2026-1609High 8.1
CVE-2026-1609 CVSS:8.1 A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is… - CVE-2026-42533 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive
CVE-2026-42533High 8.1
CVE-2026-42533 CVSS:8.1 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references… - CVE-2026-61873 Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plu
CVE-2026-61873High 8.1
CVE-2026-61873 CVSS:8.1 Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is… - CVE-2026-61443 PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillT
CVE-2026-61443High 8.1
CVE-2026-61443 CVSS:8.1 PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without… - CVE-2026-57821 A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET
CVE-2026-57821High 8.1
CVE-2026-57821 CVSS:8.1 A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including…
+PoC-in-GitHu - CVE-2026-56287 A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client S
CVE-2026-56287High 8.1
CVE-2026-56287 CVSS:8.1 A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and… - CVE-2026-12281 The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP
CVE-2026-12281High 8.1
CVE-2026-12281 CVSS:8.1 The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an… - CVE-2026-3842 A flaw was found in QEMU. This vulnerability allows a local attacker within a gu
CVE-2026-3842High 7.8
CVE-2026-3842 CVSS:7.8 A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated… - CVE-2026-58558 Permission control vulnerability in the file system. Impact: Successful exploita
CVE-2026-58558High 7.8
CVE-2026-58558 CVSS:7.8 Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service… - CVE-2026-15809 A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318)
CVE-2026-15809High 7.8
CVE-2026-15809 CVSS:7.8 A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker… - CVE-2026-61433 PraisonAI before 4.6.78 fails to safely encode deployment configuration values w
CVE-2026-61433High 7.8
CVE-2026-61433 CVSS:7.8 PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers.… - CVE-2026-40633 Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 throu
CVE-2026-40633High 7.8
CVE-2026-40633 CVSS:7.8 Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive… - CVE-2026-42936 The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there i
CVE-2026-42936High 7.8
CVE-2026-42936 CVSS:7.8 The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the… - CVE-2026-14251 A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler do
CVE-2026-14251High 7.7
CVE-2026-14251 CVSS:7.7 A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling… - CVE-2026-54560 Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until
CVE-2026-54560High 7.6
CVE-2026-54560 CVSS:7.6 Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued… - CVE-2026-53598 Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-bet
CVE-2026-53598High 7.5
CVE-2026-53598 CVSS:7.5 Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in…
+GitHub-Advis - CVE-2026-59862 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's P
CVE-2026-59862High 7.5
CVE-2026-59862 CVSS:7.5 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator let attacker-controlled enum value… - CVE-2026-59861 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's R
CVE-2026-59861High 7.5
CVE-2026-59861 CVSS:7.5 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property… - CVE-2026-21729 Loki queries with large limits can cause large memory allocations which can impa
CVE-2026-21729High 7.5
CVE-2026-21729 CVSS:7.5 Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its… - CVE-2026-12753 The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordP
CVE-2026-12753High 7.5
CVE-2026-12753 CVSS:7.5 The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's'… - CVE-2026-48863 A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists
CVE-2026-48863High 7.5
CVE-2026-48863 CVSS:7.5 A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect… - CVE-2026-23538 A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint
CVE-2026-23538High 7.5
CVE-2026-23538 CVSS:7.5 A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent… - CVE-2026-59762 When an HTTP/2 profile is configured on a virtual server, undisclosed requests c
CVE-2026-59762High 7.5
CVE-2026-59762 CVSS:7.5 When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.… - CVE-2026-60085 PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in
CVE-2026-60085High 7.5
CVE-2026-60085 CVSS:7.5 PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where… - CVE-2026-56339 Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerab
CVE-2026-56339High 7.5
CVE-2026-56339 CVSS:7.5 Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC… - CVE-2026-15907 A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an
CVE-2026-15907High 7.3
CVE-2026-15907 CVSS:7.3 A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file… - CVE-2026-61438 PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWor
CVE-2026-61438High 7.3
CVE-2026-61438 CVSS:7.3 PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient… - CVE-2026-61427 PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentica
CVE-2026-61427High 7.3
CVE-2026-61427 CVSS:7.3 PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to… - CVE-2026-56398 Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in
CVE-2026-56398High 7.3
CVE-2026-56398 CVSS:7.3 Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim… - CVE-2026-7543 The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2026-7543High 7.2
CVE-2026-7543 CVSS:7.2 The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and… - CVE-2026-13042 The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scrip
CVE-2026-13042High 7.2
CVE-2026-13042 CVSS:7.2 The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and… - CVE-2026-12978 The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied
CVE-2026-12978High 7.1
CVE-2026-12978 CVSS:7.1 The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response… - CVE-2026-54563 Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1,
CVE-2026-54563High 7.1
CVE-2026-54563 CVSS:7.1 Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured…
⚔️ Sploitus（76 条）
Unknown (76 条)
- Exploit for CVE-2026-60137 exploit
CVE-2026-60137
Exploit for CVE-2026-60137 exploit - Exploit for OS Command Injection in Zoneminder exploit
Exploit for OS Command Injection in Zoneminder exploit
…另有 74 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-18 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV