📊 2026-07-30 漏洞情报日报 · 200 条 · 高危 152
每日漏洞情报汇总 · 2026-07-30
📊 2026-07-30 漏洞情报日报
📋 共 200 条
🔥 高危/严重 152 条
🚨 CISA-KEV 1 条
🐙 GitHub-Advisory 33 条 🔥16
🛡️ NVD-Latest 136 条 🔥136
⚔️ Sploitus 30 条
🤖 今日安全态势分析
安全态势分析报告
🎯 今日重点关注
- CVE-2026-54680 (CVSS 待定, Critical)： Logging operator Fluentd 配置注入漏洞。攻击者通过创建恶意的 Flow CRD 资源可注入任意 Fluentd 配置，导致远程代码执行。利用条件：拥有创建 Flow 资源的权限。
- CVE-2026-11756 (CVSS 10.0)： 3DEXPERIENCE 平台 Station Launcher App 反序列化漏洞。未认证的远程攻击者可利用该漏洞实现任意代码执行。影响范围：3DEXPERIENCE R2023x~R2026x。
- CVE-2026-48030 (CVSS 9.9)： Pheditor 编辑器 OS 命令注入漏洞。任何已认证用户通过终端操作可执行任意系统命令。已有 PoC 公开（GitHub），利用门槛较低。
- CVE-2026-16462 (CVSS 9.8)： PROCON-WEB SCADA 系统 SQL 注入漏洞。未认证远程攻击者可通过 GetGridData 接口执行任意 SQL 命令，威胁工控系统安全。
- CVE-2026-15014 (CVSS 9.8)： WordPress SMS Alert 插件身份认证绕过漏洞。未认证攻击者可利用认证绕过接管账号，影响 WooCommerce 站点。
📈 威胁趋势
- 远程代码执行 / 命令注入： 今日多起严重漏洞属于此类，包括 Logging operator 配置注入（CVE-2026-54680）、Pheditor 命令注入（CVE-2026-48030）、3DEXPERIENCE 反序列化RCE（CVE-2026-11756），攻击面广泛。
- 身份认证绕过 / 权限提升： WordPress SMS Alert 插件（CVE-2026-15014）、TrueBooker 插件（CVE-2026-14545）以及 ZITADEL（CVE-2026-54693）均可绕过认证或自我验证，导致数据篡改或账号接管。
- 信息泄露 / SSRF： prebid-server（CVE-2026-54735）存在 SSRF 漏洞可探测内网；Easy!Appointments（CVE-2026-55651）过量数据暴露导致他人预约信息泄露；netfoil（GHSA-xvg2）错误响应可能导致本地流量泄露。
- 容器逃逸 / 符号链接攻击： proot-distro 组件存在两个高危漏洞（CVE-2026-54574 任意文件写入和 CVE-2026-54727 隔离绕过），攻击者可通过恶意备份或安装包逃逸容器，访问宿主机。
🛡️ 缓解建议
- 立即更新受影响软件： 针对已发布补丁的产品（如 Pheditor ≥2.0.4、TrueBooker ≥1.2.4、SMS Alert 插件），应尽快升级至安全版本；对于 Logging operator 和 proot-distro 请关注官方更新。
- 加强输入验证与最小权限： 限制 Flow CRD 的创建权限，并对 Fluentd 输出进行转义；对 Pheditor 终端操作启用额外身份验证；在 prebid-server 中严格校验出站 URL 参数。
- 部署 WAF 与网络隔离： 对 3DEXPERIENCE 平台和 PROCON-WEB SCADA 等 SCADA 系统部署防火墙规则，限制 API 端点访问，并启用参数过滤；对于 WordPress 插件可启用 Web 应用防火墙规则阻断 SQL 注入和认证绕过尝试。
- 监控异常行为： 检查日志中是否有批量访问 /GridData 端点、Pheditor 终端命令执行记录、以及非预期的 CRD 创建操作；对 KACE SMA 等老旧资产（CVE-2021-32084等）实施网络隔离或升级计划。
🚨 CISA-KEV（1 条）
Unknown (1 条)
- CVE-2026-20316 - Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
CVE-2026-20316
CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability 产品: Cisco Secure Firewall Management Center (FMC) 描述: Cisco…
🐙 GitHub-Advisory（33 条）
Critical (2 条)
- CVE-2026-54680 - Logging operator has Fluentd configuration injection that allows remote code exe
CVE-2026-54680Critical
Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as `Flow` directly into `fluent.conf` without escaping them. As a… - CVE-2026-54735 - prebid-server's request forgery vulnerability allows for possible host environme
CVE-2026-54735Critical
Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious…
High (14 条)
- CVE-2026-11393 - AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Tri
CVE-2026-11393High
Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon Bedrock AgentCore. An issue exists where,… - CVE-2026-55651 - Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposur
CVE-2026-55651High
Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other… - CVE-2026-54574 - `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Mali
CVE-2026-54574High
**Repository:** `termux/proot-distro` **Component:** `proot_distro/commands/install.py` → `_extract_plain_tar()`; also `helpers/docker.py` → `_apply_layer()`… - CVE-2026-54727 - proot-distro has a Container Isolation Bypass via Crafted Restore Archive
CVE-2026-54727High
## Affected Component - **Package:** proot-distro - **Affected command:** `restore` - **Attack surface:** Host-side Termux CLI processing a user-supplied… - CVE-2026-54693 - ZITADEL Users Can Self-Verify Email/Phone via API
CVE-2026-54693High
Summary A vulnerability in Zitadel's self-management capability allowed users to mark their email and phone as verified without going through an actual… - GHSA-xvg2-cgv6-6h7v - netfoil: Incorrect block responses could lead to localhost traffic High
Summary `0.0.0.0` was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the `0.0.0.0` is sent to localhost… - CVE-2026-54079 - veraPDF Validation XXE via XFA
CVE-2026-54079High
## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server… - CVE-2026-54078 - veraPDF Validation XXE via Rich Text
CVE-2026-54078High
## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server… - CVE-2026-49755 - Req vulnerable to unbounded archive/compression extraction triggered by response
CVE-2026-49755High
Summary Req's default response pipeline auto-decodes archive and compressed bodies based on the server-supplied `content-type` (or URL extension) and… - CVE-2026-50559 - Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vul
CVE-2026-50559High
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using… - CVE-2026-54660 - swagger-typescript-api vulnerable to authorization-token exfiltration via spec `
CVE-2026-54660High
Summary When the developer supplies an `--authorizationToken` (commonly required to fetch a private spec behind authentication), `swagger-typescript-api`… - CVE-2026-54662 - swagger-typescript-api vulnerable to code injection via unescaped `servers[0].ur
CVE-2026-54662High
Summary `swagger-typescript-api` interpolates `servers[0].url` directly into a TypeScript class-body field initializer of the generated **fetch** `HttpClient`… - CVE-2026-54661 - swagger-typescript-api vulnerable to code injection via unescaped `servers[0].ur
CVE-2026-54661High
Summary `swagger-typescript-api` interpolates `servers[0].url` directly into a TypeScript string literal inside the `HttpClient` constructor body of the… - CVE-2026-54664 - swagger-typescript-api vulnerable to code injection via unescaped enum string va
CVE-2026-54664High
Summary `swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generated TypeScript `enum` declarations without…
Medium (11 条)
- GHSA-wchh-9x6h-7f6p - olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193
CVE-2022-39255CVE-2024-45193Medium 3.1
Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519 signature malleability, and timing leaks in… - CVE-2026-54712 - OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
CVE-2026-54712Medium
The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An… - CVE-2026-54704 - OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text
CVE-2026-54704Medium
OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a… - CVE-2026-54705 - mathlive's Lack of Escaping of HTML allows for XSS
CVE-2026-54705Medium
Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (`\htmlData`, `\href`), text-content reflection was missed. The `\text{}`, `\mbox{}`… - CVE-2026-52837 - Easy!Appointments has unauthenticated customer PII disclosure on booking resched
CVE-2026-52837Medium
## Summary The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the **entire customer… - CVE-2026-54082 - veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Pro
CVE-2026-54082Medium
Summary veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and `GFPDAcroForm.getdynamicRender()`). A… - CVE-2026-54080 - veraPDF Parser DoS via PostScript CMap Streams
CVE-2026-54080Medium
## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allows a remote attacker to exhaust validator… - CVE-2026-54081 - veraPDF Parser DoS via PostScript Type 1 Font Programs
CVE-2026-54081Medium
## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allows a remote attacker to exhaust validator…
…另有 3 条 Medium 级漏洞（已省略）
Low (6 条)
- GHSA-pmwx-rm49-xv39 - ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traver Low
Summary Active Record Tenanted's override of Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the… - CVE-2026-52840 - Easy!Appointments has server-side request forgery in CalDAV connection test that
CVE-2026-52840Low
Summary `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or… - CVE-2026-52839 - Easy!Appointments appointments/store and appointments/update allow cross-provide
CVE-2026-52839Low
## Summary Easy!Appointments correctly filters provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an…
…另有 3 条 Low 级漏洞（已省略）
🛡️ NVD-Latest（136 条）
Critical (37 条)
- CVE-2026-11756 A Deserialization of Untrusted Data vulnerability affecting Station Launcher App
CVE-2026-11756Critical 10.0
CVE-2026-11756 CVSS:10.0 A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE… - CVE-2026-48030 Pheditor is a single-file editor and file manager written in PHP. From version 2
CVE-2026-48030Critical 9.9
CVE-2026-48030 CVSS:9.9 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection…
+GitHub-Advis+PoC-in-GitHu - CVE-2026-16462 In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This a
CVE-2026-16462Critical 9.8
CVE-2026-16462 CVSS:9.8 In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute… - CVE-2026-15014 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart
CVE-2026-15014Critical 9.8
CVE-2026-15014 CVSS:9.8 The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to… - CVE-2026-14545 The TrueBooker WordPress plugin before 1.2.4 does not validate account ownershi
CVE-2026-14545Critical 9.8
CVE-2026-14545 CVSS:9.8 The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its… - CVE-2021-32088 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.27
CVE-2021-32088Critical 9.8
CVE-2021-32088 CVSS:9.8 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting… - CVE-2021-32086 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.27
CVE-2021-32086Critical 9.8
CVE-2021-32086 CVSS:9.8 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to… - CVE-2021-32084 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.27
CVE-2021-32084Critical 9.8
CVE-2021-32084 CVSS:9.8 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by… - CVE-2026-43822 A use after free issue was addressed with improved memory management. This issue
CVE-2026-43822Critical 9.8
CVE-2026-43822 CVSS:9.8 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-43814 A use after free issue was addressed with improved memory management. This issue
CVE-2026-43814Critical 9.8
CVE-2026-43814 CVSS:9.8 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe… - CVE-2026-43812 A use after free issue was addressed with improved memory management. This issue
CVE-2026-43812Critical 9.8
CVE-2026-43812 CVSS:9.8 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-43810 The issue was addressed with improved memory handling. This issue is fixed in iO
CVE-2026-43810Critical 9.8
CVE-2026-43810 CVSS:9.8 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS… - CVE-2026-43809 An out-of-bounds read was addressed with improved bounds checking. This issue is
CVE-2026-43809Critical 9.8
CVE-2026-43809 CVSS:9.8 An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,… - CVE-2026-43807 A buffer overflow was addressed with improved bounds checking. This issue is fix
CVE-2026-43807Critical 9.8
CVE-2026-43807 CVSS:9.8 A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia… - CVE-2026-43805 A race condition was addressed with improved state handling. This issue is fixed
CVE-2026-43805Critical 9.8
CVE-2026-43805 CVSS:9.8 A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8,… - CVE-2026-43803 An out-of-bounds write issue was addressed with improved bounds checking. This i
CVE-2026-43803Critical 9.8
CVE-2026-43803 CVSS:9.8 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS… - CVE-2026-43802 An out-of-bounds write issue was addressed with improved bounds checking. This i
CVE-2026-43802Critical 9.8
CVE-2026-43802 CVSS:9.8 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma… - CVE-2026-43799 A use after free issue was addressed with improved memory management. This issue
CVE-2026-43799Critical 9.8
CVE-2026-43799 CVSS:9.8 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-43793 An issue existed in the handling of environment variables. This issue was addres
CVE-2026-43793Critical 9.8
CVE-2026-43793 CVSS:9.8 An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in… - CVE-2026-43779 A logic issue was addressed with improved restrictions. This issue is fixed in m
CVE-2026-43779Critical 9.8
CVE-2026-43779 CVSS:9.8 A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… - CVE-2026-43778 A use after free issue was addressed with improved memory management. This issue
CVE-2026-43778Critical 9.8
CVE-2026-43778 CVSS:9.8 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-43773 An out-of-bounds read was addressed with improved bounds checking. This issue is
CVE-2026-43773Critical 9.8
CVE-2026-43773 CVSS:9.8 An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,… - CVE-2026-43769 An integer overflow was addressed with improved input validation. This issue is
CVE-2026-43769Critical 9.8
CVE-2026-43769 CVSS:9.8 An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-43764 An integer overflow was addressed with improved input validation. This issue is
CVE-2026-43764Critical 9.8
CVE-2026-43764 CVSS:9.8 An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,… - CVE-2026-43757 An out-of-bounds read was addressed with improved bounds checking. This issue is
CVE-2026-43757Critical 9.8
CVE-2026-43757 CVSS:9.8 An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,… - CVE-2026-43750 A buffer overflow was addressed with improved bounds checking. This issue is fix
CVE-2026-43750Critical 9.8
CVE-2026-43750 CVSS:9.8 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… - CVE-2026-43748 An out-of-bounds write issue was addressed with improved bounds checking. This i
CVE-2026-43748Critical 9.8
CVE-2026-43748 CVSS:9.8 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe… - CVE-2026-43730 A permissions issue was addressed with additional restrictions. This issue is fi
CVE-2026-43730Critical 9.8
CVE-2026-43730 CVSS:9.8 A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS… - CVE-2026-43710 The issue was addressed with improved memory handling. This issue is fixed in ma
CVE-2026-43710Critical 9.8
CVE-2026-43710 CVSS:9.8 The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… - CVE-2026-43694 The issue was addressed with improved memory handling. This issue is fixed in ma
CVE-2026-43694Critical 9.8
CVE-2026-43694 CVSS:9.8 The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… - CVE-2026-43682 The issue was addressed with improved memory handling. This issue is fixed in ma
CVE-2026-43682Critical 9.8
CVE-2026-43682 CVSS:9.8 The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… - CVE-2026-39873 The issue was addressed with improved memory handling. This issue is fixed in ma
CVE-2026-39873Critical 9.8
CVE-2026-39873 CVSS:9.8 The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… - CVE-2026-28982 A race condition was addressed with improved locking. This issue is fixed in mac
CVE-2026-28982Critical 9.8
CVE-2026-28982 CVSS:9.8 A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… - CVE-2026-28928 A use after free issue was addressed with improved memory management. This issue
CVE-2026-28928Critical 9.8
CVE-2026-28928 CVSS:9.8 A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe… - CVE-2026-28911 The issue was addressed with improved memory handling. This issue is fixed in ma
CVE-2026-28911Critical 9.8
CVE-2026-28911 CVSS:9.8 The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app… - CVE-2026-55579 Pheditor is a single-file editor and file manager written in PHP. From version 2
CVE-2026-55579Critical 9.8
CVE-2026-55579 CVSS:9.8 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a…
+GitHub-Advis+PoC-in-GitHu - CVE-2026-11841 An attacker may perform unauthenticated read and write operations on sensitive f
CVE-2026-11841Critical 9.4
CVE-2026-11841 CVSS:9.4 An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP…
High (99 条)
- CVE-2026-7187 Missing authentication for critical function vulnerability in Universal Software
CVE-2026-7187High 8.8
CVE-2026-7187 CVSS:8.8 Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly… - CVE-2026-62427 [This CNA information record relates to multiple CVEs; the text explains which a
CVE-2026-62427High 8.8
CVE-2026-62427 CVSS:8.8 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To… - CVE-2026-62426 [This CNA information record relates to multiple CVEs; the text explains which a
CVE-2026-62426High 8.8
CVE-2026-62426 CVSS:8.8 [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To… - CVE-2026-14328 The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plug
CVE-2026-14328High 8.8
CVE-2026-14328 CVSS:8.8 The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation… - CVE-2026-14168 A low privileged remote attacker can gain administrator privileges due to missin
CVE-2026-14168High 8.8
CVE-2026-14168 CVSS:8.8 A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration… - CVE-2026-14167 A low privileged remote attacker can perform privileged configuration changes re
CVE-2026-14167High 8.8
CVE-2026-14167 CVSS:8.8 A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission… - CVE-2021-32087 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.27
CVE-2021-32087High 8.8
CVE-2021-32087 CVSS:8.8 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp… - CVE-2021-32085 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.27
CVE-2021-32085High 8.8
CVE-2021-32085 CVSS:8.8 An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The… - CVE-2026-43818 An integer overflow was addressed with improved input validation. This issue is
CVE-2026-43818High 8.8
CVE-2026-43818 CVSS:8.8 An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-28931 A buffer overflow was addressed with improved bounds checking. This issue is fix
CVE-2026-28931High 8.8
CVE-2026-28931 CVSS:8.8 A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS… - CVE-2026-66014 JFrog Artifactory contains an authentication handling weakness in internal reque
CVE-2026-66014High 8.8
CVE-2026-66014 CVSS:8.8 JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may… - CVE-2026-65921 A path validation weakness in archive extraction/write handling allows entries w
CVE-2026-65921High 8.8
CVE-2026-65921 CVSS:8.8 A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the… - CVE-2026-65617 A deserialization weakness in JFrog Artifactory package handling could allow a l
CVE-2026-65617High 8.8
CVE-2026-65617 CVSS:8.8 A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality,… - CVE-2026-65616 Incorrect authorization validation in refresh token signature allows non-admin u
CVE-2026-65616High 8.8
CVE-2026-65616 CVSS:8.8 Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. 产品: - CVE-2026-56748 Improper validation of symbolic links in the Pack Git import feature in Cribl St
CVE-2026-56748High 8.8
CVE-2026-56748 CVSS:8.8 Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated… - CVE-2026-56747 Improper control of generation of code in the JSON Pointer-to-accessor compiler
CVE-2026-56747High 8.8
CVE-2026-56747 CVSS:8.8 Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote… - CVE-2026-42017 An event-handling weakness in JFrog Artifactory could expose privileged authoriz
CVE-2026-42017High 8.8
CVE-2026-42017 CVSS:8.8 An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under… - CVE-2026-55578 Pheditor is a single-file editor and file manager written in PHP. From version 2
CVE-2026-55578High 8.8
CVE-2026-55578 CVSS:8.8 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in…
+GitHub-Advis - CVE-2026-54540 Pheditor is a single-file editor and file manager written in PHP. Prior to versi
CVE-2026-54540High 8.8
CVE-2026-54540 CVSS:8.8 Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command…
+GitHub-Advis - CVE-2026-51235 LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libr
CVE-2026-51235High 8.8
CVE-2026-51235 CVSS:8.8 LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function… - CVE-2026-28973 An integer overflow was addressed with improved input validation. This issue is
CVE-2026-28973High 8.6
CVE-2026-28973 CVSS:8.6 An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-49332 A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity
CVE-2026-49332High 8.5
CVE-2026-49332 CVSS:8.5 A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys… - CVE-2026-43772 A path traversal issue was addressed with improved input validation. This issue
CVE-2026-43772High 8.2
CVE-2026-43772 CVSS:8.2 A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,… - CVE-2026-64642 Next.js is a React framework for building full-stack web applications. In versio
CVE-2026-64642High 8.2
CVE-2026-64642 CVSS:8.2 Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting…
+GitHub-Advis - CVE-2026-14169 Due to incorrect behavior order a low privileged remote attacker could trigger a
CVE-2026-14169High 8.1
CVE-2026-14169 CVSS:8.1 Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and… - CVE-2026-42016 JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a pri
CVE-2026-42016High 8.1
CVE-2026-42016 CVSS:8.1 JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of… - CVE-2026-62428 When grant-copy operations are processed, the respective grant may or may not al
CVE-2026-62428High 7.8
CVE-2026-62428 CVSS:7.8 When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or… - CVE-2026-43780 An integer overflow was addressed with improved input validation. This issue is
CVE-2026-43780High 7.8
CVE-2026-43780 CVSS:7.8 An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-43776 A buffer overflow was addressed with improved bounds checking. This issue is fix
CVE-2026-43776High 7.8
CVE-2026-43776 CVSS:7.8 A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8,… - CVE-2026-43749 A parsing issue in the handling of directory paths was addressed with improved p
CVE-2026-43749High 7.8
CVE-2026-43749 CVSS:7.8 A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia… - CVE-2026-43733 The issue was addressed with improved memory handling. This issue is fixed in iO
CVE-2026-43733High 7.8
CVE-2026-43733 CVSS:7.8 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS… - CVE-2026-43729 The issue was addressed with improved memory handling. This issue is fixed in iO
CVE-2026-43729High 7.8
CVE-2026-43729 CVSS:7.8 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS… - CVE-2026-43723 A path handling issue was addressed with improved validation. This issue is fixe
CVE-2026-43723High 7.8
CVE-2026-43723 CVSS:7.8 A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8,… - CVE-2026-43711 A memory corruption issue was addressed with improved memory handling. This issu
CVE-2026-43711High 7.8
CVE-2026-43711 CVSS:7.8 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia… - CVE-2026-43698 An injection issue was addressed with improved validation. This issue is fixed i
CVE-2026-43698High 7.8
CVE-2026-43698 CVSS:7.8 An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… - CVE-2026-43673 The issue was addressed with improved memory handling. This issue is fixed in iO
CVE-2026-43673High 7.8
CVE-2026-43673 CVSS:7.8 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS… - CVE-2026-39877 A memory corruption issue was addressed with improved memory handling. This issu
CVE-2026-39877High 7.8
CVE-2026-39877 CVSS:7.8 A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma… - CVE-2026-39875 A permissions issue was addressed with additional restrictions. This issue is fi
CVE-2026-39875High 7.8
CVE-2026-39875 CVSS:7.8 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS…
+PoC-in-GitHu - CVE-2026-39874 A permissions issue was addressed with additional restrictions. This issue is fi
CVE-2026-39874High 7.8
CVE-2026-39874 CVSS:7.8 A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… - CVE-2026-28981 A buffer overflow was addressed with improved bounds checking. This issue is fix
CVE-2026-28981High 7.8
CVE-2026-28981 CVSS:7.8 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… - CVE-2026-28912 A logic issue was addressed with improved restrictions. This issue is fixed in m
CVE-2026-28912High 7.8
CVE-2026-28912 CVSS:7.8 A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be… - CVE-2026-66758 A flaw was found in the file-fits plugin in GIMP. When processing a FITS image f
CVE-2026-66758High 7.8
CVE-2026-66758 CVSS:7.8 A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes… - CVE-2026-28896 The issue was addressed with improved memory handling. This issue is fixed in ma
CVE-2026-28896High 7.7
CVE-2026-28896 CVSS:7.7 The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An attacker… - CVE-2026-59878 Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ
CVE-2026-59878High 7.5
CVE-2026-59878 CVSS:7.5 Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer… - CVE-2026-65881 Joomla Extension - joomdle.com - Insecure default configuration allows read/writ
CVE-2026-65881High 7.5
CVE-2026-65881 CVSS:7.5 Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default… - CVE-2026-62431 The logic to handle periodic Viridian STIMERs performs a division with an unchec
CVE-2026-62431High 7.5
CVE-2026-62431 CVSS:7.5 The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to… - CVE-2026-62430 Accesses to the CMOS memory contents are done using an indirect IO port pair. T
CVE-2026-62430High 7.5
CVE-2026-62430 CVSS:7.5 Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and… - CVE-2026-42493 Addressing certain issues, in particular related to operations which may take ex
CVE-2026-42493High 7.5
CVE-2026-42493 CVSS:7.5 Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has… - CVE-2026-42492 Xenstore, to have an up-to-date picture of the entire system, wants to know of d
CVE-2026-42492High 7.5
CVE-2026-42492 CVSS:7.5 Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more… - CVE-2026-15025 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builde
CVE-2026-15025High 7.5
CVE-2026-15025 CVSS:7.5 The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing… - CVE-2026-14785 The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injecti
CVE-2026-14785High 7.5
CVE-2026-14785 CVSS:7.5 The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to,… - CVE-2026-10207 The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Inject
CVE-2026-10207High 7.5
CVE-2026-10207 CVSS:7.5 The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due… - CVE-2026-14516 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre
CVE-2026-14516High 7.5
CVE-2026-14516 CVSS:7.5 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the… - CVE-2026-13161 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress i
CVE-2026-13161High 7.5
CVE-2026-13161 CVSS:7.5 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the… - CVE-2026-12800 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu
CVE-2026-12800High 7.5
CVE-2026-12800 CVSS:7.5 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of… - CVE-2026-12741 The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is v
CVE-2026-12741High 7.5
CVE-2026-12741 CVSS:7.5 The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the… - CVE-2026-14924 The Tablesome Table WordPress plugin before 1.1.31 does not perform any authent
CVE-2026-14924High 7.5
CVE-2026-14924 CVSS:7.5 The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX… - CVE-2026-14490 The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPres
CVE-2026-14490High 7.5
CVE-2026-14490 CVSS:7.5 The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all… - CVE-2026-17524 Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Travers
CVE-2026-17524High 7.5
CVE-2026-17524 CVSS:7.5 Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during… - CVE-2026-66473 Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.
CVE-2026-66473High 7.5
CVE-2026-66473 CVSS:7.5 Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. 产品: - CVE-2025-63913 An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of s
CVE-2025-63913High 7.5
CVE-2025-63913 CVSS:7.5 An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or… - CVE-2026-51078 An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive info
CVE-2026-51078High 7.5
CVE-2026-51078 CVSS:7.5 An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the… - CVE-2026-51077 SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to ob
CVE-2026-51077High 7.5
CVE-2026-51077 CVSS:7.5 SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter… - CVE-2026-43777 This issue was addressed with improved input validation. This issue is fixed in
CVE-2026-43777High 7.5
CVE-2026-43777 CVSS:7.5 This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe… - CVE-2026-43728 This issue was addressed through improved state management. This issue is fixed
CVE-2026-43728High 7.5
CVE-2026-43728 CVSS:7.5 This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. An attacker may be able to modify… - CVE-2026-51244 schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackF
CVE-2026-51244High 7.5
CVE-2026-51244 CVSS:7.5 schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controlled index… - CVE-2026-12383 A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStre
CVE-2026-12383High 7.5
CVE-2026-12383 CVSS:7.5 A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls… - CVE-2026-64641 Next.js is a React framework for building full-stack web applications. In versio
CVE-2026-64641High 7.5
CVE-2026-64641 CVSS:7.5 Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10,…
+GitHub-Advis - CVE-2026-45623 PostCSS takes a CSS file and provides an API to analyze and modify its rules by
CVE-2026-45623High 7.5
CVE-2026-45623 CVSS:7.5 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In…
+GitHub-Advis - CVE-2026-62433 Parts of the DM_OP handling code assumes the caller has provided the required nu
CVE-2026-62433High 7.3
CVE-2026-62433 CVSS:7.3 Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any… - CVE-2026-62432 The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are e
CVE-2026-62432High 7.3
CVE-2026-62432 CVSS:7.3 The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can… - CVE-2026-13440 The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Che
CVE-2026-13440High 7.2
CVE-2026-13440 CVSS:7.2 The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is… - CVE-2026-61376 ELECOM wireless LAN routers and access points devices contain an OS Command Inje
CVE-2026-61376High 7.2
CVE-2026-61376 CVSS:7.2 ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this… - CVE-2026-59764 ELECOM wireless LAN routers and access points devices contain an OS Command Inje
CVE-2026-59764High 7.2
CVE-2026-59764 CVSS:7.2 ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is… - CVE-2026-16585 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl
CVE-2026-16585High 7.2
CVE-2026-16585 CVSS:7.2 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file… - CVE-2026-65442 Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versio
CVE-2026-65442High 7.2
CVE-2026-65442 CVSS:7.2 Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. 产品: - CVE-2026-61953 Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro
CVE-2026-61953High 7.2
CVE-2026-61953 CVSS:7.2 Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. 产品: - CVE-2026-66015 An authenticated privilege-escalation vulnerability in JFrog Platform may be exp
CVE-2026-66015High 7.2
CVE-2026-66015 CVSS:7.2 An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions.… - CVE-2026-14870 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin befor
CVE-2026-14870High 7.1
CVE-2026-14870 CVSS:7.1 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a… - CVE-2026-65447 Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions
CVE-2026-65447High 7.1
CVE-2026-65447 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. 产品: - CVE-2026-65446 Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
CVE-2026-65446High 7.1
CVE-2026-65446 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. 产品: - CVE-2026-65443 Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.
CVE-2026-65443High 7.1
CVE-2026-65443 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. 产品: - CVE-2026-65441 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
CVE-2026-65441High 7.1
CVE-2026-65441 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. 产品: - CVE-2026-65440 Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
CVE-2026-65440High 7.1
CVE-2026-65440 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. 产品: - CVE-2026-65439 Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7
CVE-2026-65439High 7.1
CVE-2026-65439 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. 产品: - CVE-2026-65438 Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7
CVE-2026-65438High 7.1
CVE-2026-65438 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. 产品: - CVE-2026-65437 Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWal
CVE-2026-65437High 7.1
CVE-2026-65437 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions. 产品: - CVE-2026-61957 Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5
CVE-2026-61957High 7.1
CVE-2026-61957 CVSS:7.1 Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. 产品: - CVE-2026-43813 A validation issue was addressed with improved input sanitization. This issue is
CVE-2026-43813High 7.1
CVE-2026-43813 CVSS:7.1 A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6,… - CVE-2026-43771 A stack overflow was addressed with improved input validation. This issue is fix
CVE-2026-43771High 7.1
CVE-2026-43771 CVSS:7.1 A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… - CVE-2026-43747 An out-of-bounds read was addressed with improved bounds checking. This issue is
CVE-2026-43747High 7.1
CVE-2026-43747 CVSS:7.1 An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,… - CVE-2026-43681 A buffer overflow was addressed with improved bounds checking. This issue is fix
CVE-2026-43681High 7.1
CVE-2026-43681 CVSS:7.1 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… - CVE-2026-43672 An authorization issue was addressed with improved state management. This issue
CVE-2026-43672High 7.1
CVE-2026-43672 CVSS:7.1 An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8,… - CVE-2026-28945 A permissions issue was addressed with additional sandbox restrictions. This iss
CVE-2026-28945High 7.1
CVE-2026-28945 CVSS:7.1 A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma… - CVE-2026-65922 An authorization weakness in JFrog Artifactory internal metadata handling could
CVE-2026-65922High 7.1
CVE-2026-65922 CVSS:7.1 An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to… - CVE-2026-66759 A flaw was found in the file-icns plugin in GIMP. When applying a decompressed m
CVE-2026-66759High 7.1
CVE-2026-66759 CVSS:7.1 A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from… - CVE-2026-43755 A race condition was addressed with improved state management. This issue is fix
CVE-2026-43755High 7.0
CVE-2026-43755 CVSS:7.0 A race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may… - CVE-2026-43693 A race condition was addressed with improved state handling. This issue is fixed
CVE-2026-43693High 7.0
CVE-2026-43693 CVSS:7.0 A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… - CVE-2026-28926 A race condition was addressed with improved state handling. This issue is fixed
CVE-2026-28926High 7.0
CVE-2026-28926 CVSS:7.0 A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app…
⚔️ Sploitus（30 条）
Unknown (30 条)
- Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Senior Rubiweb exploit
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Senior Rubiweb exploit - Exploit for CVE-2026-66066 exploit
CVE-2026-66066
Exploit for CVE-2026-66066 exploit
…另有 28 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-30 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV