📊 2026-07-24 漏洞情报日报 · 200 条 · 高危 97
每日漏洞情报汇总 · 2026-07-24
📊 2026-07-24 漏洞情报日报
📋 共 200 条
🔥 高危/严重 97 条
🐙 GitHub-Advisory 70 条 🔥27
🛡️ NVD-Latest 70 条 🔥70
⚔️ Sploitus 60 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-16367 (CVSS 10.0) – Mozilla Firefox/Thunderbird 沙箱逃逸：影响 Firefox 及 Thunderbird 核心组件（Disability Access APIs），攻击者可利用无效指针实现完全沙箱逃逸。无需用户交互即可远程利用。
- Auth.js 多项严重漏洞 (GHSA-7rqj-j65f-68wh,GHSA-8fpg-xm3f-6cx3)：包含邮件认证绕过（Unicode 标准化缺陷）及仅检查 auth 对象存在性的权限提升漏洞。会导致未授权用户登录或绕过认证保护资源。
- CVE-2026-59931 (High) – PhpSpreadsheet SSRF 绕过：WEBSERVICE() 函数的域名白名单可被 HTTP 重定向绕过，攻击者可通过构造恶意 URL 触发内网请求（SSRF），但需要诱导用户打开恶意 Excel 文件。
- CVE-2026-45623 (High) – PostCSS 任意文件读取：CSS 解析器在处理 sourceMappingURL 注释时未进行路径校验，攻击者可在前端构建系统（如 Webpack/Vite）中通过恶意 CSS 实现读取服务器任意文件。
📈 威胁趋势
- 远程代码执行/权限提升：Mozilla Firefox 系列爆发大量严重漏洞（CVE-2026-16367~CVE-2026-16396），涵盖 WebExtensions 权限提升、DOM 网络组件隔离绕过、沙箱逃逸及整数溢出。影响面极广（浏览器+邮件客户端）。
- 资源耗尽/拒绝服务：PhpSpreadsheet 包含两项高风险 DoS 漏洞：Gnumeric 解析器 gzip 无限制解压导致内存耗尽（CVE-2026-59932），以及 OLE 解析器循环链引用导致无限循环（CVE-2026-59933）。pypdf 也存在解析未终止内联图片导致无限循环问题。
- 信息泄露/认证绕过：Auth.js 邮箱标准化缺陷可冒充任意用户登录；PostCSS 可读取任意文件。SSRF 漏洞依然活跃（PhpSpreadsheet 通过重定向绕过白名单）。
🛡️ 缓解建议
- 立即升级Mozilla产品：将 Firefox 升级至 >=153，Thunderbird 升级至 >=153（Firefox ESR 需 >=140.13），以修复 CVE-2026-16367 等9个严重/高危漏洞。
- 更新依赖库：立即更新
@auth/core/next-auth至最新版本（修复 Unicode 标准化绕过）；升级 PhpSpreadsheet 至 >=5.4.1（修复 SSRF 及内存耗尽漏洞）；升级 PostCSS 至最新版（修复路径遍历读取）。 - 限制文件上传与解析：如使用 PhpSpreadsheet 或 pypdf 解析用户上传文件，建议添加文件大小限制（如 < 10MB）、启用沙箱解析，并对 .gnumeric/.xls/.pdf 格式进行预处理安全检查。
- 加固认证配置：对于 Auth.js/NextAuth v5 应用，放弃仅判断
auth对象存在性的校验模式，务必显式检查用户 ID 或 session 有效内容；同时检查邮箱标准化逻辑，启用严格模式。
🐙 GitHub-Advisory（70 条）
Critical (2 条)
- GHSA-7rqj-j65f-68wh - Auth.js: Email normalizer validates the address before Unicode normalization, al Critical
## Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address **before** applying Unicode normalization. An… - GHSA-8fpg-xm3f-6cx3 - Auth.js: Configuration errors can cause existence-based auth checks to fail open Critical
Impact `next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth` object — the pattern shown in the official…
High (25 条)
- GHSA-xmf8-cvqr-rfgj - Auth.js: getToken() throws an uncaught exception on malformed Bearer authorizati High
## Summary The exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization:… - CVE-2026-59931 - PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CVE-2026-59931High
Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist… - CVE-2026-59932 - PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustio
CVE-2026-59932High
## Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied `.gnumeric` files into memory and, when the file starts with gzip magic bytes, calls… - CVE-2026-59933 - PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
CVE-2026-59933High
## Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain… - CVE-2026-45623 - PostCSS: Arbitrary file read and information disclosure via attacker-controlled
CVE-2026-45623High
## Summary PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `PATH` against… - CVE-2026-59936 - pypdf: Possible infinite loop for not terminated inline images
CVE-2026-59936High
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not… - CVE-2026-59935 - pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCI
CVE-2026-59935High
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not… - CVE-2026-47219 - find-my-way: DDoS with HTTP2
CVE-2026-47219High
Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that `lookup()` passes `req.method` into… - GHSA-gf29-4f56-r2jf - n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction High
## Impact Authenticated n8n users with workflow create/execute rights could use the Git node's fetch, pull, or push-tags operations to bypass the… - GHSA-rcv6-pvrj-4xcg - n8n: Authenticated code execution in the n8n Git node High
## Impact Authenticated n8n users with rights to create and execute workflows could achieve code execution on the n8n host. Using the Git node, under the… - GHSA-2x35-3fw4-9jr4 - n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object High
## Impact The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression… - GHSA-gv7g-jm28-cr3m - n8n: Expression sandbox escape via arrow-function bodies enabling command execut High
## Impact An authenticated user with permission to create or modify workflows could abuse crafted expressions using arrow functions to bypass the expression… - GHSA-6qc9-mqvw-jg7x - n8n: Credential Authorization Bypass via Expression in HTTP Request Node `generi High
## Impact An authenticated member with edit access to a shared workflow could reference another user's credential in an HTTP Request node while specifying the… - GHSA-cj9h-qx8g-pq2g - n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow J High
## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline… - GHSA-xmc9-4f2h-jf9c - n8n: Edit Image Node Format Injection Allows Arbitrary File Write High
## Impact The n8n Edit Image node passed its output format to the underlying image library without validation, so a crafted value could write bytes to a… - GHSA-xwx6-jjhv-84p8 - n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Den High
## Impact The Edit Fields (Set) node assigned output fields through a dot-notation path setter without restricting the field name, so an authenticated user… - CVE-2026-59822 - LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
CVE-2026-59822High
Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer… - CVE-2026-10050 - Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentica
CVE-2026-10050High
Summary The `DigestAuthentication.apply()` method in Jetty's HTTP client uses `getBytes(StandardCharsets.ISO_8859_1)` at three locations (lines 171, 179, 196)… - CVE-2024-7708 - Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
CVE-2024-7708High
Impact The original report: > Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state. After…
+NVD-Latest - CVE-2026-64641 - Next.js: Denial of Service in App Router using Server Actions
CVE-2026-64641High
## Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing… - CVE-2026-64642 - Next.js: Middleware / Proxy bypass in App Router applications using Turbopack an
CVE-2026-64642High
## Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a **single** entry in `config.i18n.locales` can bypass… - CVE-2026-64645 - Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destina
CVE-2026-64645High
## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary… - CVE-2026-64649 - Next.js: Server-Side Request Forgery in Server Actions on custom servers
CVE-2026-64649High
## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side… - GHSA-gx64-gj6p-pc4c - JupyterLab: Image viewer allows XSS when opening malicious image in new browser High
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new… - GHSA-pppj-hq3g-57pj - JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.jso High
JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` button in the Settings Editor. Certain…
Medium (39 条)
- GHSA-x445-f3h2-j279 - Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provide Medium
## Summary Auth.js stores the OAuth/OIDC anti-CSRF checks (`state`, `nonce`, and the PKCE verifier) in global cookies that are not bound to the provider that… - CVE-2026-59938 - pypdf: Possible large memory usage for wrong image dimensions
CVE-2026-59938Medium
Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading images where the declared size values… - CVE-2026-59937 - pypdf: Possible long runtimes for repeated malformed cross-reference entries
CVE-2026-59937Medium
Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed… - CVE-2026-53467 - ImageMagick: Information Disclosure in MNG decoder because allocated memory is l
CVE-2026-53467Medium
In the MNG decoder there is a possible heap information disclosure because part of the pixels are left unchanged. - CVE-2026-53666 - React Router: Arbitrary Constructor Injection via deserializeErrors() in React R
CVE-2026-53666Medium
If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to… - CVE-2026-53667 - React Router: RSCErrorHandler Missing Protocol Validation (XSS)
CVE-2026-53667Medium
This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the… - CVE-2026-53668 - React Router: Open redirect leading to XSS
CVE-2026-53668Medium
Applications with open redirects could permit attacker crafted links to result in redirects to unexpected external location or XSS vectors. - CVE-2026-53669 - React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68
CVE-2026-53669Medium
This is a follow up to [CVE-2025-68470](https://github.com/remix-run/react-router/security/advisories/GHSA-9jcx-v3wj-wh4m). React Router was alerted to…
…另有 31 条 Medium 级漏洞（已省略）
Low (4 条)
- CVE-2026-54696 - Ruby json: JSON generator heap buffer overflow when streaming to an IO
CVE-2026-54696Low
Summary `JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the internal JSON generator buffer when a streamed object contains an… - CVE-2026-59819 - LiteLLM: Local file read via request-supplied OIDC file references
CVE-2026-59819Low
Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references in `litellm_params`. A proxy administrator,… - CVE-2026-59821 - LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
CVE-2026-59821Low
Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged…
…另有 1 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（70 条）
Critical (31 条)
- CVE-2026-16367 Sandbox escape due to invalid pointer in the Disability Access APIs component. T
CVE-2026-16367Critical 10.0
CVE-2026-16367 CVSS:10.0 Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and… - CVE-2026-16396 Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 1
CVE-2026-16396Critical 9.8
CVE-2026-16396 CVSS:9.8 Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and… - CVE-2026-16395 Integer overflow in the Audio/Video component. This vulnerability was fixed in F
CVE-2026-16395Critical 9.8
CVE-2026-16395 CVSS:9.8 Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: mozilla firefox - CVE-2026-16389 Incorrect boundary conditions, integer overflow in the Libraries component in NS
CVE-2026-16389Critical 9.8
CVE-2026-16389 CVSS:9.8 Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and… - CVE-2026-16388 Sandbox escape in the DOM: Networking component. This vulnerability was fixed in
CVE-2026-16388Critical 9.8
CVE-2026-16388 CVSS:9.8 Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16387 Site isolation issue in the Networking component. This vulnerability was fixed i
CVE-2026-16387Critical 9.8
CVE-2026-16387 CVSS:9.8 Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and… - CVE-2026-16383 Mitigation bypass in the DOM: Networking component. This vulnerability was fixed
CVE-2026-16383Critical 9.8
CVE-2026-16383 CVSS:9.8 Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153,… - CVE-2026-16382 Mitigation bypass in the DOM: Service Workers component. This vulnerability was
CVE-2026-16382Critical 9.8
CVE-2026-16382 CVSS:9.8 Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16379 Privilege escalation in the DOM: Content Processes component. This vulnerability
CVE-2026-16379Critical 9.8
CVE-2026-16379 CVSS:9.8 Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13,… - CVE-2026-16377 Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in F
CVE-2026-16377Critical 9.8
CVE-2026-16377 CVSS:9.8 Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and… - CVE-2026-16375 Site isolation issue in the Networking: HTTP component. This vulnerability was f
CVE-2026-16375Critical 9.8
CVE-2026-16375 CVSS:9.8 Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird… - CVE-2026-16372 Privilege escalation in the DOM: Content Processes component. This vulnerability
CVE-2026-16372Critical 9.8
CVE-2026-16372 CVSS:9.8 Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16371 Privilege escalation in the DOM: Navigation component. This vulnerability was fi
CVE-2026-16371Critical 9.8
CVE-2026-16371 CVSS:9.8 Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird… - CVE-2026-16369 Integer overflow in the JavaScript: WebAssembly component. This vulnerability wa
CVE-2026-16369Critical 9.8
CVE-2026-16369 CVSS:9.8 Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird… - CVE-2026-16368 Incorrect boundary conditions in the JavaScript: WebAssembly component. This vul
CVE-2026-16368Critical 9.8
CVE-2026-16368 CVSS:9.8 Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR… - CVE-2026-16366 Privilege escalation in the DOM: Navigation component. This vulnerability was fi
CVE-2026-16366Critical 9.8
CVE-2026-16366 CVSS:9.8 Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16365 Privilege escalation in the DOM: Workers component. This vulnerability was fixed
CVE-2026-16365Critical 9.8
CVE-2026-16365 CVSS:9.8 Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16363 JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability
CVE-2026-16363Critical 9.8
CVE-2026-16363 CVSS:9.8 JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13,… - CVE-2026-16361 Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed
CVE-2026-16361Critical 9.8
CVE-2026-16361 CVSS:9.8 Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with… - CVE-2026-16360 Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some o
CVE-2026-16360Critical 9.8
CVE-2026-16360 CVSS:9.8 Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and… - CVE-2026-16358 Site isolation issue in the Graphics: WebRender component. This vulnerability wa
CVE-2026-16358Critical 9.8
CVE-2026-16358 CVSS:9.8 Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR… - CVE-2026-62144 An authentication bypass vulnerability in Check Point Security Management and Mu
CVE-2026-62144Critical 9.1
CVE-2026-62144 CVSS:9.1 An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an… - CVE-2026-16232 An authentication bypass vulnerability in the Check Point SmartConsole login pro
CVE-2026-16232Critical 9.1
CVE-2026-16232 CVSS:9.1 An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to…
+CISA-KEV+PoC-in-GitHu - CVE-2026-16394 Mitigation bypass in the DOM: Security component. This vulnerability was fixed i
CVE-2026-16394Critical 9.1
CVE-2026-16394 CVSS:9.1 Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: mozilla firefox - CVE-2026-16393 Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerabil
CVE-2026-16393Critical 9.1
CVE-2026-16393 CVSS:9.1 Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16390 Mitigation bypass in the Enterprise Policies component. This vulnerability was f
CVE-2026-16390Critical 9.1
CVE-2026-16390 CVSS:9.1 Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird… - CVE-2026-16381 Same-origin policy bypass in the Networking: DNS component. This vulnerability w
CVE-2026-16381Critical 9.1
CVE-2026-16381 CVSS:9.1 Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13,… - CVE-2026-16380 Mitigation bypass in the Networking component. This vulnerability was fixed in F
CVE-2026-16380Critical 9.1
CVE-2026-16380 CVSS:9.1 Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16370 Mitigation bypass in the DOM: Networking component. This vulnerability was fixed
CVE-2026-16370Critical 9.1
CVE-2026-16370 CVSS:9.1 Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16364 Incorrect boundary conditions in the Audio/Video: Playback component. This vulne
CVE-2026-16364Critical 9.1
CVE-2026-16364 CVSS:9.1 Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.… - CVE-2026-16359 Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerabil
CVE-2026-16359Critical 9.1
CVE-2026-16359 CVSS:9.1 Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38,…
High (39 条)
- CVE-2026-65603 The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege
CVE-2026-65603High 8.8
CVE-2026-65603 CVSS:8.8 The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile… - CVE-2026-14551 The servereye client (also known as sensorhub, technically ClientAgentContainerS
CVE-2026-14551High 8.8
CVE-2026-14551 CVSS:8.8 The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to… - CVE-2026-3821 Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14
CVE-2026-3821High 8.8
CVE-2026-3821 CVSS:8.8 Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit… - CVE-2026-12968 The Product Addons and Product Options With Custom Fields WordPress plugin befo
CVE-2026-12968High 8.8
CVE-2026-12968 CVSS:8.8 The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated… - CVE-2026-16362 Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixe
CVE-2026-16362High 8.8
CVE-2026-16362 CVSS:8.8 Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153,… - CVE-2026-13190 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulner
CVE-2026-13190High 8.1
CVE-2026-13190 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type… - CVE-2026-13187 In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider t
CVE-2026-13187High 8.1
CVE-2026-13187 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering… - CVE-2026-13186 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnera
CVE-2026-13186High 8.1
CVE-2026-13186 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider… - CVE-2026-13185 In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cooki
CVE-2026-13185High 8.1
CVE-2026-13185 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or… - CVE-2026-13181 In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata c
CVE-2026-13181High 8.1
CVE-2026-13181 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger… - CVE-2026-4773 Improper validation of specified type of input vulnerability in Magarsus Consult
CVE-2026-4773High 8.1
CVE-2026-4773 CVSS:8.1 Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This…
+GitHub-Advis - CVE-2026-15802 The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion
CVE-2026-15802High 8.1
CVE-2026-15802 CVSS:8.1 The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… - CVE-2026-44191 A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This co
CVE-2026-44191High 7.8
CVE-2026-44191 CVSS:7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from… - CVE-2026-44190 A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Co
CVE-2026-44190High 7.8
CVE-2026-44190 CVSS:7.8 A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote… - CVE-2026-44189 A flaw was found in the Visual Studio Code Ansible Lightspeed extension's Ansibl
CVE-2026-44189High 7.8
CVE-2026-44189 CVSS:7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection… - CVE-2026-61390 There is a heap buffer overflow vulnerability in some Hikvision cameras, which m
CVE-2026-61390High 7.7
CVE-2026-61390 CVSS:7.7 There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device… - CVE-2026-11605 The issue is a resource exhaustion vulnerability associated with DNSSEC validati
CVE-2026-11605High 7.5
CVE-2026-11605 CVSS:7.5 The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an… - CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME
CVE-2026-11331High 7.5
CVE-2026-11331 CVSS:7.5 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a… - CVE-2026-62145 A vulnerability in Check Point Gaia Portal allows an authenticated attacker with
CVE-2026-62145High 7.5
CVE-2026-62145 CVSS:7.5 A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands… - CVE-2026-55973 In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporti
CVE-2026-55973High 7.5
CVE-2026-55973 CVSS:7.5 In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code… - CVE-2026-44690 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation
CVE-2026-44690High 7.5
CVE-2026-44690 CVSS:7.5 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache… - CVE-2026-40691 In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received o
CVE-2026-40691High 7.5
CVE-2026-40691 CVSS:7.5 In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place… - CVE-2026-32665 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-ove
CVE-2026-32665High 7.5
CVE-2026-32665 CVSS:7.5 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional… - CVE-2026-13189 In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation
CVE-2026-13189High 7.5
CVE-2026-13189 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler… - CVE-2026-13184 In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.Conf
CVE-2026-13184High 7.5
CVE-2026-13184 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not… - CVE-2026-13183 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload me
CVE-2026-13183High 7.5
CVE-2026-13183 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity… - CVE-2026-13182 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-st
CVE-2026-13182High 7.5
CVE-2026-13182 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from… - CVE-2026-57600 Insufficient validation of input parameters in the firmware of some Hikvision ca
CVE-2026-57600High 7.5
CVE-2026-57600 CVSS:7.5 Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve… - CVE-2026-63047 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect AC
CVE-2026-63047High 7.5
CVE-2026-63047 CVSS:7.5 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla… - CVE-2026-12987 The Events Manager WordPress plugin before 7.3.7 does not safely handle booking
CVE-2026-12987High 7.5
CVE-2026-12987 CVSS:7.5 The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account… - CVE-2026-16391 Information disclosure in the Storage: IndexedDB component. This vulnerability w
CVE-2026-16391High 7.5
CVE-2026-16391 CVSS:7.5 Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13,… - CVE-2026-16386 Information disclosure due to uninitialized memory in the Graphics: WebGPU compo
CVE-2026-16386High 7.5
CVE-2026-16386 CVSS:7.5 Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and… - CVE-2026-16385 Information disclosure due to uninitialized memory in the Graphics: WebGPU compo
CVE-2026-16385High 7.5
CVE-2026-16385 CVSS:7.5 Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and… - CVE-2026-16384 Information disclosure due to uninitialized memory in the Graphics: WebGPU compo
CVE-2026-16384High 7.5
CVE-2026-16384 CVSS:7.5 Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and… - CVE-2026-16378 Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerabili
CVE-2026-16378High 7.5
CVE-2026-16378 CVSS:7.5 Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16376 Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixe
CVE-2026-16376High 7.5
CVE-2026-16376 CVSS:7.5 Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. 产品: - CVE-2026-16374 Information disclosure in the Framework component in DevTools. This vulnerabilit
CVE-2026-16374High 7.5
CVE-2026-16374 CVSS:7.5 Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13,… - CVE-2026-16373 Information disclosure in the Privacy component in Firefox for Android. This vul
CVE-2026-16373High 7.5
CVE-2026-16373 CVSS:7.5 Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. 产品: - CVE-2026-61391 There is a stack-based buffer overflow vulnerability in some Hikvision cameras,
CVE-2026-61391High 7.2
CVE-2026-61391 CVSS:7.2 There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device…
⚔️ Sploitus（60 条）
Unknown (60 条)
- labymod-poc exploit
labymod-poc exploit - Exploit for CVE-2026-65971 exploit
CVE-2026-65971
Exploit for CVE-2026-65971 exploit
…另有 58 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-24 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV