📊 2026-07-19 漏洞情报日报 · 200 条 · 高危 89
每日漏洞情报汇总 · 2026-07-19
📊 2026-07-19 漏洞情报日报
📋 共 200 条
🔥 高危/严重 89 条
🐙 GitHub-Advisory 35 条 🔥14
🛡️ NVD-Latest 75 条 🔥75
⚔️ Sploitus 90 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-9810 (CVSS 9.8)：WordPress AI Copilot 插件认证绕过漏洞。未绑定 OAuth 令牌至用户，攻击者可通过公共 OAuth 流程获取有效令牌直接获取管理员权限。
- CVE-2026-45695 (CVSS 9.8)：Kopia 备份工具 HTTP 服务无需密码启动时，存在未授权API访问风险。远程攻击者可利用该漏洞读取或操作备份数据。
- CVE-2026-53713 (Critical)：Envoy Gateway 认证绕过漏洞。路径归一化处理缺陷（//等），攻击者可通过`//etc/passwd`绕过关键路径检查，实现越权访问。
- CVE-2026-54549 (High)：meta-ads-mcp 工具 SSRF漏洞。`upload_ad_image`接口未限制`image_url`参数，攻击者可利用服务器发起内网探测或访问云元数据服务。
- CVE-2026-15982 / CVE-2026-14956 (CVSS 9.8)：多个WordPress插件（Aimogen Pro、Bricksforge）存在权限提升漏洞，未授权攻击者可利用注册或参数验证缺陷接管管理员账户。
📈 威胁趋势
- 认证/授权绕过（占比最高）：今日出现多个CVSS 9.8级别的认证绕过漏洞，集中在WordPress插件（AI Copilot、SAML SSO）及云原生组件（Envoy Gateway），利用条件低，可导致完全接管。
- 权限提升（Privilege Escalation）：多个WordPress插件（Aimogen Pro, Bricksforge）及AWS JDBC Wrapper均存在权限升级漏洞，攻击者可从低权限提升至管理员或数据库DA权限。
- 远程代码执行/命令执行（RCE）：CVE-2023-49899/49900等老漏洞今日被重新收录至NVD，涉及未授权远程命令执行，风险极高，需警惕历史漏洞的延续利用。
- 服务端请求伪造（SSRF）及拒绝服务（DoS）：meta-ads-mcp存在SSRF；vLLM AI推理框架被曝出两种DoS漏洞（无效Token注入、ReDoS），攻击者可通过构造特定请求导致服务中断。
- 不完整权限丢弃：sh工具中的`_uid`选项未正确清理附属组权限，导致权限提升，影响容器和Unix环境的安全性。
🛡️ 缓解建议
- 立即更新受影响组件：优先升级AI Copilot（>1.5.4）、Kopia（>=0.23.0）、Bricksforge及Aimogen Pro至最新版本，杜绝已知认证绕过与提权漏洞。
- 强化网络访问控制：对Envoy Gateway等反向代理配置严格的路径白名单；确保Kopia等工具的HTTP服务不暴露于公网，并配置强密码认证。
- 限制对外部输入的信任：针对meta-ads-mpc等工具，在代码层对`image_url`进行协议与域白名单校验；对vLLM框架启用正则超时机制，防止ReDoS攻击。
- 审计插件及第三方依赖：立即排查所有WordPress站点中已安装的SAML SSO (<=5.4.3) 与WooCommerce OTP插件，建议暂停使用或启用强制多因素认证作为补偿措施。
🐙 GitHub-Advisory（35 条）
Critical (1 条)
- CVE-2026-53713 - Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExten
CVE-2026-53713Critical
Impact The `to_absolute_normalized_path` function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, `//etc/passwd` is…
High (13 条)
- CVE-2026-54549 - meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrest
CVE-2026-54549High 3.1
## Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch Summary The `upload_ad_image` MCP tool in `meta-ads-mcp` v1.0.113… - CVE-2026-54567 - Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-o
CVE-2026-54567High 3.1
## 1. Header | Field | Value | |---|---| | **Title** | Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of… - CVE-2026-54234 - vLLM has Remote DoS via Invalid Recovered Token Reinjection
CVE-2026-54234High
## Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to `vocab_size`, convert that… - CVE-2026-55574 - vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar an
CVE-2026-55574High
## Summary The `structured_outputs.regex` API parameter passes a user-supplied regex string directly to grammar compiler backends with no compilation timeout.… - CVE-2026-11400 - AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
CVE-2026-11400High
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identified CVE-2026-11400, an issue in Aurora… - CVE-2026-54552 - sh _uid does not drop supplementary groups (incomplete privilege drop)
CVE-2026-54552High
Impact The `_uid` option performed an incomplete privilege drop on Linux/Unix-like systems. When `sh` was run from a process with elevated privileges, such as… - CVE-2026-54547 - meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
CVE-2026-54547High
## X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary `AuthInjectionMiddleware` in `meta-ads-mcp` rejects HTTP MCP requests only when… - CVE-2026-27771 - Gitea has insufficient permission checks for Composer package source links
CVE-2026-27771High
CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or…
+PoC-in-GitHu - CVE-2026-53598 - Prompty: Arbitrary file read via file reference expansion
CVE-2026-53598High
## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized…
+NVD-Latest - CVE-2026-53597 - Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loade
CVE-2026-53597High
## Summary The TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-matter` supports JavaScript frontmatter… - CVE-2026-55177 - CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlle
CVE-2026-55177High
# Authenticated full-read SSRF in CloudTAK `/api/esri*` routes — user-controlled URL fetched with no IP-classification guard ## Summary Every route in the ESRI… - GHSA-8qqm-fp2q-v734 - Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA den
CVE-2026-50197High
Summary A wrong policy can be an open door. You have to check `input.attributes.request.http.truncated_body` in your policy. Description Incomplete fix for… - CVE-2026-53714 - Envoy Gateway: xDS Control Plane Information Disclosure when operating in Gatewa
CVE-2026-53714High
Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a…
Medium (20 条)
- CVE-2026-34760 - vLLM: Processing differential in multi-channel audio downmixing enables hidden-i
CVE-2026-34760Medium
## Issue Description Librosa defaults to using `numpy.mean` for mono downmixing (`to_mono`), while the international standard ITU-R BS.775-4 specifies a… - CVE-2026-55646 - vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
CVE-2026-55646Medium
## Summary Current-head vLLM documents `VLLM_MAX_AUDIO_CLIP_FILESIZE_MB` as the maximum audio file size accepted by the speech-to-text APIs. The default is 25… - CVE-2026-54247 - Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhausti
CVE-2026-54247Medium
## Summary The Kubernetes admission webhook handler reads the entire request body using `io.ReadAll(r.Body)` without any size limit. Any client that can reach… - CVE-2026-54503 - plone.app.textfield: Stored XSS by spoofing mime type
CVE-2026-54503Medium
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the… - GHSA-8rqh-vxpr-x77p - plone.restapi: Stored XSS by spoofing mime type Medium
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the… - CVE-2026-54546 - TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PU
CVE-2026-54546Medium
Summary `PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSRF protection whatsoever**. Any authenticated… - GHSA-cvpc-hccg-wmw4 - Formie: Missing authorization in administrative settings allows low-privileged C Medium
Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited… - CVE-2026-54561 - mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated f
CVE-2026-54561Medium
Impact `context_import` passed the caller-supplied `filePath` directly to `fs.readFileSync` with no path confinement. A malicious MCP client — or an LLM agent…
…另有 12 条 Medium 级漏洞（已省略）
Low (1 条)
- GHSA-rjwr-m7qx-3fjr - oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Inject
CVE-2026-22785Low
## Summary The vulnerability in oapi-codegen seems to be similar with CVE-2026-22785, which is a generated-code injection issue where untrusted OpenAPI…
🛡️ NVD-Latest（75 条）
Critical (13 条)
- CVE-2026-9810 The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens
CVE-2026-9810Critical 9.8
CVE-2026-9810 CVSS:9.8 The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an… - CVE-2026-15982 The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Too
CVE-2026-15982Critical 9.8
CVE-2026-15982 CVSS:9.8 The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege… - CVE-2026-14956 The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in al
CVE-2026-14956Critical 9.8
CVE-2026-14956 CVSS:9.8 The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due… - CVE-2026-45695 Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast in
CVE-2026-45695Critical 9.8
CVE-2026-45695 CVSS:9.8 Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption,…
+GitHub-Advis - CVE-2023-49900 An unauthenticated remote attacker is able to perform remote code execution due
CVE-2023-49900Critical 9.8
CVE-2023-49900 CVSS:9.8 An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter… - CVE-2023-49899 An unauthenticated remote attacker can execute any command on the affected devic
CVE-2023-49899Critical 9.8
CVE-2023-49899 CVSS:9.8 An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a… - CVE-2026-12492 The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not
CVE-2026-12492Critical 9.8
CVE-2026-12492 CVSS:9.8 The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated… - CVE-2026-15013 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authen
CVE-2026-15013Critical 9.8
CVE-2026-15013 CVSS:9.8 The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion… - CVE-2026-22752 Authentication bypass by primary weakness vulnerability in Spring Security Sprin
CVE-2026-22752Critical 9.6
CVE-2026-22752 CVSS:9.6 Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring… - CVE-2024-23564 HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a no
CVE-2024-23564Critical 9.1
CVE-2024-23564 CVSS:9.1 HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords… - CVE-2026-62241 clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT
CVE-2026-62241Critical 9.1
CVE-2026-62241 CVSS:9.1 clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and… - CVE-2026-14890 SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socke
CVE-2026-14890Critical 9.1
CVE-2026-14890 CVSS:9.1 SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain… - CVE-2026-11386 An input validation and injection vulnerability exists in Canonical ubuntu-pro-c
CVE-2026-11386Critical 9.0
CVE-2026-11386 CVSS:9.0 An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client…
High (62 条)
- CVE-2026-13352 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User
CVE-2026-13352High 8.8
CVE-2026-13352 CVSS:8.8 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for… - CVE-2026-62233 grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKe
CVE-2026-62233High 8.8
CVE-2026-62233 CVSS:8.8 grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing… - CVE-2026-62229 OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec
CVE-2026-62229High 8.8
CVE-2026-62229 CVSS:8.8 OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers… - CVE-2026-62228 OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node e
CVE-2026-62228High 8.8
CVE-2026-62228 CVSS:8.8 OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to… - CVE-2026-62223 OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the d
CVE-2026-62223High 8.8
CVE-2026-62223 CVSS:8.8 OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust… - CVE-2026-62218 OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerabilit
CVE-2026-62218High 8.8
CVE-2026-62218 CVSS:8.8 OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows… - CVE-2026-62217 OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the
CVE-2026-62217High 8.8
CVE-2026-62217 CVSS:8.8 OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is… - CVE-2026-62207 OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability
CVE-2026-62207High 8.8
CVE-2026-62207 CVSS:8.8 OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped… - CVE-2026-62203 OpenClaw versions before 2026.6.6 contain an environment variable filtering vuln
CVE-2026-62203High 8.8
CVE-2026-62203 CVSS:8.8 OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize… - CVE-2026-62202 OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulner
CVE-2026-62202High 8.8
CVE-2026-62202 CVSS:8.8 OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust… - CVE-2026-5674 A flaw was found in PipeWire, a multimedia server. This vulnerability allows an
CVE-2026-5674High 8.8
CVE-2026-5674 CVSS:8.8 A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as… - CVE-2026-15103 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
CVE-2026-15103High 8.8
CVE-2026-15103 CVSS:8.8 The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege… - CVE-2026-15005 The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forg
CVE-2026-15005High 8.8
CVE-2026-15005 CVSS:8.8 The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This… - CVE-2026-13741 The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vul
CVE-2026-13741High 8.8
CVE-2026-13741 CVSS:8.8 The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,… - CVE-2026-12525 The Redux Framework WordPress plugin before 4.5.13 does not restrict which user
CVE-2026-12525High 8.8
CVE-2026-12525 CVSS:8.8 The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile… - CVE-2026-63306 stoatchat before 0.13.5 contains an unauthenticated server-side request forgery
CVE-2026-63306High 8.6
CVE-2026-63306 CVSS:8.6 stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that… - CVE-2026-62226 OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerabilit
CVE-2026-62226High 8.5
CVE-2026-62226 CVSS:8.5 OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly… - CVE-2026-13410 Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verificatio
CVE-2026-13410High 8.2
CVE-2026-13410 CVSS:8.2 Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with… - CVE-2026-35149 HCL DFXServer is affected by an Authentication Bypass vulnerability via server r
CVE-2026-35149High 8.2
CVE-2026-35149 CVSS:8.2 HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without… - CVE-2026-35147 HCL DFXServer is affected by a Broken Authentication vulnerability via direct AP
CVE-2026-35147High 8.2
CVE-2026-35147 CVSS:8.2 HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's… - CVE-2026-11961 The User Registration & Membership WordPress plugin before 5.2.3 does not valid
CVE-2026-11961High 8.1
CVE-2026-11961 CVSS:8.1 The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public… - CVE-2026-62234 Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing
CVE-2026-62234High 8.1
CVE-2026-62234 CVSS:8.1 Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission… - CVE-2026-62231 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authoriza
CVE-2026-62231High 8.1
CVE-2026-62231 CVSS:8.1 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted… - CVE-2026-62209 OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypa
CVE-2026-62209High 8.1
CVE-2026-62209 CVSS:8.1 OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which… - CVE-2026-63305 AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg
CVE-2026-63305High 8.1
CVE-2026-63305 CVSS:8.1 AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback… - CVE-2026-63304 AVideo through 29.0 contains an OS command injection vulnerability in plugin/API
CVE-2026-63304High 8.1
CVE-2026-63304 CVSS:8.1 AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the… - CVE-2026-15008 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builde
CVE-2026-15008High 8.1
CVE-2026-15008 CVSS:8.1 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to… - CVE-2026-12585 The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not p
CVE-2026-12585High 8.1
CVE-2026-12585 CVSS:8.1 The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or… - CVE-2026-1609 A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant
CVE-2026-1609High 8.1
CVE-2026-1609 CVSS:8.1 A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is… - CVE-2026-62215 OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability
CVE-2026-62215High 8.0
CVE-2026-62215 CVSS:8.0 OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust… - CVE-2026-62222 OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that a
CVE-2026-62222High 7.8
CVE-2026-62222 CVSS:7.8 OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers… - CVE-2026-3842 A flaw was found in QEMU. This vulnerability allows a local attacker within a gu
CVE-2026-3842High 7.8
CVE-2026-3842 CVSS:7.8 A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated… - CVE-2026-62227 OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulner
CVE-2026-62227High 7.7
CVE-2026-62227 CVSS:7.7 OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to… - CVE-2026-62201 OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability
CVE-2026-62201High 7.7
CVE-2026-62201 CVSS:7.7 OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust… - CVE-2026-8396 Improper restriction of XML external entity reference vulnerability in Netcad So
CVE-2026-8396High 7.5
CVE-2026-8396 CVSS:7.5 Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External… - CVE-2026-7189 Insertion of sensitive information into sent data vulnerability in Proliz Softwa
CVE-2026-7189High 7.5
CVE-2026-7189 CVSS:7.5 Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality… - CVE-2026-11575 The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly ve
CVE-2026-11575High 7.5
CVE-2026-11575 CVSS:7.5 The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks:… - CVE-2026-13765 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin
CVE-2026-13765High 7.5
CVE-2026-13765 CVSS:7.5 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information… - CVE-2026-62386 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT acc
CVE-2026-62386High 7.5
CVE-2026-62386 CVSS:7.5 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on… - CVE-2026-62230 Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/hta
CVE-2026-62230High 7.5
CVE-2026-62230 CVSS:7.5 Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive… - CVE-2026-54340 h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to com
CVE-2026-54340High 7.5
CVE-2026-54340 CVSS:7.5 h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification… - CVE-2026-39359 Wazuh is a free and open source platform used for threat prevention, detection,
CVE-2026-39359High 7.5
CVE-2026-39359 CVSS:7.5 Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and… - CVE-2026-34150 Wazuh is a free and open source platform used for threat prevention, detection,
CVE-2026-34150High 7.5
CVE-2026-34150 CVSS:7.5 Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to… - CVE-2026-53598 Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-bet
CVE-2026-53598High 7.5
CVE-2026-53598 CVSS:7.5 Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in…
+GitHub-Advis - CVE-2026-59862 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's P
CVE-2026-59862High 7.5
CVE-2026-59862 CVSS:7.5 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator let attacker-controlled enum value… - CVE-2026-59861 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's R
CVE-2026-59861High 7.5
CVE-2026-59861 CVSS:7.5 Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property… - CVE-2026-21729 Loki queries with large limits can cause large memory allocations which can impa
CVE-2026-21729High 7.5
CVE-2026-21729 CVSS:7.5 Loki queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its… - CVE-2026-12753 The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordP
CVE-2026-12753High 7.5
CVE-2026-12753 CVSS:7.5 The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's'… - CVE-2026-48863 A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists
CVE-2026-48863High 7.5
CVE-2026-48863 CVSS:7.5 A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect… - CVE-2026-23538 A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint
CVE-2026-23538High 7.5
CVE-2026-23538 CVSS:7.5 A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent… - CVE-2026-62232 Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in t
CVE-2026-62232High 7.4
CVE-2026-62232 CVSS:7.4 Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task… - CVE-2026-16014 A vulnerability was found in code-projects Hospital Bed Management System 1.0. T
CVE-2026-16014High 7.3
CVE-2026-16014 CVSS:7.3 A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login… - CVE-2026-15907 A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an
CVE-2026-15907High 7.3
CVE-2026-15907 CVSS:7.3 A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file… - CVE-2026-15395 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vu
CVE-2026-15395High 7.2
CVE-2026-15395 CVSS:7.2 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… - CVE-2026-7543 The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2026-7543High 7.2
CVE-2026-7543 CVSS:7.2 The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and… - CVE-2026-13042 The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scrip
CVE-2026-13042High 7.2
CVE-2026-13042 CVSS:7.2 The RPB Chessboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and… - CVE-2026-62387 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access
CVE-2026-62387High 7.1
CVE-2026-62387 CVSS:7.1 The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS… - CVE-2026-62219 OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerabilit
CVE-2026-62219High 7.1
CVE-2026-62219 CVSS:7.1 OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A… - CVE-2026-62212 OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DN
CVE-2026-62212High 7.1
CVE-2026-62212 CVSS:7.1 OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled… - CVE-2026-62206 OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability
CVE-2026-62206High 7.1
CVE-2026-62206 CVSS:7.1 OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a… - CVE-2026-62205 OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorizati
CVE-2026-62205High 7.1
CVE-2026-62205 CVSS:7.1 OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions… - CVE-2026-12978 The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied
CVE-2026-12978High 7.1
CVE-2026-12978 CVSS:7.1 The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response…
⚔️ Sploitus（90 条）
Unknown (90 条)
- Exploit for CVE-2026-46420 exploit
CVE-2026-46420
Exploit for CVE-2026-46420 exploit - Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms exploit
Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms exploit
…另有 88 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-19 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV