📊 2026-07-27 漏洞情报日报 · 200 条 · 高危 100
每日漏洞情报汇总 · 2026-07-27
📊 2026-07-27 漏洞情报日报
📋 共 200 条
🔥 高危/严重 100 条
🐙 GitHub-Advisory 35 条 🔥24
🛡️ NVD-Latest 76 条 🔥76
⚔️ Sploitus 89 条
🤖 今日安全态势分析
🎯 今日重点关注
- OpenDJ 未认证 SSRF / 文件读取 / DoS（GHSA‑68r5）：影响 OpenIdentityPlatform OpenDJ ≤5.1.1，DSMLv2 SOAP 网关无需认证即可发起 SSRF、读取本地文件并导致无界读取 DoS，属关键基础设施风险。
- sm‑crypto SM2 密钥可预测（GHSA‑vh45）：Node.js 包 0.4.0 使用全局 RNG 实例生成 SM2 私钥与签名随机数，攻击者可推导私钥，威胁国密应用安全。
- Azure 多服务 CVSS 10.0 权限提升（CVE‑2026‑58630 等）：Azure App Service、AKS、Key Vault、DNS 及 Exchange Online 均存在认证/授权缺陷，未经授权攻击者可远程提权或篡改，需紧急修复。
- Pheditor 强制改密认证绕过（GHSA‑f25v）：密码为默认 admin 时，提交任意非空值即可绕过强制修改流程，直接导致账户接管。
📈 威胁趋势
- 权限提升与认证绕过：OpenDJ SASL 代理 ACI 绕过、Pheditor 改密绕过、Azure 五大服务提权、Exchange Online 认证不当，共 7 个 Critical 级别漏洞集中爆发。
- 远程代码执行（RCE）：Microsoft Surface 输入验证不当（CVSS 9.9）、M365 Copilot 反序列化（CVSS 9.9）要求认证，但可致远程代码执行。
- SSRF 与信息泄露：OpenDJ SSRF + 文件读取、IBM Data Quality SSRF（CVSS 10.0）、Budibase 未认证用户信息泄露（含 email、SSO ID）。
- 注入与逻辑缺陷：Budibase NoSQL 注入、MySQL 反引号注入；Budibase Chat‑Link 身份混淆可致同租户账户接管。
🛡️ 缓解建议
- 立即升级/隔离 OpenDJ：关闭 DSMLv2 SOAP 网关或升级至 5.2.0+；检查 SASL PLAIN 配置，启用代理 ACI 严格检查。
- 替换 sm‑crypto 0.4.0：停止使用该版本，改用独立 RNG 实例或等官方修复；若无法升级，手动替换 SecureRandom 为真随机源。
- 应用 Azure 紧急补丁：针对 CVE‑2026‑58630 等 6 个 CVSS 10.0 漏洞，立即安装微软 7 月安全更新；限制公网暴露面，启用网络策略。
- 加固 Budibase 与 Pheditor：Budibase 需限制 `/api/global/users/tenant/:id` 访问并升级；Pheditor 立即修改默认密码并启用改密验证逻辑。
🐙 GitHub-Advisory（35 条）
Critical (4 条)
- GHSA-68r5-9hpg-7qw9 - OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv Critical
The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without… - GHSA-p279-2cqp-84jg - OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check Critical
Summary When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, PlainSASLMechanismHandler verified only the… - GHSA-vh45-f885-3848 - sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.rand Critical
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single… - GHSA-f25v-x6vr-962g - Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Cu Critical
## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not verify that the password submitted by…
High (20 条)
- GHSA-hr66-5mqr-8mpx - Budibase: Unauthenticated user information disclosure via public tenant user lo High
#### Summary The Budibase Worker service exposes a public, unauthenticated API endpoint (`GET /api/global/users/tenant/:id`) that returns sensitive user… - GHSA-qw6m-8fw2-2v64 - Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Exe High
## Summary Budibase's MongoDB query execution endpoint (`POST /api/v2/queries/:queryId`) is vulnerable to NoSQL injection through user-supplied query… - GHSA-2xgg-r2wc-c5r2 - Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database C High
Summary **This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p (PostgreSQL SQL injection), reported in the same original disclosure… - GHSA-pvcr-8mvp-w8qr - Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) High
Summary The Budibase AI chat-link handoff flow (`GET/POST /api/chat-links/:instance/:token/handoff`) binds an **external chat identity** (Slack/Discord/MS… - GHSA-pmpg-2mxq-6xwr - Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS ex High
## Summary An end-user injection in Budibase's MongoDB datasource lets any BASIC app user bypass the builder's query-level access controls. Builders scope… - GHSA-v42f-v8xc-j435 - Budibase: SSRF via DNS rebinding in the REST datasource integration
CVE-2026-54353High
Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP… - GHSA-94p4-4cq8-9g67 - GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.a High
## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped… - GHSA-g3hq-hphg-8fhh - Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE High
Summary pheditor's terminal feature restricts callers to an allowlist of commands (`TERMINAL_COMMANDS`) and rejects shell metacharacters. The allowlist is… - GHSA-g5vv-q72c-7j78 - @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion High
Summary `@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never… - GHSA-26gq-p25f-99cp - frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via High
## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire `frps`… - GHSA-47w6-gwp4-w6vc - vantage6: Algorithm developer can edit another developer's algorithm that is pen High
Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image… - CVE-2026-14257 - brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro
CVE-2026-14257High
Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups,… - GHSA-h4hf-v6w5-897x - Poweradmin: API user-update endpoint leads to a non-admin reset any user's passw High
Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce two authorization rules that the web… - GHSA-rm67-g9ch-vxff - Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records High
## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (also reachable in the 4.x release line —… - GHSA-cmwh-g2h8-c222 - Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeove High
## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`. In the MySQL schema, the OIDC link table… - GHSA-mhvj-jhpq-885v - blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parse High
Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (`http/src/main/java/org/http4s/blaze/http/parser/`) cause… - GHSA-46q4-43ph-c6fr - blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server High
Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into `Request.headers`. Because trailer fields are attacker-controlled, an unauthenticated… - GHSA-7ppr-r889-mcf2 - blaze: Unbounded WebSocket message aggregation in http4s-blaze-server High
## Summary `http4s-blaze-server` aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that… - GHSA-95cv-r8x4-vh75 - OpenList: Authenticated users can rename files outside their base path via batch High
Summary The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects path separators in `new_name`, but it does… - CVE-2026-16584 - AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
CVE-2026-16584High
## Summary The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources…
Medium (10 条)
- GHSA-gh4h-34gr-87r7 - Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Othe Medium
## Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the… - GHSA-cr7p-cr3q-h5cm - Budibase: Account Enumeration via Login Lockout Response Differential Medium
## Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email… - GHSA-hfhx-w8p8-4hc7 - Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Medium
# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `packages/server/src/utilities/fileUtils.ts`… - GHSA-c534-2w9c-x7fm - Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC a Medium
## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters.… - GHSA-f45q-w629-wr25 - Hubuum client library (Rust): Authenticated requests may escape the configured b Medium
## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and… - GHSA-qqc3-94qv-7fw3 - Hubuum client library (Rust): Configured custom transports may be bypassed, expo Medium
## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client… - GHSA-v6w6-358x-2433 - Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests Medium
## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept attacker-controlled node definitions and… - CVE-2026-64785 - swift-nio-http2: Missing CR/LF/NUL validation in header values
CVE-2026-64785Medium
## Summary SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend…
…另有 2 条 Medium 级漏洞（已省略）
Low (1 条)
- GHSA-2625-rw7m-5q5x - Hubuum client library (Rust): Sensitive data may be exposed through default diag Low
## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format…
🛡️ NVD-Latest（76 条）
Critical (18 条)
- CVE-2026-58630 Improper access control in Azure App Service allows an unauthorized attacker to
CVE-2026-58630Critical 10.0
CVE-2026-58630 CVSS:10.0 Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-57106 Server-side request forgery (ssrf) in Data Quality allows an unauthorized attack
CVE-2026-57106Critical 10.0
CVE-2026-57106 CVSS:10.0 Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-56163 Missing authentication for critical function in Microsoft Azure Kubernetes Servi
CVE-2026-56163Critical 10.0
CVE-2026-56163 CVSS:10.0 Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate… - CVE-2026-62825 Improper authentication in Azure Key Vault allows an unauthorized attacker to el
CVE-2026-62825Critical 10.0
CVE-2026-62825 CVSS:10.0 Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-58275 Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr
CVE-2026-58275Critical 10.0
CVE-2026-58275 CVSS:10.0 Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-56191 Improper authentication in Microsoft Exchange Online allows an unauthorized atta
CVE-2026-56191Critical 10.0
CVE-2026-56191 CVSS:10.0 Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. 产品: - CVE-2026-54120 Improper input validation in Microsoft Surface allows an authorized attacker to
CVE-2026-54120Critical 9.9
CVE-2026-54120 CVSS:9.9 Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. 产品: - CVE-2026-50517 Deserialization of untrusted data in M365 Copilot allows an authorized attacker
CVE-2026-50517Critical 9.9
CVE-2026-50517 CVSS:9.9 Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. 产品: - CVE-2026-15704 In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled
CVE-2026-15704Critical 9.8
CVE-2026-15704 CVSS:9.8 In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass… - CVE-2026-56165 Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker
CVE-2026-56165Critical 9.8
CVE-2026-56165 CVSS:9.8 Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network. 产品: - CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custo
CVE-2026-64873Critical 9.8
CVE-2026-64873 CVSS:9.8 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network… - CVE-2026-15015 The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable t
CVE-2026-15015Critical 9.8
CVE-2026-15015 CVSS:9.8 The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… - CVE-2026-15011 The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable
CVE-2026-15011Critical 9.8
CVE-2026-15011 CVSS:9.8 The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all… - CVE-2026-14282 The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folde
CVE-2026-14282Critical 9.8
CVE-2026-14282 CVSS:9.8 The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is… - CVE-2026-12877 The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5
CVE-2026-12877Critical 9.1
CVE-2026-12877 CVSS:9.1 The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input… - CVE-2026-56160 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att
CVE-2026-56160Critical 9.1
CVE-2026-56160 CVSS:9.1 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. 产品: - CVE-2026-27064 Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
CVE-2026-27064Critical 9.1
CVE-2026-27064 CVSS:9.1 Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. 产品: - CVE-2026-16723 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.
CVE-2026-16723Critical 9.0
CVE-2026-16723 CVSS:9.0 A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under…
+PoC-in-GitHu
High (58 条)
- CVE-2026-16801 Improper control of generation of code ('Code Injection') in the variables featu
CVE-2026-16801High 8.8
CVE-2026-16801 CVSS:8.8 Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and… - CVE-2026-16800 Improper control of generation of code ('Code Injection') in the schedule featur
CVE-2026-16800High 8.8
CVE-2026-16800 CVSS:8.8 Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and… - CVE-2026-45813 Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apa
CVE-2026-45813High 8.8
CVE-2026-45813 CVSS:8.8 Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when… - CVE-2026-16870 Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior
CVE-2026-16870High 8.8
CVE-2026-16870 CVSS:8.8 Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and… - CVE-2026-16745 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShif
CVE-2026-16745High 8.8
CVE-2026-16745 CVSS:8.8 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a… - CVE-2026-15017 The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escala
CVE-2026-15017High 8.8
CVE-2026-15017 CVSS:8.8 The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4.… - CVE-2026-56167 Server-side request forgery (ssrf) in Azure AI Search allows an authorized attac
CVE-2026-56167High 8.5
CVE-2026-56167 CVSS:8.5 Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. 产品: - CVE-2026-25405 Contributor SQL Injection in eRoom <= 1.7.1 versions.
CVE-2026-25405High 8.5
CVE-2026-25405 CVSS:8.5 Contributor SQL Injection in eRoom <= 1.7.1 versions. 产品: - CVE-2026-24552 Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.
CVE-2026-24552High 8.5
CVE-2026-24552 CVSS:8.5 Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions. 产品: - CVE-2026-66140 Exim before 4.99.5 allows directory traversal to access files outside of the spo
CVE-2026-66140High 8.4
CVE-2026-66140 CVSS:8.4 Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because… - CVE-2024-58023 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allow
CVE-2024-58023High 8.4
CVE-2024-58023 CVSS:8.4 Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. 产品: - CVE-2026-10818 The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in a
CVE-2026-10818High 8.1
CVE-2026-10818 CVSS:8.1 The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the…
+PoC-in-GitHu - CVE-2026-66374 Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer
CVE-2026-66374High 8.1
CVE-2026-66374 CVSS:8.1 Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. 产品: - CVE-2026-65757 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege
CVE-2026-65757High 8.1
CVE-2026-65757 CVSS:8.1 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup… - CVE-2026-12736 The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in vers
CVE-2026-12736High 8.0
CVE-2026-12736 CVSS:8.0 The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the… - CVE-2026-35425 Improper access control in Azure API Management (APIM) allows an authorized atta
CVE-2026-35425High 8.0
CVE-2026-35425 CVSS:8.0 Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. 产品: - CVE-2026-49745 Kernel software installed and running inside a Guest VM may post improper comman
CVE-2026-49745High 7.8
CVE-2026-49745 CVSS:7.8 Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data… - CVE-2026-49744 Kernel software installed and running inside a Guest VM may post improper comman
CVE-2026-49744High 7.8
CVE-2026-49744 CVSS:7.8 Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data… - CVE-2026-49743 Software installed and run as a non-privileged user may conduct improper GPU sys
CVE-2026-49743High 7.8
CVE-2026-49743 CVSS:7.8 Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of… - CVE-2026-14172 Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables
CVE-2026-14172High 7.8
CVE-2026-14172 CVSS:7.8 Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file… - CVE-2026-16287 Improper neutralization of special elements used in an OS command ('OS command i
CVE-2026-16287High 7.8
CVE-2026-16287 CVSS:7.8 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software… - CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can exec
CVE-2026-66373High 7.5
CVE-2026-66373 CVSS:7.5 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE… - CVE-2026-66144 Although remote policy references are not retrieved during policy normalization,
CVE-2026-66144High 7.5
CVE-2026-66144 CVSS:7.5 Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can… - CVE-2026-66143 It is possible to bypass the maximum number of normalized policy alternatives th
CVE-2026-66143High 7.5
CVE-2026-66143 CVSS:7.5 It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain… - CVE-2026-66142 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that
CVE-2026-66142High 7.5
CVE-2026-66142 CVSS:7.5 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures,… - CVE-2026-45816 NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Requ
CVE-2026-45816High 7.5
CVE-2026-45816 CVSS:7.5 NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise… - CVE-2026-45815 Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read
CVE-2026-45815High 7.5
CVE-2026-45815 CVSS:7.5 Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response… - CVE-2026-45811 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerabi
CVE-2026-45811High 7.5
CVE-2026-45811 CVSS:7.5 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not… - CVE-2026-14603 The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have
CVE-2026-14603High 7.5
CVE-2026-14603 CVSS:7.5 The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing… - CVE-2026-12981 The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication
CVE-2026-12981High 7.5
CVE-2026-12981 CVSS:7.5 The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords,… - CVE-2026-12497 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User
CVE-2026-12497High 7.5
CVE-2026-12497 CVSS:7.5 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before… - CVE-2026-64611 A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function
CVE-2026-64611High 7.5
CVE-2026-64611 CVSS:7.5 A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a… - CVE-2026-52688 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation
CVE-2026-52688High 7.5
CVE-2026-52688 CVSS:7.5 RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation 产品: - CVE-2024-58330 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 a
CVE-2024-58330High 7.5
CVE-2024-58330 CVSS:7.5 A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video… - CVE-2026-9713 The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable t
CVE-2026-9713High 7.5
CVE-2026-9713 CVSS:7.5 The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in… - CVE-2026-14291 The security-ninja-premium WordPress plugin before 5.290 does not verify the sec
CVE-2026-14291High 7.5
CVE-2026-14291 CVSS:7.5 The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor… - CVE-2026-12082 The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization
CVE-2026-12082High 7.5
CVE-2026-12082 CVSS:7.5 The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing… - CVE-2026-15074 @fastify/static up to and including version 10.1.0 fails to reject dot-dot path
CVE-2026-15074High 7.5
CVE-2026-15074 CVSS:7.5 @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the… - CVE-2026-66141 Exim before 4.99.5 allows .forward privilege escalation because force_command fo
CVE-2026-66141High 7.4
CVE-2026-66141 CVSS:7.4 Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled. 产品: - CVE-2026-10033 The EventON Action User plugin for WordPress is vulnerable to authorization bypa
CVE-2026-10033High 7.3
CVE-2026-10033 CVSS:7.3 The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This… - CVE-2026-16519 A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility deskt
CVE-2026-16519High 7.3
CVE-2026-16519 CVSS:7.3 A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more… - CVE-2026-16632 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the functio
CVE-2026-16632High 7.3
CVE-2026-16632 CVSS:7.3 A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library… - CVE-2026-15401 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to
CVE-2026-15401High 7.2
CVE-2026-15401 CVSS:7.2 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in… - CVE-2026-66138 In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the
CVE-2026-66138High 7.2
CVE-2026-66138 CVSS:7.2 In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a… - CVE-2026-12421 The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi
CVE-2026-12421High 7.2
CVE-2026-12421 CVSS:7.2 The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and… - CVE-2026-7534 The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Sto
CVE-2026-7534High 7.2
CVE-2026-7534 CVSS:7.2 The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint… - CVE-2026-7232 The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2026-7232High 7.2
CVE-2026-7232 CVSS:7.2 The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up… - CVE-2026-9765 Note: The CVE and blog post don't exist because we determined this is actually a
CVE-2026-9765High 7.1
CVE-2026-9765 CVSS:7.1 Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a… - CVE-2026-57701 Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5
CVE-2026-57701High 7.1
CVE-2026-57701 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. 产品: - CVE-2026-57699 Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.
CVE-2026-57699High 7.1
CVE-2026-57699 CVSS:7.1 Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. 产品: - CVE-2026-57696 Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
CVE-2026-57696High 7.1
CVE-2026-57696 CVSS:7.1 Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. 产品: - CVE-2026-57626 Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Re
CVE-2026-57626High 7.1
CVE-2026-57626 CVSS:7.1 Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0… - CVE-2026-57428 Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.
CVE-2026-57428High 7.1
CVE-2026-57428 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. 产品: - CVE-2026-57427 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <=
CVE-2026-57427High 7.1
CVE-2026-57427 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions. 产品: - CVE-2026-57397 Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
CVE-2026-57397High 7.1
CVE-2026-57397 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. 产品: - CVE-2026-57374 Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3
CVE-2026-57374High 7.1
CVE-2026-57374 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions. 产品: - CVE-2026-57370 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statisti
CVE-2026-57370High 7.1
CVE-2026-57370 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions. 产品: - CVE-2026-57367 Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
CVE-2026-57367High 7.1
CVE-2026-57367 CVSS:7.1 Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. 产品:
⚔️ Sploitus（89 条）
Unknown (89 条)
- relay-secreport-bench exploit
relay-secreport-bench exploit - DarkPrompt exploit
DarkPrompt exploit
…另有 87 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-27 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV