📊 2026-07-26 漏洞情报日报 · 200 条 · 高危 106
每日漏洞情报汇总 · 2026-07-26
📊 2026-07-26 漏洞情报日报
📋 共 200 条
🔥 高危/严重 106 条
🐙 GitHub-Advisory 50 条 🔥33
🛡️ NVD-Latest 73 条 🔥73
⚔️ Sploitus 77 条
🤖 今日安全态势分析
🎯 今日重点关注
- OpenDJ 双重高危漏洞：GHSA-68r5 (未认证SSRF/本地文件读取/DoS) 与 GHSA-p279 (SASL PLAIN认证绕过)。攻击者无需认证即可利用网关进行内网扫描、读取任意文件或绕过代理权限检查，实现权限提升。
- sm-crypto SM2密钥可预测（GHSA-vh45）：Node.js密码学库sm-crypto 0.4.0因使用模块级单例RNG，导致SM2私钥和签名随机数可被预测，严重威胁基于SM2的加密通信安全。
- Azure 多服务权限提升链（CVE-2026-58630、CVE-2026-56163、CVE-2026-62825等CVSS 10.0）：Azure App Service、AKS、Key Vault、DNS均存在认证/授权缺失，未授权攻击者可通过网络直接提升权限，影响大规模云租户。
- Pheditor 默认密码绕过（GHSA-f25v）：强制密码修改流程未验证原密码，攻击者提交任意非空值即可绕过认证接管管理员账户，风险极高。
📈 威胁趋势
- 权限提升/认证绕过：OpenDJ、Azure全系（App Service、AKS、Key Vault、DNS）、Exchange Online、Pheditor，共8项，是今日最突出的攻击面。
- 服务器端请求伪造（SSRF）：OpenDJ、Data Quality（CVE-2026-57106），常导致内网渗透和信息泄露。
- 信息泄露：Budibase未认证API泄露用户邮箱/SSO ID；OpenDJ本地文件读取。
- SQL/NoSQL注入：Budibase MongoDB NoSQL注入与MySQL Backtick注入，可导致数据篡改或读取。
- 远程代码执行（RCE）：Microsoft Surface输入验证（CVE-2026-54120）、M365 Copilot反序列化（CVE-2026-50517），均需认证但影响面广。
- 加密缺陷：sm-crypto SM2密钥预测，影响密码学基础设施。
- 拒绝服务（DoS）：OpenDJ未限制读取大小，可导致内存耗尽。
- Shell注入：Shescape在Windows CMD下未转义括号，可被注入恶意命令。
🛡️ 缓解建议
- 立即升级/停用受影响的OpenDJ组件：如无法升级，建议关闭DSMLv2 SOAP网关服务，并限制对SASL PLAIN机制的使用；同时监控异常SSRF出站流量。
- 更新sm-crypto至修复版本：当前0.4.0为最新版，建议联系维护方或临时替换为其他SM2实现（如国密标准库），并为已生成密钥轮换。
- 集中修复Azure系列漏洞：优先为Azure App Service、AKS、Key Vault、DNS、Exchange Online等应用微软发布的补丁或安全配置（如启用托管身份、限制公网访问）。
- 检查并更新其他受影响中间件：针对Pheditor、Budibase、Shescape等，立即升级至修复后的版本；若无补丁，启用额外认证校验（如强制密码复杂度、限制API公网暴露）。
🐙 GitHub-Advisory（50 条）
Critical (5 条)
- GHSA-68r5-9hpg-7qw9 - OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv Critical
The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without… - GHSA-p279-2cqp-84jg - OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check Critical
Summary When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, PlainSASLMechanismHandler verified only the… - GHSA-vh45-f885-3848 - sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.rand Critical
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single… - GHSA-f25v-x6vr-962g - Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Cu Critical
## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by… - GHSA-w4hw-qcx7-56pr - Shescape: Shell injection via unescaped parentheses on Windows with CMD Critical
Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the default shell being CMD, using the `escape` and…
High (28 条)
- GHSA-hr66-5mqr-8mpx - Budibase: Unauthenticated user information disclosure via public tenant user lo High
#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:id`) that returns sensitive user… - GHSA-qw6m-8fw2-2v64 - Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Exe High
## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injection through user-supplied query… - GHSA-2xgg-r2wc-c5r2 - Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database C High
Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same original disclosure… - GHSA-pvcr-8mvp-w8qr - Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) High
Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **external chat identity** (Slack/Discord/MS… - GHSA-pmpg-2mxq-6xwr - Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS ex High
## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope… - GHSA-v42f-v8xc-j435 - Budibase: SSRF via DNS rebinding in the REST datasource integration
CVE-2026-54353High
Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP… - GHSA-94p4-4cq8-9g67 - GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.a High
## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped… - GHSA-g3hq-hphg-8fhh - Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE High
Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects shell metacharacters. The allowlist is… - GHSA-g5vv-q72c-7j78 - @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion High
Summary `@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never… - GHSA-26gq-p25f-99cp - frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via High
## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire `frps`… - GHSA-47w6-gwp4-w6vc - vantage6: Algorithm developer can edit another developer's algorithm that is pen High
Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image… - CVE-2026-14257 - brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro
CVE-2026-14257High
Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups,… - GHSA-h4hf-v6w5-897x - Poweradmin: API user-update endpoint leads to a non-admin reset any user's passw High
Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce two authorization rules that the web… - GHSA-rm67-g9ch-vxff - Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records High
## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (also reachable in the 4.x release line —… - GHSA-cmwh-g2h8-c222 - Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeove High
## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`. In the MySQL schema, the OIDC link table… - GHSA-mhvj-jhpq-885v - blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parse High
Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/org/http4s/blaze/http/parser/`) cause… - GHSA-46q4-43ph-c6fr - blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server High
Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, an unauthenticated… - GHSA-7ppr-r889-mcf2 - blaze: Unbounded WebSocket message aggregation in http4s-blaze-server High
## Summary `http4s-blaze-server` aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that… - GHSA-95cv-r8x4-vh75 - OpenList: Authenticated users can rename files outside their base path via batch High
Summary The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects path separators in `new_name`, but it does… - CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
CVE-2026-16584High
## Summary The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources… - GHSA-gm3r-q2wp-hw87 - Shescape: Quadratic-time denial of service in the flag-protection High
Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a… - GHSA-fp43-vj7g-pg92 - OmniFaces: Forged combined-resource IDs and related output/push boundaries
CVE-2026-41883High
## 1. Forged combined-resource IDs `CombinedResourceInfo` accepts a path-derived ID without an authenticity check, inflates it without an output limit,… - GHSA-6xj8-qv9j-xcjq - Oh My Posh: Arbitrary command execution via template injection in the path segme High
Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go `text/template` engine.… - GHSA-hmj8-5xmh-5573 - libp2p: yamux connection DoS via oversized data frame High
Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any… - CVE-2026-16756 - Smithy-RS: Allocation of resources without limits in the default aws-smithy-http
CVE-2026-16756High
## Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the… - GHSA-xg4h-6gfc-h4m8 - etcd: Watch API authorization bypass via open-ended range requests High
Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key can use the Watch gRPC API with… - CVE-2026-16796 - AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Pyt
CVE-2026-16796High
Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs… - GHSA-6vch-q96h-7gc3 - etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no dea High
Impact _What kind of vulnerability is it? Who is impacted?_ A network attacker who can reach an etcd TLS listener can open many TCP connections and never send…
Medium (16 条)
- GHSA-gh4h-34gr-87r7 - Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Othe Medium
## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the… - GHSA-cr7p-cr3q-h5cm - Budibase: Account Enumeration via Login Lockout Response Differential Medium
## Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email… - GHSA-hfhx-w8p8-4hc7 - Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Medium
# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `packages/server/src/utilities/fileUtils.ts`… - GHSA-c534-2w9c-x7fm - Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC a Medium
## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters.… - GHSA-f45q-w629-wr25 - Hubuum client library (Rust): Authenticated requests may escape the configured b Medium
## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and… - GHSA-qqc3-94qv-7fw3 - Hubuum client library (Rust): Configured custom transports may be bypassed, expo Medium
## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client… - GHSA-v6w6-358x-2433 - Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests Medium
## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept attacker-controlled node definitions and… - CVE-2026-64785 - swift-nio-http2: Missing CR/LF/NUL validation in header values
CVE-2026-64785Medium
## Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend…
…另有 8 条 Medium 级漏洞（已省略）
Low (1 条)
- GHSA-2625-rw7m-5q5x - Hubuum client library (Rust): Sensitive data may be exposed through default diag Low
## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format…
🛡️ NVD-Latest（73 条）
Critical (18 条)
- CVE-2026-58630 Improper access control in Azure App Service allows an unauthorized attacker to
CVE-2026-58630Critical 10.0
CVE-2026-58630 CVSS:10.0 Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-57106 Server-side request forgery (ssrf) in Data Quality allows an unauthorized attack
CVE-2026-57106Critical 10.0
CVE-2026-57106 CVSS:10.0 Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-56163 Missing authentication for critical function in Microsoft Azure Kubernetes Servi
CVE-2026-56163Critical 10.0
CVE-2026-56163 CVSS:10.0 Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate… - CVE-2026-62825 Improper authentication in Azure Key Vault allows an unauthorized attacker to el
CVE-2026-62825Critical 10.0
CVE-2026-62825 CVSS:10.0 Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-58275 Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr
CVE-2026-58275Critical 10.0
CVE-2026-58275 CVSS:10.0 Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-56191 Improper authentication in Microsoft Exchange Online allows an unauthorized atta
CVE-2026-56191Critical 10.0
CVE-2026-56191 CVSS:10.0 Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. 产品: - CVE-2026-54120 Improper input validation in Microsoft Surface allows an authorized attacker to
CVE-2026-54120Critical 9.9
CVE-2026-54120 CVSS:9.9 Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. 产品: - CVE-2026-50517 Deserialization of untrusted data in M365 Copilot allows an authorized attacker
CVE-2026-50517Critical 9.9
CVE-2026-50517 CVSS:9.9 Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. 产品: - CVE-2026-15704 In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled
CVE-2026-15704Critical 9.8
CVE-2026-15704 CVSS:9.8 In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass… - CVE-2026-56165 Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker
CVE-2026-56165Critical 9.8
CVE-2026-56165 CVSS:9.8 Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network. 产品: - CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custo
CVE-2026-64873Critical 9.8
CVE-2026-64873 CVSS:9.8 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network… - CVE-2026-15015 The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable t
CVE-2026-15015Critical 9.8
CVE-2026-15015 CVSS:9.8 The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… - CVE-2026-15011 The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable
CVE-2026-15011Critical 9.8
CVE-2026-15011 CVSS:9.8 The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all… - CVE-2026-14282 The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folde
CVE-2026-14282Critical 9.8
CVE-2026-14282 CVSS:9.8 The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is… - CVE-2026-12877 The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5
CVE-2026-12877Critical 9.1
CVE-2026-12877 CVSS:9.1 The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input… - CVE-2026-56160 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att
CVE-2026-56160Critical 9.1
CVE-2026-56160 CVSS:9.1 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. 产品: - CVE-2026-27064 Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
CVE-2026-27064Critical 9.1
CVE-2026-27064 CVSS:9.1 Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. 产品: - CVE-2026-16723 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.
CVE-2026-16723Critical 9.0
CVE-2026-16723 CVSS:9.0 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under…
+PoC-in-GitHu
High (55 条)
- CVE-2026-16801 Improper control of generation of code ('Code Injection') in the variables featu
CVE-2026-16801High 8.8
CVE-2026-16801 CVSS:8.8 Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and… - CVE-2026-16800 Improper control of generation of code ('Code Injection') in the schedule featur
CVE-2026-16800High 8.8
CVE-2026-16800 CVSS:8.8 Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and… - CVE-2026-45813 Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apa
CVE-2026-45813High 8.8
CVE-2026-45813 CVSS:8.8 Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when… - CVE-2026-16870 Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior
CVE-2026-16870High 8.8
CVE-2026-16870 CVSS:8.8 Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and… - CVE-2026-16745 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShif
CVE-2026-16745High 8.8
CVE-2026-16745 CVSS:8.8 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a… - CVE-2026-15017 The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escala
CVE-2026-15017High 8.8
CVE-2026-15017 CVSS:8.8 The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4.… - CVE-2026-56167 Server-side request forgery (ssrf) in Azure AI Search allows an authorized attac
CVE-2026-56167High 8.5
CVE-2026-56167 CVSS:8.5 Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. 产品: - CVE-2026-25405 Contributor SQL Injection in eRoom <= 1.7.1 versions.
CVE-2026-25405High 8.5
CVE-2026-25405 CVSS:8.5 Contributor SQL Injection in eRoom <= 1.7.1 versions. 产品: - CVE-2026-24552 Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.
CVE-2026-24552High 8.5
CVE-2026-24552 CVSS:8.5 Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions. 产品: - CVE-2026-66140 Exim before 4.99.5 allows directory traversal to access files outside of the spo
CVE-2026-66140High 8.4
CVE-2026-66140 CVSS:8.4 Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because… - CVE-2024-58023 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allow
CVE-2024-58023High 8.4
CVE-2024-58023 CVSS:8.4 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. 产品: - CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege
CVE-2026-65757High 8.1
CVE-2026-65757 CVSS:8.1 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup… - CVE-2026-12736 The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in vers
CVE-2026-12736High 8.0
CVE-2026-12736 CVSS:8.0 The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the… - CVE-2026-35425 Improper access control in Azure API Management (APIM) allows an authorized atta
CVE-2026-35425High 8.0
CVE-2026-35425 CVSS:8.0 Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. 产品: - CVE-2026-49745 Kernel software installed and running inside a Guest VM may post improper comman
CVE-2026-49745High 7.8
CVE-2026-49745 CVSS:7.8 Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data… - CVE-2026-49744 Kernel software installed and running inside a Guest VM may post improper comman
CVE-2026-49744High 7.8
CVE-2026-49744 CVSS:7.8 Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data… - CVE-2026-49743 Software installed and run as a non-privileged user may conduct improper GPU sys
CVE-2026-49743High 7.8
CVE-2026-49743 CVSS:7.8 Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of… - CVE-2026-14172 Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables
CVE-2026-14172High 7.8
CVE-2026-14172 CVSS:7.8 Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file… - CVE-2026-16287 Improper neutralization of special elements used in an OS command ('OS command i
CVE-2026-16287High 7.8
CVE-2026-16287 CVSS:7.8 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software… - CVE-2026-66144 Although remote policy references are not retrieved during policy normalization,
CVE-2026-66144High 7.5
CVE-2026-66144 CVSS:7.5 Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can… - CVE-2026-66143 It is possible to bypass the maximum number of normalized policy alternatives th
CVE-2026-66143High 7.5
CVE-2026-66143 CVSS:7.5 It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain… - CVE-2026-66142 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that
CVE-2026-66142High 7.5
CVE-2026-66142 CVSS:7.5 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures,… - CVE-2026-45816 NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Requ
CVE-2026-45816High 7.5
CVE-2026-45816 CVSS:7.5 NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise… - CVE-2026-45815 Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read
CVE-2026-45815High 7.5
CVE-2026-45815 CVSS:7.5 Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response… - CVE-2026-45811 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerabi
CVE-2026-45811High 7.5
CVE-2026-45811 CVSS:7.5 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not… - CVE-2026-14603 The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have
CVE-2026-14603High 7.5
CVE-2026-14603 CVSS:7.5 The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing… - CVE-2026-12981 The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication
CVE-2026-12981High 7.5
CVE-2026-12981 CVSS:7.5 The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords,… - CVE-2026-12497 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User
CVE-2026-12497High 7.5
CVE-2026-12497 CVSS:7.5 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before… - CVE-2026-64611 A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function
CVE-2026-64611High 7.5
CVE-2026-64611 CVSS:7.5 A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a… - CVE-2026-52688 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
CVE-2026-52688High 7.5
CVE-2026-52688 CVSS:7.5 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation 产品: - CVE-2024-58330 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 a
CVE-2024-58330High 7.5
CVE-2024-58330 CVSS:7.5 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video… - CVE-2026-9713 The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable t
CVE-2026-9713High 7.5
CVE-2026-9713 CVSS:7.5 The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in… - CVE-2026-14291 The security-ninja-premium WordPress plugin before 5.290 does not verify the sec
CVE-2026-14291High 7.5
CVE-2026-14291 CVSS:7.5 The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor… - CVE-2026-12082 The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization
CVE-2026-12082High 7.5
CVE-2026-12082 CVSS:7.5 The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing… - CVE-2026-15074 @fastify/static up to and including version 10.1.0 fails to reject dot-dot path
CVE-2026-15074High 7.5
CVE-2026-15074 CVSS:7.5 @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the… - CVE-2026-66141 Exim before 4.99.5 allows .forward privilege escalation because force_command fo
CVE-2026-66141High 7.4
CVE-2026-66141 CVSS:7.4 Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled. 产品: - CVE-2026-10033 The EventON Action User plugin for WordPress is vulnerable to authorization bypa
CVE-2026-10033High 7.3
CVE-2026-10033 CVSS:7.3 The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This… - CVE-2026-16519 A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility deskt
CVE-2026-16519High 7.3
CVE-2026-16519 CVSS:7.3 A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more… - CVE-2026-16632 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the functio
CVE-2026-16632High 7.3
CVE-2026-16632 CVSS:7.3 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library… - CVE-2026-15401 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to
CVE-2026-15401High 7.2
CVE-2026-15401 CVSS:7.2 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in… - CVE-2026-66138 In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the
CVE-2026-66138High 7.2
CVE-2026-66138 CVSS:7.2 In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a… - CVE-2026-12421 The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
CVE-2026-12421High 7.2
CVE-2026-12421 CVSS:7.2 The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and… - CVE-2026-7534 The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Sto
CVE-2026-7534High 7.2
CVE-2026-7534 CVSS:7.2 The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint… - CVE-2026-7232 The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2026-7232High 7.2
CVE-2026-7232 CVSS:7.2 The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up… - CVE-2026-9765 Note: The CVE and blog post don't exist because we determined this is actually a
CVE-2026-9765High 7.1
CVE-2026-9765 CVSS:7.1 Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a… - CVE-2026-57701 Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5
CVE-2026-57701High 7.1
CVE-2026-57701 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. 产品: - CVE-2026-57699 Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.
CVE-2026-57699High 7.1
CVE-2026-57699 CVSS:7.1 Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. 产品: - CVE-2026-57696 Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
CVE-2026-57696High 7.1
CVE-2026-57696 CVSS:7.1 Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. 产品: - CVE-2026-57626 Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Re
CVE-2026-57626High 7.1
CVE-2026-57626 CVSS:7.1 Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0… - CVE-2026-57428 Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.
CVE-2026-57428High 7.1
CVE-2026-57428 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. 产品: - CVE-2026-57427 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <=
CVE-2026-57427High 7.1
CVE-2026-57427 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions. 产品: - CVE-2026-57397 Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
CVE-2026-57397High 7.1
CVE-2026-57397 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. 产品: - CVE-2026-57374 Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3
CVE-2026-57374High 7.1
CVE-2026-57374 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions. 产品: - CVE-2026-57370 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statisti
CVE-2026-57370High 7.1
CVE-2026-57370 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. 产品: - CVE-2026-57367 Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
CVE-2026-57367High 7.1
CVE-2026-57367 CVSS:7.1 Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. 产品:
⚔️ Sploitus（77 条）
Unknown (77 条)
- HTB-Writeups exploit
HTB-Writeups exploit - Exploit for Deserialization of Untrusted Data in Dataease exploit
Exploit for Deserialization of Untrusted Data in Dataease exploit
…另有 75 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-26 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV