📊 2026-07-25 漏洞情报日报 · 200 条 · 高危 109
每日漏洞情报汇总 · 2026-07-25
📊 2026-07-25 漏洞情报日报
📋 共 200 条
🔥 高危/严重 109 条
🐙 GitHub-Advisory 70 条 🔥43
🛡️ NVD-Latest 66 条 🔥66
⚔️ Sploitus 64 条
🤖 今日安全态势分析
（今日数据暂无足够信息生成分析）
🐙 GitHub-Advisory（70 条）
Critical (7 条)
- GHSA-68r5-9hpg-7qw9 - OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv Critical
The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without… - GHSA-p279-2cqp-84jg - OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check Critical
Summary When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, PlainSASLMechanismHandler verified only the… - GHSA-vh45-f885-3848 - sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.rand Critical
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single… - GHSA-f25v-x6vr-962g - Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Cu Critical
## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by… - GHSA-w4hw-qcx7-56pr - Shescape: Shell injection via unescaped parentheses on Windows with CMD Critical
Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and… - GHSA-7rqj-j65f-68wh - Auth.js: Email normalizer validates the address before Unicode normalization, al Critical
## Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address **before** applying Unicode normalization. An… - GHSA-8fpg-xm3f-6cx3 - Auth.js: Configuration errors can cause existence-based auth checks to fail open Critical
Impact `next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth` object — the pattern shown in the official…
High (36 条)
- GHSA-hr66-5mqr-8mpx - Budibase: Unauthenticated user information disclosure via public tenant user lo High
#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:id`) that returns sensitive user… - GHSA-qw6m-8fw2-2v64 - Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Exe High
## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injection through user-supplied query… - GHSA-2xgg-r2wc-c5r2 - Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database C High
Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same original disclosure… - GHSA-pvcr-8mvp-w8qr - Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) High
Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **external chat identity** (Slack/Discord/MS… - GHSA-pmpg-2mxq-6xwr - Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS ex High
## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope… - GHSA-v42f-v8xc-j435 - Budibase: SSRF via DNS rebinding in the REST datasource integration
CVE-2026-54353High
Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP… - GHSA-94p4-4cq8-9g67 - GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.a High
## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped… - GHSA-g3hq-hphg-8fhh - Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE High
Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects shell metacharacters. The allowlist is… - GHSA-g5vv-q72c-7j78 - @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion High
Summary `@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never… - GHSA-26gq-p25f-99cp - frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via High
## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire `frps`… - GHSA-47w6-gwp4-w6vc - vantage6: Algorithm developer can edit another developer's algorithm that is pen High
Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image… - CVE-2026-14257 - brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro
CVE-2026-14257High
Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups,… - GHSA-h4hf-v6w5-897x - Poweradmin: API user-update endpoint leads to a non-admin reset any user's passw High
Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce two authorization rules that the web… - GHSA-rm67-g9ch-vxff - Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records High
## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (also reachable in the 4.x release line —… - GHSA-cmwh-g2h8-c222 - Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeove High
## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`. In the MySQL schema, the OIDC link table… - GHSA-mhvj-jhpq-885v - blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parse High
Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/org/http4s/blaze/http/parser/`) cause… - GHSA-46q4-43ph-c6fr - blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server High
Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, an unauthenticated… - GHSA-7ppr-r889-mcf2 - blaze: Unbounded WebSocket message aggregation in http4s-blaze-server High
## Summary `http4s-blaze-server` aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that… - GHSA-95cv-r8x4-vh75 - OpenList: Authenticated users can rename files outside their base path via batch High
Summary The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects path separators in `new_name`, but it does… - CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
CVE-2026-16584High
## Summary The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources… - GHSA-gm3r-q2wp-hw87 - Shescape: Quadratic-time denial of service in the flag-protection High
Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a… - GHSA-fp43-vj7g-pg92 - OmniFaces: Forged combined-resource IDs and related output/push boundaries
CVE-2026-41883High
## 1. Forged combined-resource IDs `CombinedResourceInfo` accepts a path-derived ID without an authenticity check, inflates it without an output limit,… - GHSA-6xj8-qv9j-xcjq - Oh My Posh: Arbitrary command execution via template injection in the path segme High
Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go `text/template` engine.… - GHSA-hmj8-5xmh-5573 - libp2p: yamux connection DoS via oversized data frame High
Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any… - CVE-2026-16756 - Smithy-RS: Allocation of resources without limits in the default aws-smithy-http
CVE-2026-16756High
## Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the… - GHSA-xg4h-6gfc-h4m8 - etcd: Watch API authorization bypass via open-ended range requests High
Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key can use the Watch gRPC API with… - CVE-2026-16796 - AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Pyt
CVE-2026-16796High
Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs… - GHSA-6vch-q96h-7gc3 - etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no dea High
Impact _What kind of vulnerability is it? Who is impacted?_ A network attacker who can reach an etcd TLS listener can open many TCP connections and never send… - GHSA-xmf8-cvqr-rfgj - Auth.js: getToken() throws an uncaught exception on malformed Bearer authorizati High
## Summary The exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization:… - CVE-2026-59931 - PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CVE-2026-59931High
Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypassed via HTTP redirect. The whitelist… - CVE-2026-59932 - PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustio
CVE-2026-59932High
## Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied `.gnumeric` files into memory and, when the file starts with gzip magic bytes, calls… - CVE-2026-59933 - PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
CVE-2026-59933High
## Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain… - CVE-2026-45623 - PostCSS: Arbitrary file read and information disclosure via attacker-controlled
CVE-2026-45623High
## Summary PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `PATH` against… - CVE-2026-59936 - pypdf: Possible infinite loop for not terminated inline images
CVE-2026-59936High
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not… - CVE-2026-59935 - pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCI
CVE-2026-59935High
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not… - CVE-2026-47219 - find-my-way: DDoS with HTTP2
CVE-2026-47219High
Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that `lookup()` passes `req.method` into…
Medium (25 条)
- GHSA-gh4h-34gr-87r7 - Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Othe Medium
## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the… - GHSA-cr7p-cr3q-h5cm - Budibase: Account Enumeration via Login Lockout Response Differential Medium
## Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email… - GHSA-hfhx-w8p8-4hc7 - Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Medium
# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `packages/server/src/utilities/fileUtils.ts`… - GHSA-c534-2w9c-x7fm - Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC a Medium
## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters.… - GHSA-f45q-w629-wr25 - Hubuum client library (Rust): Authenticated requests may escape the configured b Medium
## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and… - GHSA-qqc3-94qv-7fw3 - Hubuum client library (Rust): Configured custom transports may be bypassed, expo Medium
## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client… - GHSA-v6w6-358x-2433 - Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests Medium
## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept attacker-controlled node definitions and… - CVE-2026-64785 - swift-nio-http2: Missing CR/LF/NUL validation in header values
CVE-2026-64785Medium
## Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend…
…另有 17 条 Medium 级漏洞（已省略）
Low (2 条)
- GHSA-2625-rw7m-5q5x - Hubuum client library (Rust): Sensitive data may be exposed through default diag Low
## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format… - CVE-2026-54696 - Ruby json: JSON generator heap buffer overflow when streaming to an IO
CVE-2026-54696Low
Summary `JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the internal JSON generator buffer when a streamed object contains an…
🛡️ NVD-Latest（66 条）
Critical (8 条)
- CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custo
CVE-2026-64873Critical 9.8
CVE-2026-64873 CVSS:9.8 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network… - CVE-2026-15015 The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable t
CVE-2026-15015Critical 9.8
CVE-2026-15015 CVSS:9.8 The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… - CVE-2026-15011 The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable
CVE-2026-15011Critical 9.8
CVE-2026-15011 CVSS:9.8 The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all… - CVE-2026-14282 The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folde
CVE-2026-14282Critical 9.8
CVE-2026-14282 CVSS:9.8 The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is… - CVE-2026-27064 Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
CVE-2026-27064Critical 9.1
CVE-2026-27064 CVSS:9.1 Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. 产品: - CVE-2026-62144 An authentication bypass vulnerability in Check Point Security Management and Mu
CVE-2026-62144Critical 9.1
CVE-2026-62144 CVSS:9.1 An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an… - CVE-2026-16232 An authentication bypass vulnerability in the Check Point SmartConsole login pro
CVE-2026-16232Critical 9.1
CVE-2026-16232 CVSS:9.1 An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to…
+CISA-KEV+PoC-in-GitHu - CVE-2026-16723 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.
CVE-2026-16723Critical 9.0
CVE-2026-16723 CVSS:9.0 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under…
High (58 条)
- CVE-2026-16745 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShif
CVE-2026-16745High 8.8
CVE-2026-16745 CVSS:8.8 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a… - CVE-2026-15017 The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escala
CVE-2026-15017High 8.8
CVE-2026-15017 CVSS:8.8 The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4.… - CVE-2026-65603 The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege
CVE-2026-65603High 8.8
CVE-2026-65603 CVSS:8.8 The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile… - CVE-2026-14551 The servereye client (also known as sensorhub, technically ClientAgentContainerS
CVE-2026-14551High 8.8
CVE-2026-14551 CVSS:8.8 The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to… - CVE-2026-3821 Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14
CVE-2026-3821High 8.8
CVE-2026-3821 CVSS:8.8 Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit… - CVE-2026-12968 The Product Addons and Product Options With Custom Fields WordPress plugin befo
CVE-2026-12968High 8.8
CVE-2026-12968 CVSS:8.8 The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated… - CVE-2026-25405 Contributor SQL Injection in eRoom <= 1.7.1 versions.
CVE-2026-25405High 8.5
CVE-2026-25405 CVSS:8.5 Contributor SQL Injection in eRoom <= 1.7.1 versions. 产品: - CVE-2026-24552 Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.
CVE-2026-24552High 8.5
CVE-2026-24552 CVSS:8.5 Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions. 产品: - CVE-2024-58023 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allow
CVE-2024-58023High 8.4
CVE-2024-58023 CVSS:8.4 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. 产品: - CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege
CVE-2026-65757High 8.1
CVE-2026-65757 CVSS:8.1 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup… - CVE-2026-13190 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulner
CVE-2026-13190High 8.1
CVE-2026-13190 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type… - CVE-2026-13187 In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider t
CVE-2026-13187High 8.1
CVE-2026-13187 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering… - CVE-2026-13186 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnera
CVE-2026-13186High 8.1
CVE-2026-13186 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider… - CVE-2026-13185 In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cooki
CVE-2026-13185High 8.1
CVE-2026-13185 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or… - CVE-2026-13181 In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata c
CVE-2026-13181High 8.1
CVE-2026-13181 CVSS:8.1 In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger… - CVE-2026-4773 Improper validation of specified type of input vulnerability in Magarsus Consult
CVE-2026-4773High 8.1
CVE-2026-4773 CVSS:8.1 Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This…
+GitHub-Advis - CVE-2026-15802 The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion
CVE-2026-15802High 8.1
CVE-2026-15802 CVSS:8.1 The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the… - CVE-2026-16287 Improper neutralization of special elements used in an OS command ('OS command i
CVE-2026-16287High 7.8
CVE-2026-16287 CVSS:7.8 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software… - CVE-2026-44191 A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This co
CVE-2026-44191High 7.8
CVE-2026-44191 CVSS:7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from… - CVE-2026-44190 A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Co
CVE-2026-44190High 7.8
CVE-2026-44190 CVSS:7.8 A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote… - CVE-2026-44189 A flaw was found in the Visual Studio Code Ansible Lightspeed extension's Ansibl
CVE-2026-44189High 7.8
CVE-2026-44189 CVSS:7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection… - CVE-2026-61390 There is a heap buffer overflow vulnerability in some Hikvision cameras, which m
CVE-2026-61390High 7.7
CVE-2026-61390 CVSS:7.7 There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device… - CVE-2026-64611 A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function
CVE-2026-64611High 7.5
CVE-2026-64611 CVSS:7.5 A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a… - CVE-2026-52688 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
CVE-2026-52688High 7.5
CVE-2026-52688 CVSS:7.5 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation 产品: - CVE-2024-58330 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 a
CVE-2024-58330High 7.5
CVE-2024-58330 CVSS:7.5 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video… - CVE-2026-9713 The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable t
CVE-2026-9713High 7.5
CVE-2026-9713 CVSS:7.5 The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in… - CVE-2026-14291 The security-ninja-premium WordPress plugin before 5.290 does not verify the sec
CVE-2026-14291High 7.5
CVE-2026-14291 CVSS:7.5 The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor… - CVE-2026-12082 The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization
CVE-2026-12082High 7.5
CVE-2026-12082 CVSS:7.5 The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing… - CVE-2026-15074 @fastify/static up to and including version 10.1.0 fails to reject dot-dot path
CVE-2026-15074High 7.5
CVE-2026-15074 CVSS:7.5 @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the… - CVE-2026-11605 The issue is a resource exhaustion vulnerability associated with DNSSEC validati
CVE-2026-11605High 7.5
CVE-2026-11605 CVSS:7.5 The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an… - CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME
CVE-2026-11331High 7.5
CVE-2026-11331 CVSS:7.5 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a… - CVE-2026-62145 A vulnerability in Check Point Gaia Portal allows an authenticated attacker with
CVE-2026-62145High 7.5
CVE-2026-62145 CVSS:7.5 A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands… - CVE-2026-55973 In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporti
CVE-2026-55973High 7.5
CVE-2026-55973 CVSS:7.5 In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code… - CVE-2026-44690 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation
CVE-2026-44690High 7.5
CVE-2026-44690 CVSS:7.5 In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache… - CVE-2026-40691 In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received o
CVE-2026-40691High 7.5
CVE-2026-40691 CVSS:7.5 In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place… - CVE-2026-32665 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-ove
CVE-2026-32665High 7.5
CVE-2026-32665 CVSS:7.5 In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional… - CVE-2026-13189 In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation
CVE-2026-13189High 7.5
CVE-2026-13189 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler… - CVE-2026-13184 In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.Conf
CVE-2026-13184High 7.5
CVE-2026-13184 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not… - CVE-2026-13183 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload me
CVE-2026-13183High 7.5
CVE-2026-13183 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity… - CVE-2026-13182 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-st
CVE-2026-13182High 7.5
CVE-2026-13182 CVSS:7.5 In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from… - CVE-2026-57600 Insufficient validation of input parameters in the firmware of some Hikvision ca
CVE-2026-57600High 7.5
CVE-2026-57600 CVSS:7.5 Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve… - CVE-2026-63047 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect AC
CVE-2026-63047High 7.5
CVE-2026-63047 CVSS:7.5 Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla… - CVE-2026-12987 The Events Manager WordPress plugin before 7.3.7 does not safely handle booking
CVE-2026-12987High 7.5
CVE-2026-12987 CVSS:7.5 The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account… - CVE-2026-16632 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the functio
CVE-2026-16632High 7.3
CVE-2026-16632 CVSS:7.3 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library… - CVE-2026-12421 The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
CVE-2026-12421High 7.2
CVE-2026-12421 CVSS:7.2 The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and… - CVE-2026-7534 The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Sto
CVE-2026-7534High 7.2
CVE-2026-7534 CVSS:7.2 The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint… - CVE-2026-7232 The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2026-7232High 7.2
CVE-2026-7232 CVSS:7.2 The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up… - CVE-2026-61391 There is a stack-based buffer overflow vulnerability in some Hikvision cameras,
CVE-2026-61391High 7.2
CVE-2026-61391 CVSS:7.2 There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device… - CVE-2026-57701 Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5
CVE-2026-57701High 7.1
CVE-2026-57701 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. 产品: - CVE-2026-57699 Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.
CVE-2026-57699High 7.1
CVE-2026-57699 CVSS:7.1 Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. 产品: - CVE-2026-57696 Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
CVE-2026-57696High 7.1
CVE-2026-57696 CVSS:7.1 Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. 产品: - CVE-2026-57626 Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Re
CVE-2026-57626High 7.1
CVE-2026-57626 CVSS:7.1 Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0… - CVE-2026-57428 Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.
CVE-2026-57428High 7.1
CVE-2026-57428 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. 产品: - CVE-2026-57427 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <=
CVE-2026-57427High 7.1
CVE-2026-57427 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions. 产品: - CVE-2026-57397 Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
CVE-2026-57397High 7.1
CVE-2026-57397 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. 产品: - CVE-2026-57374 Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3
CVE-2026-57374High 7.1
CVE-2026-57374 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions. 产品: - CVE-2026-57370 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statisti
CVE-2026-57370High 7.1
CVE-2026-57370 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. 产品: - CVE-2026-57367 Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
CVE-2026-57367High 7.1
CVE-2026-57367 CVSS:7.1 Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. 产品:
⚔️ Sploitus（64 条）
Unknown (64 条)
- Exploit for CVE-2026-64600 exploit
CVE-2026-64600
Exploit for CVE-2026-64600 exploit - Exploit for Code Injection in Langflow exploit
Exploit for Code Injection in Langflow exploit
…另有 62 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-25 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV