📊 2026-07-29 漏洞情报日报 · 200 条 · 高危 107
每日漏洞情报汇总 · 2026-07-29
📊 2026-07-29 漏洞情报日报
📋 共 200 条
🔥 高危/严重 107 条
🚨 CISA-KEV 2 条
🐙 GitHub-Advisory 54 条 🔥36
🛡️ NVD-Latest 71 条 🔥71
⚔️ Sploitus 73 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-58630 (CVSS 10.0) – Azure App Service 权限提升：影响 Microsoft Azure App Service，因访问控制缺陷允许未授权攻击者通过网络提升权限。无需用户交互，利用条件极低。
- CVE-2026-56163 (CVSS 10.0) – Azure Kubernetes Service 缺少认证：Azure Kubernetes Service 关键功能缺失身份验证，攻击者可直接通过网络提升权限，严重威胁容器集群安全。
- CVE-2026-61511 (CVSS 9.8) – vBulletin eval 注入：影响 vBulletin 5.x~6.2.1，未认证攻击者可通过模板运行时中的
runMaths()方法执行任意代码。已有 PoC 公开，利用简单。 - CVE-2026-62325 (Critical) – goshs SFTP 空密码认证绕过：goshs v2.1.3 在使用
-b 'admin:' -sftp且未设置-fkf时，SFTP 接受空密码连接，绕过此前 CVE-2026-40884 的修复。 - CVE-2026-54588 (Critical) – Poweradmin Host 头注入：Poweradmin v4.3.2 在 OIDC、SAML 及注销流程中直接使用
HTTP_HOST构建回调 URL，未经验证，可被未认证攻击者用于重定向或会话劫持。
📈 威胁趋势
- 权限提升 / 认证绕过：今日核心威胁，共出现 5 个相关漏洞。Azure App Service、Azure Kubernetes Service、MemberGlut 插件、goshs SFTP、Poweradmin 均存在此类风险，攻击者可获取高级权限或绕过身份验证。
- 远程代码执行 (RCE)：vBulletin eval 注入、Apache Thrift C++ 堆缓冲区溢出、Realtyna 插件文件上传均允许未认证攻击者执行代码或恶意文件。
- 安全限制绕过：goshs WebDAV 的
MOVE方法绕过了--no-delete保护；lettre 库 TLS 主机名验证因逻辑反转而失效；openhole-server 路径遍历未正确处理 URL 编码。 - 拒绝服务 (DoS)：td 协议解析器存在未授权内存过量分配，可导致 OOM 终止。
- 其他：@hypequery/clickhouse SQL 注入、Style Dictionary 原型污染、SP Page Builder 硬编码 secret 导致的邮件中继、Data Quality SSRF。
🛡️ 缓解建议
- 立即升级受影响组件：重点关注 Azure 服务（App Service、AKS）、vBulletin（≥6.2.2）、Apache Thrift（≥0.24.0）、goshs、Poweradmin、MemberGlut 等，安装厂商已发布的补丁。
- 强化访问控制与配置：对 Azure 资源启用最小权限原则，审查 K8s 认证配置；goshs 用户禁用 SFTP 空密码模式或启用
-fkf；Poweradmin 中强制验证 Host 头并配置白名单。 - 部署输入验证与 WAF 规则：针对 SQL 注入、eval 注入、Host 头注入等攻击，在应用层实施严格输入过滤，并利用 Web 应用防火墙（WAF）拦截恶意载荷（如 vBulletin 模板注入、ClickHouse 特殊字符）。
- 启用安全监控与异常检测：关注日志中的异常文件操作（如 WebDAV MOVE）、SFTP 空密码连接、未授权 API 调用，并设置告警，及时发现利用行为。
🚨 CISA-KEV（2 条）
Unknown (2 条)
- CVE-2026-16812 - Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
CVE-2026-16812
CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability 产品: Arista VeloCloud Orchestrator 描述: Arista VeloCloud Orchestrator… - CVE-2025-68686 - Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
CVE-2025-68686
CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability 产品: Fortinet FortiOS 描述: Fortinet FortiOS contains an…
🐙 GitHub-Advisory（54 条）
Critical (5 条)
- CVE-2026-54658 - @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitr
CVE-2026-54658Critical
Impact A SQL injection vulnerability exists in the `escapeValue()` function used for parameter substitution. Attackers who can control parameter values can… - CVE-2026-62325 - goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026
CVE-2026-62325Critical
## Summary Start goshs v2.1.3 with `-b 'admin:' -sftp`. No `-fkf`. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant… - CVE-2026-64863 - goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
CVE-2026-64863Critical
## Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce `--no-delete` on the WebDAV `MOVE` verb. `MOVE` deletes the… - CVE-2026-54588 - Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and
CVE-2026-54588Critical
Summary Poweradmin v4.3.2 uses the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and… - CVE-2026-46428 - lettre has TLS hostname verification disabled when using Boring TLS backend
CVE-2026-46428Critical
Summary An inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verification for callers using the default (strict)…
High (31 条)
- CVE-2026-54638 - td has pre-auth denial of service via unbounded memory allocation in proto.Unenc
CVE-2026-54638High
Impact A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, potentially OOM termination) by sending a… - CVE-2026-54650 - openhole-server vulnerable to path traversal via URL-decoded request path
CVE-2026-54650High
## Summary openhole-server forwarded the URL-decoded request path (`r.URL.Path`) to tunnel clients instead of the original request-target. Percent-encoded… - CVE-2026-54639 - Style Dictionary - Prototype Pollution in convertTokenData utility function
CVE-2026-54639High
Impact Prototype pollution. A malicious user can create a token array `[{ key: '{__proto__.foo}', value: 'malicious' }]`, when processed by… - CVE-2026-55390 - datamodel-code-generator vulnerable to arbitrary local file read via XSD `schema
CVE-2026-55390High
Summary When generating models from an XML Schema (`--input-file-type xmlschema`), `datamodel-code-generator` resolves `<xs:include>`, `<xs:import>`,… - CVE-2026-54691 - datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, fo
CVE-2026-54691High
Summary `datamodel-code-generator`'s built-in HTTP fetcher (`http.get_body`) issues an `httpx.GET` against any URL passed to `--url` (or reached via a redirect… - CVE-2026-54655 - `datamodel-code-generator` vulnerable to code execution on import via `x-python
CVE-2026-54655High
Summary `datamodel-code-generator` honours a custom `x-python-type` JSON-Schema extension that lets a schema author override the generated Python type for a… - CVE-2026-54621 - `datamodel-code-generator` vulnerable to code injection via unescaped carriage r
CVE-2026-54621High
Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a… - CVE-2026-55415 - datamodel-code-generator vulnerable to code injection via `x-python-import` / `c
CVE-2026-55415High
#### Summary A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that **imports** the generated model. The… - CVE-2026-54690 - datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (
CVE-2026-54690High
Summary JSON-Schema `$ref` values pointing at HTTP or HTTPS URLs are silently dereferenced by `datamodel-code-generator` with no IP/host validation, no scheme… - CVE-2026-54656 - `datamodel-code-generator` vulnerable to code execution on import via unescaped
CVE-2026-54656High
Summary When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each model entry in the `--extra-template-data`… - CVE-2026-55391 - datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
CVE-2026-55391High
Summary `datamodel-code-generator`'s anti-SSRF guard validates the resolved IP of a fetch target once and then lets `httpx` perform its own independent DNS… - CVE-2026-54653 - `datamodel-code-generator` vulnerable to code injection in via attacker-controll
CVE-2026-54653High
Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON,… - CVE-2026-55389 - datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema
CVE-2026-55389High
Summary `datamodel-code-generator` resolves JSON-Schema `$ref` targets that point at the local filesystem without restricting them to the input/base directory… - CVE-2026-54654 - `datamodel-code-generator` vulnerable to code injection via unescaped carriage r
CVE-2026-54654High
Summary `datamodel-code-generator` is vulnerable to code injection when a developer passes an `--extra-template-data` file whose `comment` value contains a… - CVE-2026-54719 - goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download rou
CVE-2026-54719High
GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution,… - CVE-2026-50570 - Fission: Incomplete capability denylist in Environment/Function PodSpec validati
CVE-2026-50570High
Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs (`ValidatePodSpecSafety` / `ValidateContainerSafety` admission… - CVE-2026-50567 - Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside
CVE-2026-50567High
`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and wrote the result without checking… - CVE-2026-32203 - Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Se
CVE-2026-32203High
## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This… - CVE-2026-54635 - pytonapi has a Webhook Custom Path Authentication Bypass
CVE-2026-54635High
## Webhook Custom Path Authentication Bypass in pytonapi Summary `TonapiWebhookDispatcher` in pytonapi 2.2.0 fails to validate the `Authorization` header when… - CVE-2026-54605 - OAuth: Cross-origin token-request redirects can expose signed request metadata
CVE-2026-54605High
# Cross-origin OAuth token-request redirects can expose signed request metadata ## Summary When an application uses `OAuth::Consumer` to request OAuth 1.0… - CVE-2026-54603 - OAuth2::Client#request: Protocol-relative redirect Location overrides authority,
CVE-2026-54603High
## Summary When an application uses `OAuth2::Client` (typically via an `OAuth2::AccessToken`) and the configured authorization server returns a redirect whose… - CVE-2026-54609 - QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_
CVE-2026-54609High
Impact The relay's reconnect handler forwards every `RECONNECT_REQUEST` to the host without deduplication or a size cap on the `pendingReconnects` map, unlike… - CVE-2026-54632 - SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a
CVE-2026-54632High
Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler… - CVE-2026-43983 - Pocket ID: OIDC refresh token flow bypasses authorization revocation, account di
CVE-2026-43983High
# OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions ## Summary The `createTokenFromRefreshToken` function… - CVE-2026-43910 - java-client Allows Network Pivot via Unvalidated directConnect Redirect in Appiu
CVE-2026-43910High
## Summary When `directConnect(true)` is enabled, appium/java-client unconditionally accepts `directConnectHost`, `directConnectPort`, and `directConnectPath`… - CVE-2026-45293 - WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vu
CVE-2026-45293High
Impact WordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the… - CVE-2026-47427 - GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
CVE-2026-47427High
Summary A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed `completion/complete` request with… - CVE-2026-54545 - @wakaru/cli arbitrary file write during bundle unpack
CVE-2026-54545High
Impact `@wakaru/cli` is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with `--unpack`. Bundle-controlled module filenames were… - CVE-2026-55771 - Cedar-Java has policy injection, type confusion, and incorrect equality comparis
CVE-2026-55771High
Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain… - CVE-2026-61609 - Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables u
CVE-2026-61609High
Summary The `authentication` rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead… - CVE-2026-54593 - Pterodactyl's improper JWT scoping allows subuser to upload files when not expli
CVE-2026-54593High
Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any…
Medium (14 条)
- CVE-2026-66063 - goshs has a Path Traversal issue
CVE-2026-66063Medium
## Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. ## Finding… - GHSA-6xx4-9wp6-65p7 - skilo add follows symbolic links, allowing arbitrary local file disclosure from Medium
Impact `skilo add` installs a skill by recursively copying the skill directory into the target skills directory. The copy routine (`copy_dir_all`) classified… - CVE-2026-54659 - Pagy I18n locale option is not validated before being used in a file path
CVE-2026-54659Medium
Summary `Pagy::I18n.locale=` did not validate its argument before using it as a path component to load the matching dictionary file (`<locale>.yml`). An… - CVE-2026-66064 - goshs has ACL Bypass & Path Traversal
CVE-2026-66064Medium
## Summary `sendFile` derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties… - CVE-2026-50569 - Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl ap
CVE-2026-50569Medium
`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but silently skipped `RelativeURL` and… - CVE-2026-49447 - Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer t
CVE-2026-49447Medium
Summary `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty `Authorization`… - CVE-2026-49446 - Cosmos-Server has an authentication bypass via forward-auth header smuggling on
CVE-2026-49446Medium
Summary The Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to the upstream handler before the request's… - CVE-2026-52888 - NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
CVE-2026-52888Medium
# Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass ## Summary The `checkSQL()` function in `plugin-collection-sql` implements a…
…另有 6 条 Medium 级漏洞（已省略）
Low (4 条)
- CVE-2026-55403 - datamodel-code-generator: Authorization / request headers leaked to cross-origin
CVE-2026-55403Low
Summary When `datamodel-code-generator` fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any… - CVE-2026-50568 - Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory esc
CVE-2026-50568Low
`SanitizeFilePath` in `pkg/utils/utils.go` validated that a path stayed under a safe directory by calling `strings.HasPrefix(path, safedir)`. This is a lexical… - CVE-2026-54619 - sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different
CVE-2026-54619Low
## Summary Using `Database#create_function` or `Database#define_function` to define the same function name more than once with different numbers of arguments…
…另有 1 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（71 条）
Critical (17 条)
- CVE-2026-58630 Improper access control in Azure App Service allows an unauthorized attacker to
CVE-2026-58630Critical 10.0
CVE-2026-58630 CVSS:10.0 Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-57106 Server-side request forgery (ssrf) in Data Quality allows an unauthorized attack
CVE-2026-57106Critical 10.0
CVE-2026-57106 CVSS:10.0 Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. 产品: - CVE-2026-56163 Missing authentication for critical function in Microsoft Azure Kubernetes Servi
CVE-2026-56163Critical 10.0
CVE-2026-56163 CVSS:10.0 Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate… - CVE-2026-65879 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded,
CVE-2026-65879Critical 9.8
CVE-2026-65879 CVSS:9.8 Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A… - CVE-2026-55971 Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This is
CVE-2026-55971Critical 9.8
CVE-2026-55971 CVSS:9.8 Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are… - CVE-2026-61511 vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vul
CVE-2026-61511Critical 9.8
CVE-2026-61511 CVSS:9.8 vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths()…
+PoC-in-GitHu - CVE-2026-13714 The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0
CVE-2026-13714Critical 9.8
CVE-2026-13714 CVSS:9.8 The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its… - CVE-2026-12394 The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen
CVE-2026-12394Critical 9.8
CVE-2026-12394 CVSS:9.8 The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated… - CVE-2026-64530 In the Linux kernel, the following vulnerability has been resolved: net/sched:
CVE-2026-64530Critical 9.8
CVE-2026-64530 CVSS:9.8 In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle… - CVE-2026-59533 Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.
CVE-2026-59533Critical 9.3
CVE-2026-59533 CVSS:9.3 Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. 产品: - CVE-2026-59527 Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
CVE-2026-59527Critical 9.3
CVE-2026-59527 CVSS:9.3 Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. 产品: - CVE-2026-58662 Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi
CVE-2026-58662Critical 9.1
CVE-2026-58662 CVSS:9.1 Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects… - CVE-2026-58023 Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue a
CVE-2026-58023Critical 9.1
CVE-2026-58023 CVSS:9.1 Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are… - CVE-2026-48144 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th
CVE-2026-48144Critical 9.1
CVE-2026-48144 CVSS:9.1 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift:… - CVE-2026-13597 The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webho
CVE-2026-13597Critical 9.1
CVE-2026-13597 CVSS:9.1 The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and… - CVE-2026-13332 The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify autho
CVE-2026-13332Critical 9.1
CVE-2026-13332 CVSS:9.1 The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to… - CVE-2026-14289 The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does
CVE-2026-14289Critical 9.0
CVE-2026-14289 CVSS:9.0 The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose…
High (54 条)
- CVE-2026-15962 The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Objec
CVE-2026-15962High 8.8
CVE-2026-15962 CVSS:8.8 The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6… - CVE-2026-16801 Improper control of generation of code ('Code Injection') in the variables featu
CVE-2026-16801High 8.8
CVE-2026-16801 CVSS:8.8 Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and… - CVE-2026-16800 Improper control of generation of code ('Code Injection') in the schedule featur
CVE-2026-16800High 8.8
CVE-2026-16800 CVSS:8.8 Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and… - CVE-2026-45813 Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apa
CVE-2026-45813High 8.8
CVE-2026-45813 CVSS:8.8 Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when… - CVE-2025-15662 The Printcart Web to Print Product Designer for WooCommerce WordPress plugin bef
CVE-2025-15662High 8.6
CVE-2025-15662 CVSS:8.6 The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before… - CVE-2026-59688 An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Conne
CVE-2026-59688High 8.4
CVE-2026-59688 CVSS:8.4 An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and… - CVE-2026-59687 An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Conne
CVE-2026-59687High 8.4
CVE-2026-59687 CVSS:8.4 An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and… - CVE-2026-59686 An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Conne
CVE-2026-59686High 8.4
CVE-2026-59686 CVSS:8.4 An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and… - CVE-2026-17497 NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capabili
CVE-2026-17497High 8.3
CVE-2026-17497 CVSS:8.3 NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary… - CVE-2026-9830 The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not
CVE-2026-9830High 8.2
CVE-2026-9830 CVSS:8.2 The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving…
+PoC-in-GitHu - CVE-2026-13152 The Custom Fields Account Registration For Woocommerce WordPress plugin before 1
CVE-2026-13152High 8.1
CVE-2026-13152 CVSS:8.1 The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from… - CVE-2026-12255 The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's
CVE-2026-12255High 8.1
CVE-2026-12255 CVSS:8.1 The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when… - CVE-2026-17496 NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with
CVE-2026-17496High 8.1
CVE-2026-17496 CVSS:8.1 NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via… - CVE-2026-10818 The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in a
CVE-2026-10818High 8.1
CVE-2026-10818 CVSS:8.1 The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the…
+PoC-in-GitHu - CVE-2026-66374 Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer
CVE-2026-66374High 8.1
CVE-2026-66374 CVSS:8.1 Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. 产品: - CVE-2026-59690 A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Conne
CVE-2026-59690High 8.0
CVE-2026-59690 CVSS:8.0 A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit… - CVE-2026-59689 An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Co
CVE-2026-59689High 8.0
CVE-2026-59689 CVSS:8.0 An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and… - CVE-2026-17523 A flaw was found in the kernel. An unprivileged local user can exploit this vuln
CVE-2026-17523High 7.8
CVE-2026-17523 CVSS:7.8 A flaw was found in the kernel. An unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel,… - CVE-2026-14837 Multiple Lenze products are affected by an improper signature verification vulne
CVE-2026-14837High 7.8
CVE-2026-14837 CVSS:7.8 Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A… - CVE-2024-14040 In the Linux kernel, the following vulnerability has been resolved: net: nextho
CVE-2024-14040High 7.8
CVE-2024-14040 CVSS:7.8 In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link… - CVE-2026-17527 In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view Cluste
CVE-2026-17527High 7.7
CVE-2026-17527 CVSS:7.7 In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI… - CVE-2026-59536 Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 ve
CVE-2026-59536High 7.5
CVE-2026-59536 CVSS:7.5 Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. 产品: - CVE-2026-59534 Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
CVE-2026-59534High 7.5
CVE-2026-59534 CVSS:7.5 Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. 产品: - CVE-2026-59532 Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2
CVE-2026-59532High 7.5
CVE-2026-59532 CVSS:7.5 Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions. 产品: - CVE-2026-59531 Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 v
CVE-2026-59531High 7.5
CVE-2026-59531 CVSS:7.5 Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions. 产品: - CVE-2026-59530 Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 version
CVE-2026-59530High 7.5
CVE-2026-59530 CVSS:7.5 Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. 产品: - CVE-2026-59529 Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.
CVE-2026-59529High 7.5
CVE-2026-59529 CVSS:7.5 Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. 产品: - CVE-2026-59528 Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1
CVE-2026-59528High 7.5
CVE-2026-59528 CVSS:7.5 Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. 产品: - CVE-2026-58389 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr
CVE-2026-58389High 7.5
CVE-2026-58389 CVSS:7.5 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift:… - CVE-2026-55969 Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, n
CVE-2026-55969High 7.5
CVE-2026-55969 CVSS:7.5 Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects… - CVE-2026-55968 Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Th
CVE-2026-55968High 7.5
CVE-2026-55968 CVSS:7.5 Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js… - CVE-2026-48586 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i
CVE-2026-48586High 7.5
CVE-2026-48586 CVSS:7.5 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib… - CVE-2026-48145 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th
CVE-2026-48145High 7.5
CVE-2026-48145 CVSS:7.5 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift:… - CVE-2026-45112 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr
CVE-2026-45112High 7.5
CVE-2026-45112 CVSS:7.5 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift:… - CVE-2026-43871 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache T
CVE-2026-43871High 7.5
CVE-2026-43871 CVSS:7.5 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue… - CVE-2026-41608 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i
CVE-2026-41608High 7.5
CVE-2026-41608 CVSS:7.5 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects… - CVE-2026-12493 The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.
CVE-2026-12493High 7.5
CVE-2026-12493 CVSS:7.5 The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment… - CVE-2026-49158 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i
CVE-2026-49158High 7.5
CVE-2026-49158 CVSS:7.5 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects… - CVE-2026-14235 The Download Manager WordPress plugin before 3.3.62 does not bind its temporary
CVE-2026-14235High 7.5
CVE-2026-14235 CVSS:7.5 The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it… - CVE-2026-63720 datamodel-code-generator prior to version 0.70.0 contains a code injection vulne
CVE-2026-63720High 7.5
CVE-2026-63720 CVSS:7.5 datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input… - CVE-2026-66373 Redis before 8.8.0, in the unusual case where an authenticated attacker can exec
CVE-2026-66373High 7.5
CVE-2026-66373 CVSS:7.5 Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE… - CVE-2026-66144 Although remote policy references are not retrieved during policy normalization,
CVE-2026-66144High 7.5
CVE-2026-66144 CVSS:7.5 Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can… - CVE-2026-66143 It is possible to bypass the maximum number of normalized policy alternatives th
CVE-2026-66143High 7.5
CVE-2026-66143 CVSS:7.5 It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain… - CVE-2026-66142 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that
CVE-2026-66142High 7.5
CVE-2026-66142 CVSS:7.5 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures,… - CVE-2026-45816 NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Requ
CVE-2026-45816High 7.5
CVE-2026-45816 CVSS:7.5 NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise… - CVE-2026-45815 Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read
CVE-2026-45815High 7.5
CVE-2026-45815 CVSS:7.5 Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response… - CVE-2026-45811 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerabi
CVE-2026-45811High 7.5
CVE-2026-45811 CVSS:7.5 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not… - CVE-2026-57990 Files or directories accessible to external parties in Microsoft Edge (Chromium
CVE-2026-57990High 7.4
CVE-2026-57990 CVSS:7.4 Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose… - CVE-2026-57989 Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorize
CVE-2026-57989High 7.4
CVE-2026-57989 CVSS:7.4 Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. 产品: - CVE-2026-59535 Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versio
CVE-2026-59535High 7.3
CVE-2026-59535 CVSS:7.3 Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. 产品: - CVE-2026-10033 The EventON Action User plugin for WordPress is vulnerable to authorization bypa
CVE-2026-10033High 7.3
CVE-2026-10033 CVSS:7.3 The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This… - CVE-2026-15401 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to
CVE-2026-15401High 7.2
CVE-2026-15401 CVSS:7.2 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in… - CVE-2026-13726 The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter
CVE-2026-13726High 7.1
CVE-2026-13726 CVSS:7.1 The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing… - CVE-2026-9765 Note: The CVE and blog post don't exist because we determined this is actually a
CVE-2026-9765High 7.1
CVE-2026-9765 CVSS:7.1 Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a…
⚔️ Sploitus（73 条）
Unknown (73 条)
- Exploit for Improper Authentication in Redhat Keycloak exploit
Exploit for Improper Authentication in Redhat Keycloak exploit - Exploit for Improper Authentication in Checkpoint Multi-Domain_Security_Management exploit
Exploit for Improper Authentication in Checkpoint Multi-Domain_Security_Management exploit
…另有 71 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-29 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV