📊 2026-07-22 漏洞情报日报 · 200 条 · 高危 84
每日漏洞情报汇总 · 2026-07-22
📊 2026-07-22 漏洞情报日报
📋 共 200 条
🔥 高危/严重 84 条
🚨 CISA-KEV 4 条
🐙 GitHub-Advisory 94 条 🔥42
🛡️ NVD-Latest 42 条 🔥42
⚔️ Sploitus 60 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-44359 (CVSS 10.0) - Meshtastic GitHub CI/CD 投毒：Mesh网络开源项目。攻击者可利用
pull_request_target工作流触发恶意代码执行，获取仓库密钥。利用条件低，仅需提交含恶意载荷的PR即可触发。 - CVE-2026-58426 / CVE-2026-58443 (Critical) - Gitea 跨仓库/权限绕过：DevOps平台。工件签名歧义导致可跨任务访问；公库令牌可操作私有PR分支。已获得Actions权限或拥有公库令牌的攻击者可利用。
- CVE-2026-62183 / CVE-2026-64620 (CVSS 9.8) - Apache Syncope 权限提升链 & FreeRDP RCE：前者配置不当可致普通用户自提升权限；后者FreeRDP ≤3.27.1存在堆溢出，无需认证即可远程代码执行。均具备公开PoC，利用风险高。
- CVE-2026-59873 (Critical) - Node.js Tar 解压拒绝服务：npm包
node-tar未限制解压数据总量，攻击者可通过构造的压缩包耗尽服务器磁盘与CPU，影响广泛的后端服务。
📈 威胁趋势
- 远程代码执行 (RCE) / 命令注入：FreeRDP堆溢出、Apache Syncope脚本/类加载绕过及SQL注入、Meshtastic CI投毒，均可达任意代码执行，其中FreeRDP与Meshtastic无需交互即可触发。
- 权限提升 / 安全特性绕过：Gitea公库令牌越权操作、Apache Syncope用户自提权、.NET XML加密绕过（CVE-2026-47304），主要源于身份校验逻辑缺失或权限模型不完善。
- 拒绝服务 (DoS)：.NET运行时（CVE-2026-57108/47302/50524）及node-tar解压类漏洞集中爆发，攻击面覆盖TLS、XML处理及数据解压，极易引发大范围服务瘫痪。
- 信息泄露 / 加密弱点：Perl Crypt::Password库使用随机数生成器（CVE-2026-16235），产生可预测的盐值；Gitea工件签名歧义可致跨仓库数据暴露。
🛡️ 缓解建议
- 立即升级受影响组件：升级FreeRDP至≥3.28.0；更新Apache Syncope至包含补丁的最新版本；将Gitea升级至≥1.22.3；更新项目中node-tar至≥6.2.1。
- 加固身份与权限管理：审计Gitea令牌作用域，禁止公库令牌操作私有PR；在Apache Syncope中禁用不必要的BPMN自定义导入与脚本连接器，遵循最小权限原则。
- 更新.NET运行时与依赖：针对CVE-2026-57108等四个.NET DoS漏洞，安装2026年7月微软安全更新，并同步更新System.Net.Security与System.Security.Cryptography.Xml。
- 部署输入与资源限制：在代理层增加请求体/压缩包大小限制；启用CI/CD流程隔离，禁用
pull_request_target的不安全用法，或采用先拉取再Checkout的模式。
🚨 CISA-KEV（4 条）
Unknown (4 条)
- CVE-2021-27137 - DD-WRT Stack-Based Buffer Overflow Vulnerability
CVE-2021-27137
CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability 产品: DD-WRT DD-WRT 描述: DD-WRT contains a stack-based buffer overflow vulnerability that could… - CVE-2026-0770 - Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
CVE-2026-0770
CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability 产品: Langflow Langflow 描述: Langflow contains an inclusion of…
…另有 2 条 Unknown 级漏洞（已省略）
🐙 GitHub-Advisory（94 条）
Critical (3 条)
- CVE-2026-58426 - Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository art
CVE-2026-58426Critical
Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the… - CVE-2026-58443 - Gitea: Public-only repository tokens can update private PR head branches
CVE-2026-58443Critical
Summary Gitea allows a `public-only,write:repository` token to update a private pull request head branch through a public base repository route. The vulnerable… - CVE-2026-59873 - node-tar: Decompression/parse DoS via unlimited input
CVE-2026-59873Critical
Summary A **Decompression/parse DoS via unlimited input** vulnerability in `node-tar` allows an attacker to exhaust server resources (disk space and CPU).…
+OSV
High (39 条)
- CVE-2026-57108 - Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerabilit
CVE-2026-57108High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET runtime cryptography layer… - CVE-2026-47302 - Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerabilit
CVE-2026-47302High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing… - CVE-2026-47304 - Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulner
CVE-2026-47304High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption… - CVE-2026-50524 - Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerabilit
CVE-2026-50524High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This… - CVE-2026-50648 - Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerabilit
CVE-2026-50648High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption… - CVE-2026-50528 - Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulner
CVE-2026-50528High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET TLS/SSL (System.Net.Security). This… - CVE-2026-50525 - Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerabilit
CVE-2026-50525High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption… - CVE-2026-50651 - Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerabilit
CVE-2026-50651High 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET HTTP client (System.Net.Http). This… - CVE-2026-58421 - Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of se
CVE-2026-58421High
This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership… - CVE-2026-58423 - Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized
CVE-2026-58423High
Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including… - CVE-2026-58424 - Gitea: Permanent Fork PR Workflow Approval Gate Bypass
CVE-2026-58424High
| Field | Value | |-------|-------| | **Identifier (researcher-assigned)** | GITEA-2026-004 | | **Product** | Gitea (self-hosted Git service) | | **Component**… - CVE-2026-54481 - Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config
CVE-2026-54481High
Summary Gitea's internal API HTTP client (modules/private/internal.go) hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It… - CVE-2026-55987 - Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth s
CVE-2026-55987High
## Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user signs in through an authentication… - CVE-2026-58437 - Gitea: Repository Visibility Manipulation via Git Push Options
CVE-2026-58437High
Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_receive.go` | |… - CVE-2026-58436 - Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthent
CVE-2026-58436High
Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw… - CVE-2026-58314 - Gitea: Two SSRF findings
CVE-2026-58314High
| --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/gitea:latest`… - CVE-2026-24451 - Gitea: Fork Synchronization Continues After Parent Repository Changes from Publi
CVE-2026-24451High
Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a parent repository after the parent repository… - CVE-2026-27775 - Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Reposi
CVE-2026-27775High
## Vulnerability Header | Field | Value | | ------------------- |… - CVE-2026-25038 - Gitea: Unauthorized Access to Labels of Private Organizations
CVE-2026-25038High
## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without access to a private… - CVE-2026-58419 - Gitea: Notification API leaks private issue metadata after access revocation
CVE-2026-58419High
# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private… - CVE-2026-58422 - Gitea: Improper authorization on OAuth sign-in callback silently re-enables admi
CVE-2026-58422High
Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked… - CVE-2026-20779 - Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X
CVE-2026-20779High
Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2018 fix (PR #3878) introduced the… - GHSA-r7wm-3cxj-wff9 - jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation High
## Summary The fix released in jackson-core `2.18.6` and `2.21.1` for… - GHSA-hrxh-6v49-42gf - gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities High
Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2… - GHSA-rwj8-pgh3-r573 - GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.cl High
Summary `Repo.clone_from()` passes the caller-supplied remote URL through `Git.polish_url()`, which on every non-Cygwin platform calls `os.path.expandvars()`… - GHSA-8r6m-32jq-jx6q - fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits High
Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities`… - GHSA-f88m-g3jw-g9cj - sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE High
Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those… - CVE-2026-16221 - fast-uri vulnerable to host confusion via literal backslash authority delimiter
CVE-2026-16221High
Impact `fast-uri` v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG `URL` (used by `fetch()`,… - CVE-2026-13311 - shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
CVE-2026-13311High
Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the accumulator. Each `prev.concat(arg)`…
+NVD-Latest - CVE-2026-59725 - Socket.IO: Engine.IO Polling Transport Connection Exhaustion
CVE-2026-59725High
Impact An unauthenticated remote attacker can cause a denial of service in affected versions of **engine.io** by opening Engine.IO polling sessions and sending… - CVE-2026-59874 - node-tar: Negative tar entry size causes infinite loop in archive replace
CVE-2026-59874High
Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the existing archive.…
+OSV - CVE-2026-59731 - Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonica
CVE-2026-59731High
# Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch ## Summary Astro 6.4.7 appears to reintroduce a… - CVE-2026-62685 - File Browser: Colliding username normalization gives two users the same home dir
CVE-2026-62685High
## Summary FileBrowser confines each user to a *scope*: a home directory that acts as the boundary for everything they can read or write. When… - GHSA-gcfj-64vw-6mp9 - Axios Node HTTP adapter can use an inherited proxy after interceptor config clon High
## Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.proxy` is polluted and request… - CVE-2026-59197 - Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflo
CVE-2026-59197High
Summary Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size. Minimal public API trigger:…
+OSV - CVE-2026-59199 - Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coo
CVE-2026-59199High
Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In…
+OSV - CVE-2026-59200 - Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
CVE-2026-59200High
Summary `PdfParser.PdfStream.decode()` in Pillow's `PdfParser.py` calls `zlib.decompress()` with the `bufsize` parameter set to the value of the PDF stream's…
+OSV - CVE-2026-59204 - Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used fo
CVE-2026-59204High
Summary `src/libImaging/Jpeg2KDecode.c:853` accumulates `total_component_width` across every tile in a JPEG2000 image instead of recomputing it per tile. That…
+OSV - CVE-2026-59205 - Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()
CVE-2026-59205High
Summary Pillow's public `ImageCms.ImageCmsTransform.apply(im, imOut)` API can trigger controlled native heap corruption when the caller supplies an output…
+OSV
Medium (43 条)
- CVE-2026-58510 - Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path
CVE-2026-58510Medium 3.1
## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR #36319… - CVE-2026-50659 - Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
CVE-2026-50659Medium 3.1
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client (System.Net.Mail). This… - CVE-2026-58441 - Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
CVE-2026-58441Medium
Summary Gitea's `restore-repo` CLI command restores a repository from a dump directory/archive. When parsing `pull_request.yml` from that dump, the… - CVE-2026-58442 - Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
CVE-2026-58442Medium
Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts… - CVE-2026-58444 - Gitea: Personal access token scope enforcement bypass on the repository home pag
CVE-2026-58444Medium
Summary A personal access token (PAT) or OAuth2 token that does **not** carry the `repository` scope or that is **public-only** is correctly rejected (HTTP… - CVE-2026-42931 - Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
CVE-2026-42931Medium
Summary An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a… - CVE-2026-58416 - Gitea: Fork-PR Actions task can read a third private repository via the collabor
CVE-2026-58416Medium
Summary `GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions task token may access a target repo. Its cross-repo… - CVE-2026-50105 - Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (
CVE-2026-50105Medium
Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or public-only enforcement**. A personal access token that is…
…另有 35 条 Medium 级漏洞（已省略）
Low (9 条)
- CVE-2026-58438 - Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper
CVE-2026-58438Low
Details `RemoveDependency` in `routers/web/repo/issue_dependency.go` takes a `removeDependencyID` form parameter identifying the other issue by its global… - CVE-2026-58445 - Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabe
CVE-2026-58445Low
## Summary The API endpoint `DELETE /repos/{owner}/{repo}/issues/{index}/labels/{id}` loads the label by ID with a **global, unscoped** lookup and never… - CVE-2026-58434 - Gitea: Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-58434Low
Summary A user who previously had access to a private repository can continue to obtain repository metadata through `GET /api/v1/user/starred` after their…
…另有 6 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（42 条）
Critical (11 条)
- CVE-2026-44359 Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1
CVE-2026-44359Critical 10.0
CVE-2026-44359 CVSS:10.0 Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's… - CVE-2026-63071 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An
CVE-2026-63071Critical 9.8
CVE-2026-63071 CVSS:9.8 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for… - CVE-2026-62183 Improper Privilege Management vulnerability in Apache Syncope. When: * the all
CVE-2026-62183Critical 9.8
CVE-2026-62183 CVSS:9.8 Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the…
+PoC-in-GitHu - CVE-2026-57308 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CVE-2026-57308Critical 9.8
CVE-2026-57308 CVSS:9.8 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator… - CVE-2026-53421 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. A
CVE-2026-53421Critical 9.8
CVE-2026-53421 CVSS:9.8 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve… - CVE-2026-53405 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An
CVE-2026-53405Critical 9.8
CVE-2026-53405 CVSS:9.8 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import… - CVE-2026-64620 FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow
CVE-2026-64620Critical 9.8
CVE-2026-64620 CVSS:9.8 FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c).… - CVE-2026-16235 Crypt::Password versions through 0.28 for Perl generate insecure random values f
CVE-2026-16235Critical 9.8
CVE-2026-16235 CVSS:9.8 Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand… - CVE-2026-16242 A flaw was found in the Konnectivity proxy-server configuration for hosted contr
CVE-2026-16242Critical 9.4
CVE-2026-16242 CVSS:9.4 A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started… - CVE-2026-13147 The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL
CVE-2026-13147Critical 9.1
CVE-2026-13147 CVSS:9.1 The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing… - CVE-2026-12701 A path traversal vulnerability was found in pulpcore. The relative_path_validato
CVE-2026-12701Critical 9.0
CVE-2026-12701 CVSS:9.0 A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not…
High (31 条)
- CVE-2026-25039 Parsec is a cloud-based application for simple and cryptographically secure file
CVE-2026-25039High 8.8
CVE-2026-25039 CVSS:8.8 Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the… - CVE-2026-21824 HCL Commerce contains an privilege escalation vulnerability that could allow den
CVE-2026-21824High 8.8
CVE-2026-21824 CVSS:8.8 HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and… - CVE-2026-63090 ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulner
CVE-2026-63090High 8.8
CVE-2026-63090 CVSS:8.8 ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows… - CVE-2026-16248 A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affe
CVE-2026-16248High 8.8
CVE-2026-16248 CVSS:8.8 A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affects the function fromAdvSetLanip of the file… - CVE-2026-63757 SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where
CVE-2026-63757High 8.8
CVE-2026-63757 CVSS:8.8 SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session… - CVE-2026-10081 The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not san
CVE-2026-10081High 8.8
CVE-2026-10081 CVSS:8.8 The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the… - CVE-2026-45270 CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to vers
CVE-2026-45270High 8.7
CVE-2026-45270 CVSS:8.7 CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the… - CVE-2026-64623 Network-AI before 5.13.4 contains an improper cryptographic signature verificati
CVE-2026-64623High 8.6
CVE-2026-64623 CVSS:8.6 Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local… - CVE-2026-11349 The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Cale
CVE-2026-11349High 8.6
CVE-2026-11349 CVSS:8.6 The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not… - CVE-2026-13577 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRN
CVE-2026-13577High 8.2
CVE-2026-13577 CVSS:8.2 Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable.… - CVE-2026-62418 Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability i
CVE-2026-62418High 8.1
CVE-2026-62418 CVSS:8.1 Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check.… - CVE-2026-63756 SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race conditi
CVE-2026-63756High 8.1
CVE-2026-63756 CVSS:8.1 SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows… - CVE-2026-63735 SurrealDB versions before 3.2.0 fail to validate namespace and database scope in
CVE-2026-63735High 8.1
CVE-2026-63735 CVSS:8.1 SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to… - CVE-2026-13142 The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.
CVE-2026-13142High 8.1
CVE-2026-13142 CVSS:8.1 The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt… - CVE-2026-52349 Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48:
CVE-2026-52349High 7.8
CVE-2026-52349 CVSS:7.8 Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to… - CVE-2026-54910 FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to ver
CVE-2026-54910High 7.7
CVE-2026-54910 CVSS:7.7 FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET… - CVE-2026-63739 SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFI
CVE-2026-63739High 7.7
CVE-2026-63739 CVSS:7.7 SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users… - CVE-2026-64622 Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the co
CVE-2026-64622High 7.5
CVE-2026-64622 CVSS:7.5 Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the… - CVE-2026-63760 SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in
CVE-2026-63760High 7.5
CVE-2026-63760 CVSS:7.5 SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested… - CVE-2026-63747 SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the
CVE-2026-63747High 7.5
CVE-2026-63747 CVSS:7.5 SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a… - CVE-2026-6656 Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks
CVE-2026-6656High 7.5
CVE-2026-6656 CVSS:7.5 Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq… - CVE-2026-12592 The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-c
CVE-2026-12592High 7.5
CVE-2026-12592 CVSS:7.5 The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its… - CVE-2026-42566 Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b
CVE-2026-42566High 7.5
CVE-2026-42566 CVSS:7.5 Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that… - CVE-2026-16252 A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multim
CVE-2026-16252High 7.3
CVE-2026-16252 CVSS:7.3 A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted… - CVE-2026-12080 A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can ex
CVE-2026-12080High 7.3
CVE-2026-12080 CVSS:7.3 A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the… - CVE-2026-64621 FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulne
CVE-2026-64621High 7.3
CVE-2026-64621 CVSS:7.3 FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings()… - CVE-2026-16247 In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is e
CVE-2026-16247High 7.3
CVE-2026-16247 CVSS:7.3 In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing… - CVE-2026-16246 In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed
CVE-2026-16246High 7.3
CVE-2026-16246 CVSS:7.3 In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone… - CVE-2026-14448 An high privileged remote attacker can exploit an authenticated OS command injec
CVE-2026-14448High 7.2
CVE-2026-14448 CVSS:7.2 An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due… - CVE-2026-9833 The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plug
CVE-2026-9833High 7.1
CVE-2026-9833 CVSS:7.1 The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX… - CVE-2026-12970 The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter
CVE-2026-12970High 7.1
CVE-2026-12970 CVSS:7.1 The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading…
⚔️ Sploitus（60 条）
Unknown (60 条)
- Exploit for Command Injection in Microsoft exploit
Exploit for Command Injection in Microsoft exploit - Exploit for Injection in Glpi-Project Glpi exploit
Exploit for Injection in Glpi-Project Glpi exploit
…另有 58 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-22 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV