📊 2026-07-31 漏洞情报日报 · 200 条 · 高危 162
每日漏洞情报汇总 · 2026-07-31
📊 2026-07-31 漏洞情报日报
📋 共 200 条
🔥 高危/严重 162 条
🐙 GitHub-Advisory 19 条 🔥12
🛡️ NVD-Latest 150 条 🔥150
⚔️ Sploitus 31 条
🤖 今日安全态势分析
🎯 今日重点关注
- CVE-2026-58162 / CVE-2026-58150 / CVE-2026-57834 / CVE-2026-33267（Apache Traffic Server） — 影响Apache Traffic Server 8~10.1.3版，漏洞类型包括证书生成劫持、请求走私、输入验证；利用条件：无需认证，可远程利用，CVSS 10.0，攻击者可完全控制证书或进行HTTP走私攻击。
- CVE-2026-66066（Active Storage + Rails） — 影响Ruby on Rails应用默认配置下显示图片变体的场景；漏洞类型为任意文件读取（含环境变量）可导致RCE；利用条件：无需认证，已有PoC公开（GitHub仓库），风险极高。
- CVE-2026-63232 / CVE-2026-63233 / CVE-2026-63234（Koollab LMS） — 影响Koollab学习管理系统，漏洞类型为SQL注入 + 不安全反序列化导致Webshell写入；利用条件：低权限认证用户即可触发，CVSS 9.9，可实现完全控制服务器。
- CVE-2026-67426 / CVE-2026-67429（Flyto2 Core） — 影响Flyto2 Core，漏洞类型包括未认证SSRF（callback_url无限制）和任意文件写入（image.download绕过路径检查）；利用条件：远程未认证攻击者可利用SSRF探测内网或写入恶意文件，风险严重。
📈 威胁趋势
- 远程代码执行（RCE）：Active Storage任意文件读取->RCE、Koollab LMS SQLi+反序列化写Webshell、Flyto2 Core任意文件写入，均为Critical级，攻击面广。
- 服务端请求伪造（SSRF）：Flyto2 Core /run接口未认证SSRF、dssrf SSRF绕过（CVE-2026-54722），可探测内网或触发其他漏洞。
- HTTP请求走私/输入验证：Apache Traffic Server三个CVSS 10.0漏洞针对Transfer-Encoding、chunked消息和证书验证，严重影响代理安全。
- 拒绝服务（DoS）：OliveTin OAuth2状态内存耗尽（未绑定增长）、MCP Ruby SDK单JSON-RPC请求造成GB级内存分配，均可由未认证远程攻击者触发。
- 会话劫持/权限提升：MCP Ruby SDK SSE会话中毒（无所有权验证）、terraform-mcp-server跨租户凭证重用（CVSS 10.0），导致工具调用权限泄露。
🛡️ 缓解建议
- 立即升级 Apache Traffic Server 至 9.2.15 或 10.1.4 及以上版本，修复请求走私与证书劫持漏洞；如无法升级，临时禁用 certifier 插件并配置严格HTTP/2校验。
- 针对 Active Storage 漏洞，手动禁用图片变体功能或限制可处理的图片格式与URL来源，同时升级 Rails 至包含修复的版本（参考官方公告）。
- 对 Koollab LMS 系统，立即应用官方补丁或临时关闭 “manual mark assessment” 等受影响端点，并检查服务器是否有异常Webshell文件。
- 加固 Flyto2 Core 部署：为 flyto-verification 服务添加认证机制，限制 image.download 的目标路径，并隔离沙箱目录权限。
🐙 GitHub-Advisory（19 条）
Critical (4 条)
- CVE-2025-4318 - AWS Amplify Studio UI Component Properties Has an Input Validation Issue
CVE-2025-4318Critical
Summary The AWS Amplify Studio [amplify-codegen-ui](https://github.com/aws-amplify/amplify-codegen-ui) is a package that generates front-end code from UI… - CVE-2026-66066 - Active Storage has possible arbitrary file read and remote code execution in Act
CVE-2026-66066Critical
Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the…
+PoC-in-GitHu - CVE-2026-67429 - Flyto2 Core: Arbitrary file write via image.download (and other file-writing mod
CVE-2026-67429Critical
## Summary `image.download` fetches a URL and writes the response to disk. It does not use the central path guard (`validate_path_with_env_config`, which… - CVE-2026-67426 - Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and inte
CVE-2026-67426Critical
## Summary The standalone `flyto-verification` service exposes `POST /run` with **no authentication**, on all interfaces (0.0.0.0:8344 per the shipped…
High (8 条)
- CVE-2026-54722 - dssrf has an SSRF bypass with remove_at_symbol_in_string
CVE-2026-54722High
## Summary `is_url_safe` in v1.0.3 contains an SSRF bypass. `remove_at_symbol_in_string` is applied to the raw URL string **before** `new URL()` parses it.… - CVE-2026-67437 - OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map
CVE-2026-67437High
## Summary OliveTin's OAuth2 login handler stores per-login state in an in-memory map (`registeredStates`) that grows unboundedly. States are added on every… - CVE-2026-67432 - MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocat
CVE-2026-67432High
## Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using `MCP::Server::Transports::StreamableHTTPTransport` to allocate gigabytes… - CVE-2026-67431 - MCP Ruby SDK: Ruby SSE Session Poisoning
CVE-2026-67431High
Summary **Vulnerability**: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a… - CVE-2026-67427 - Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being
CVE-2026-67427High
## Summary The capability policy denies the `env.get` and `env.load_dotenv` modules by default, with the stated reason that they read arbitrary host… - CVE-2026-67425 - Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url
CVE-2026-67425High
## Summary `llm.chat` reads the operator's provider key from the environment (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, ...) and sends it in the `Authorization:… - CVE-2026-67428 - Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without t
CVE-2026-67428High
## Summary Numerous HTTP-emitting modules (`core.api.http_get`, `core.api.http_post`, `graphql.query`/`graphql.mutation`, `monitor.http_check`,… - CVE-2026-67424 - Flyto2 Core: Guarded HTTP modules follow redirects into internal space without p
CVE-2026-67424High
## Summary The HTTP modules that DO call the SSRF guard (`http.get`, `http.request`, `http.batch`) validate only the initial URL, then issue the request with…
Medium (6 条)
- CVE-2026-67439 - OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Actio
CVE-2026-67439Medium
## Summary The synchronous execution RPCs `StartActionAndWait` and `StartActionByGetAndWait` return the full `LogEntry` for the just-executed action without… - CVE-2026-67438 - OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Sa
CVE-2026-67438Medium
Summary OliveTin's checkShellArgumentSafety() function maintains a blocklist of argument types unsafe for Shell mode actions, but does not include… - CVE-2026-63118 - MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protec
CVE-2026-63118Medium
## Summary `MCP::Server::Transports::StreamableHTTPTransport` (the Rack-mountable Streamable HTTP transport in the `mcp` gem) processes every incoming JSON-RPC… - CVE-2026-63119 - MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhausti
CVE-2026-63119Medium
## Summary The stdio transports in `MCP::Server::Transports::StdioTransport` and `MCP::Client::Stdio` read newline-delimited JSON-RPC frames using `IO#gets`… - CVE-2026-67430 - MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memo
CVE-2026-67430Medium
## Summary In its default configuration, `MCP::Server::Transports::StreamableHTTPTransport` never expires sessions. Every successful `initialize` request… - CVE-2026-67435 - linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redir
CVE-2026-67435Medium
Summary `lib.url.fetch()` follows HTTP redirects (`follow_redirects=True`). httpx strips only `Authorization` and `Cookie` when a redirect crosses the origin,…
Low (1 条)
- CVE-2026-54522 - MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
CVE-2026-54522Low
Summary `MessagePack::Buffer#clear` shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor…
🛡️ NVD-Latest（150 条）
Critical (33 条)
- CVE-2026-58162 The Apache Traffic Server certifier plugin generates certificates based on attac
CVE-2026-58162Critical 10.0
CVE-2026-58162 CVSS:10.0 The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache… - CVE-2026-58150 Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allo
CVE-2026-58150Critical 10.0
CVE-2026-58150 CVSS:10.0 Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects… - CVE-2026-57834 Apache Traffic Server allows request smuggling if chunked messages are malformed
CVE-2026-57834Critical 10.0
CVE-2026-57834 CVSS:10.0 Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0… - CVE-2026-33267 Improper Input Validation vulnerability in Apache Traffic Server. This issue af
CVE-2026-33267Critical 10.0
CVE-2026-33267 CVSS:10.0 Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14,… - CVE-2026-16498 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant cr
CVE-2026-16498Critical 10.0
CVE-2026-16498 CVSS:10.0 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless… - CVE-2026-63234 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed
CVE-2026-63234Critical 9.9
CVE-2026-63234 CVSS:9.9 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual… - CVE-2026-63233 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed
CVE-2026-63233Critical 9.9
CVE-2026-63233 CVSS:9.9 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the… - CVE-2026-63232 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed
CVE-2026-63232Critical 9.9
CVE-2026-63232 CVSS:9.9 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the… - CVE-2026-63227 An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authen
CVE-2026-63227Critical 9.9
CVE-2026-63227 CVSS:9.9 An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package… - CVE-2026-14900 The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Cod
CVE-2026-14900Critical 9.8
CVE-2026-14900 CVSS:9.8 The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3… - CVE-2026-59243 The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` w
CVE-2026-59243Critical 9.8
CVE-2026-59243 CVSS:9.8 The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to…
+PoC-in-GitHu - CVE-2025-10656 The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin f
CVE-2025-10656Critical 9.8
CVE-2025-10656 CVSS:9.8 The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in… - CVE-2026-18191 VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allo
CVE-2026-18191Critical 9.8
CVE-2026-18191 CVSS:9.8 VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a… - CVE-2026-13423 The Streamit WordPress theme through 4.5.0 does not perform any authorization or
CVE-2026-13423Critical 9.8
CVE-2026-13423 CVSS:9.8 The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX… - CVE-2026-18072 The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick
CVE-2026-18072Critical 9.8
CVE-2026-18072 CVSS:9.8 The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication… - CVE-2026-54658 Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeV
CVE-2026-54658Critical 9.8
CVE-2026-54658 CVSS:9.8 Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not…
+GitHub-Advis - CVE-2026-14512 IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-a
CVE-2026-14512Critical 9.8
CVE-2026-14512 CVSS:9.8 IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow… - CVE-2026-14446 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access con
CVE-2026-14446Critical 9.8
CVE-2026-14446 CVSS:9.8 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative… - CVE-2026-51267 schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability
CVE-2026-51267Critical 9.8
CVE-2026-51267 CVSS:9.8 schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The… - CVE-2026-51266 schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability
CVE-2026-51266Critical 9.8
CVE-2026-51266 CVSS:9.8 schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The… - CVE-2026-51263 schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::o
CVE-2026-51263Critical 9.8
CVE-2026-51263 CVSS:9.8 schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openai_speech function in the Audio library manually… - CVE-2026-66713 Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering compo
CVE-2026-66713Critical 9.8
CVE-2026-66713 CVSS:9.8 Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java… - CVE-2026-51271 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability
CVE-2026-51271Critical 9.6
CVE-2026-51271 CVSS:9.6 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function… - CVE-2026-58155 Apache Traffic Server truncates over-long header names, allowing header aliasing
CVE-2026-58155Critical 9.3
CVE-2026-58155 CVSS:9.3 Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue… - CVE-2026-41920 Improper Access Control vulnerability in Apache Traffic Server. This issue affe
CVE-2026-41920Critical 9.3
CVE-2026-41920 CVSS:9.3 Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14,… - CVE-2026-14973 IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow fil
CVE-2026-14973Critical 9.3
CVE-2026-14973 CVSS:9.3 IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected… - CVE-2026-14488 The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via
CVE-2026-14488Critical 9.1
CVE-2026-14488 CVSS:9.1 The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend… - CVE-2026-63230 A pre-authentication error-based SQL injection vulnerability in Koollab LMS allo
CVE-2026-63230Critical 9.1
CVE-2026-63230 CVSS:9.1 A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive… - CVE-2026-63229 A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an
CVE-2026-63229Critical 9.1
CVE-2026-63229 CVSS:9.1 A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL… - CVE-2026-64863 goshs is a feature-rich single-binary file server for red teamers and developers
CVE-2026-64863Critical 9.1
CVE-2026-64863 CVSS:9.1 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard…
+GitHub-Advis - CVE-2026-62325 goshs is a feature-rich single-binary file server for red teamers and developers
CVE-2026-62325Critical 9.1
CVE-2026-62325 CVSS:9.1 goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go…
+GitHub-Advis - CVE-2026-14959 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated at
CVE-2026-14959Critical 9.1
CVE-2026-14959 CVSS:9.1 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command… - CVE-2026-14958 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated at
CVE-2026-14958Critical 9.1
CVE-2026-14958 CVSS:9.1 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell…
High (117 条)
- CVE-2026-58154 Apache Traffic Server can write out of bounds or overflow integers while parsing
CVE-2026-58154High 8.9
CVE-2026-58154 CVSS:8.9 Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache… - CVE-2026-16496 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization
CVE-2026-16496High 8.9
CVE-2026-16496 CVSS:8.9 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode… - CVE-2026-50622 Description: Missing Authorization in Apache Atlas. A missing authorization vuln
CVE-2026-50622High 8.8
CVE-2026-50622 CVSS:8.8 Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any… - CVE-2026-64557 In the Linux kernel, the following vulnerability has been resolved: Bluetooth:
CVE-2026-64557High 8.8
CVE-2026-64557 CVSS:8.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in… - CVE-2026-12144 The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Es
CVE-2026-12144High 8.8
CVE-2026-12144 CVSS:8.8 The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5.… - CVE-2026-54653 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a
CVE-2026-54653High 8.8
CVE-2026-54653 CVSS:8.8 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL,…
+GitHub-Advis - CVE-2026-57510 SuperPlane before 0.27.0 contains a broken object-level authorization vulnerabil
CVE-2026-57510High 8.8
CVE-2026-57510 CVSS:8.8 SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows… - CVE-2026-16347 MikroTik RouterOS contains a weakness in its API authentication handling that la
CVE-2026-16347High 8.8
CVE-2026-16347 CVSS:8.8 MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login… - CVE-2026-49258 Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In ver
CVE-2026-49258High 8.8
CVE-2026-49258 CVSS:8.8 Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not… - CVE-2026-16771 In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to en
CVE-2026-16771High 8.8
CVE-2026-16771 CVSS:8.8 In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its… - CVE-2026-15992 The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalatio
CVE-2026-15992High 8.8
CVE-2026-15992 CVSS:8.8 The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is… - CVE-2026-51275 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2
CVE-2026-51275High 8.8
CVE-2026-51275 CVSS:8.8 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib allows remote… - CVE-2026-51274 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2
CVE-2026-51274High 8.8
CVE-2026-51274 CVSS:8.8 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows… - CVE-2026-66748 Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code
CVE-2026-66748High 8.8
CVE-2026-66748 CVSS:8.8 Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with…
+PoC-in-GitHu - CVE-2026-51269 schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability
CVE-2026-51269High 8.8
CVE-2026-51269 CVSS:8.8 schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech() function. The application… - CVE-2026-63727 Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper
CVE-2026-63727High 8.8
CVE-2026-63727 CVSS:8.8 Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user… - CVE-2026-58157 Apache Traffic Server can reuse server sessions and tunnels improperly, exposing
CVE-2026-58157High 8.7
CVE-2026-58157 CVSS:8.7 Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects… - CVE-2026-15325 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv
CVE-2026-15325High 8.7
CVE-2026-15325 CVSS:8.7 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to… - CVE-2026-15064 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv
CVE-2026-15064High 8.7
CVE-2026-15064 CVSS:8.7 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to… - CVE-2026-58182 The Apache Traffic Server ts_lua plugin mishandles initialization, transform con
CVE-2026-58182High 8.6
CVE-2026-58182 CVSS:8.6 The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache… - CVE-2026-11974 The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a use
CVE-2026-11974High 8.6
CVE-2026-11974 CVSS:8.6 The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read… - CVE-2026-54650 openhole exposes localhost to the internet in one command. In 0.1.1 and earlier,
CVE-2026-54650High 8.6
CVE-2026-54650 CVSS:8.6 openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go…
+GitHub-Advis - CVE-2026-48396 Bridge is affected by an Incorrect Authorization vulnerability that could result
CVE-2026-48396High 8.6
CVE-2026-48396 CVSS:8.6 Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the… - CVE-2026-48395 Bridge is affected by an Untrusted Search Path vulnerability that could result i
CVE-2026-48395High 8.6
CVE-2026-48395 CVSS:8.6 Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the… - CVE-2026-14869 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side req
CVE-2026-14869High 8.6
CVE-2026-14869 CVSS:8.6 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport… - CVE-2026-48388 Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vu
CVE-2026-48388High 8.6
CVE-2026-48388 CVSS:8.6 Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code… - CVE-2026-54609 QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol libra
CVE-2026-54609High 8.6
CVE-2026-54609 CVSS:8.6 QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's…
+GitHub-Advis - CVE-2026-54603 OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, inc
CVE-2026-54603High 8.6
CVE-2026-54603 CVSS:8.6 OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0 to 2.0.21, a…
+GitHub-Advis - CVE-2026-45293 WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enfor
CVE-2026-45293High 8.6
CVE-2026-45293 CVSS:8.6 WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until…
+GitHub-Advis - CVE-2026-58153 Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without
CVE-2026-58153High 8.3
CVE-2026-58153 CVSS:8.3 Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to… - CVE-2026-58188 Several Apache Traffic Server experimental plugins have memory-safety and limit
CVE-2026-58188High 8.2
CVE-2026-58188 CVSS:8.2 Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic… - CVE-2026-58184 The Apache Traffic Server header_rewrite plugin can crash or corrupt memory duri
CVE-2026-58184High 8.2
CVE-2026-58184 CVSS:8.2 The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This… - CVE-2026-58159 Apache Traffic Server can bypass IP access controls on UDS listeners and through
CVE-2026-58159High 8.2
CVE-2026-58159 CVSS:8.2 Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic… - CVE-2026-22068 Regular Expression without Anchors vulnerability in Apache Traffic Server. This
CVE-2026-22068High 8.2
CVE-2026-22068 CVSS:8.2 Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X… - CVE-2026-54691 datamodel-code-generator generates Python data models from schema definitions. F
CVE-2026-54691High 8.2
CVE-2026-54691 CVSS:8.2 datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0,…
+GitHub-Advis - CVE-2026-54690 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a
CVE-2026-54690High 8.2
CVE-2026-54690 CVSS:8.2 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL,…
+GitHub-Advis - CVE-2026-14996 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related
CVE-2026-14996High 8.2
CVE-2026-14996 CVSS:8.2 IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management. 产品: - CVE-2026-48391 Bridge is affected by an Untrusted Search Path vulnerability that could result i
CVE-2026-48391High 8.2
CVE-2026-48391 CVSS:8.2 Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the… - CVE-2026-48390 Bridge is affected by an Incorrect Authorization vulnerability that could result
CVE-2026-48390High 8.2
CVE-2026-48390 CVSS:8.2 Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage… - CVE-2026-47483 NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pp
CVE-2026-47483High 8.2
CVE-2026-47483 CVSS:8.2 NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause… - CVE-2026-43910 Appium Java Client is the Java language binding for writing Appium tests that co
CVE-2026-43910High 8.2
CVE-2026-43910 CVSS:8.2 Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until…
+GitHub-Advis - CVE-2026-58179 The Apache Traffic Server regex_remap plugin overflows the stack and integers fr
CVE-2026-58179High 8.1
CVE-2026-58179 CVSS:8.1 The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache… - CVE-2026-58177 The Apache Traffic Server Cripts framework has out-of-bounds writes, path traver
CVE-2026-58177High 8.1
CVE-2026-58177 CVSS:8.1 The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects… - CVE-2026-63231 A post-authentication SQL injection vulnerability in Koollab LMS allowed an auth
CVE-2026-63231High 8.1
CVE-2026-63231 CVSS:8.1 A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via… - CVE-2026-14300 The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Wo
CVE-2026-14300High 8.1
CVE-2026-14300 CVSS:8.1 The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time… - CVE-2026-14974 IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote a
CVE-2026-14974High 8.1
CVE-2026-14974 CVSS:8.1 IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe… - CVE-2026-48060 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to
CVE-2026-48060High 8.1
CVE-2026-48060 CVSS:8.1 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template…
+GitHub-Advis - CVE-2026-7769 IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2
CVE-2026-7769High 8.1
CVE-2026-7769 CVSS:8.1 IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File… - CVE-2026-54593 Pterodactyl is a free, open-source game server management panel. Prior to Panel
CVE-2026-54593High 8.1
CVE-2026-54593 CVSS:8.1 Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings…
+GitHub-Advis - CVE-2026-18220 An out-of-bounds write vulnerability was found in the BFD library's DLX ELF back
CVE-2026-18220High 7.8
CVE-2026-18220 CVSS:7.8 An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The…
+PoC-in-GitHu - CVE-2026-64556 In the Linux kernel, the following vulnerability has been resolved: perf/core:
CVE-2026-64556High 7.8
CVE-2026-64556 CVSS:7.8 In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec… - CVE-2026-54656 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a
CVE-2026-54656High 7.8
CVE-2026-54656 CVSS:7.8 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL,…
+GitHub-Advis - CVE-2026-54655 datamodel-code-generator generates Python data models from schema definitions. F
CVE-2026-54655High 7.8
CVE-2026-54655 CVSS:7.8 datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by…
+GitHub-Advis - CVE-2026-54654 datamodel-code-generator generates Python data models from schema definitions. F
CVE-2026-54654High 7.8
CVE-2026-54654 CVSS:7.8 datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data…
+GitHub-Advis - CVE-2026-54621 datamodel-code-generator generates Python data models from schema definitions. P
CVE-2026-54621High 7.8
CVE-2026-54621 CVSS:7.8 datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in…
+GitHub-Advis - CVE-2026-48394 Bridge is affected by an out-of-bounds write vulnerability that could result in
CVE-2026-48394High 7.8
CVE-2026-48394 CVSS:7.8 Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… - CVE-2026-48393 Bridge is affected by an out-of-bounds write vulnerability that could result in
CVE-2026-48393High 7.8
CVE-2026-48393 CVSS:7.8 Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… - CVE-2026-48392 Bridge is affected by an out-of-bounds write vulnerability that could result in
CVE-2026-48392High 7.8
CVE-2026-48392 CVSS:7.8 Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… - CVE-2026-48374 Bridge is affected by an Improper Limitation of a Pathname to a Restricted Direc
CVE-2026-48374High 7.8
CVE-2026-48374 CVSS:7.8 Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead… - CVE-2026-18107 A flaw was found in CRIU's handling of restartable sequences (rseq) during check
CVE-2026-18107High 7.8
CVE-2026-18107 CVSS:7.8 A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container… - CVE-2026-48372 Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that co
CVE-2026-48372High 7.8
CVE-2026-48372 CVSS:7.8 Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context… - CVE-2026-51273 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability
CVE-2026-51273High 7.8
CVE-2026-51273 CVSS:7.8 In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of… - CVE-2026-59931 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
CVE-2026-59931High 7.7
CVE-2026-59931 CVSS:7.7 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6,…
+GitHub-Advis - CVE-2026-16313 A flaw was found in sg3_utils. The sg_inq command, when invoked with the --expor
CVE-2026-16313High 7.6
CVE-2026-16313 CVSS:7.6 A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without… - CVE-2026-58189 Apache Traffic Server allows redirect-limit bypass when plugins reset the retry
CVE-2026-58189High 7.5
CVE-2026-58189 CVSS:7.5 Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue… - CVE-2026-58186 The Apache Traffic Server webp_transform plugin can decode unsafely and serve mi
CVE-2026-58186High 7.5
CVE-2026-58186 CVSS:7.5 The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects… - CVE-2026-58181 The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack
CVE-2026-58181High 7.5
CVE-2026-58181 CVSS:7.5 The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache… - CVE-2026-58180 The Apache Traffic Server txn_box plugin overflows the stack from attacker-contr
CVE-2026-58180High 7.5
CVE-2026-58180 CVSS:7.5 The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server:… - CVE-2026-58178 The Apache Traffic Server ESI plugin can recurse without bound and fetch attacke
CVE-2026-58178High 7.5
CVE-2026-58178 CVSS:7.5 The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic… - CVE-2026-58175 Apache Traffic Server leaks memory when handling HostDB SRV records. This issue
CVE-2026-58175High 7.5
CVE-2026-58175 CVSS:7.5 Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through… - CVE-2026-58164 Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in
CVE-2026-58164High 7.5
CVE-2026-58164 CVSS:7.5 Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects… - CVE-2026-58163 Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corr
CVE-2026-58163High 7.5
CVE-2026-58163 CVSS:7.5 Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache… - CVE-2026-58161 Apache Traffic Server can crash from null dereferences and dangling references i
CVE-2026-58161High 7.5
CVE-2026-58161 CVSS:7.5 Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache… - CVE-2026-65324 Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or
CVE-2026-65324High 7.5
CVE-2026-65324 CVSS:7.5 Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server… - CVE-2026-58151 Apache Traffic Server can be crashed or driven to resource exhaustion by abusive
CVE-2026-58151High 7.5
CVE-2026-58151 CVSS:7.5 Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects… - CVE-2026-54719 goshs is a feature-rich single-binary file server for red teamers and developers
CVE-2026-54719High 7.5
CVE-2026-54719 CVSS:7.5 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload…
+GitHub-Advis - CVE-2026-54638 gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.Unencr
CVE-2026-54638High 7.5
CVE-2026-54638 CVSS:7.5 gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go…
+GitHub-Advis - CVE-2026-47219 find-my-way is a framework-independent HTTP router that internally uses a Radix
CVE-2026-47219High 7.5
CVE-2026-47219 CVSS:7.5 find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards.…
+GitHub-Advis - CVE-2026-55415 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a
CVE-2026-55415High 7.5
CVE-2026-55415 CVSS:7.5 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL,…
+GitHub-Advis - CVE-2026-55391 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a
CVE-2026-55391High 7.5
CVE-2026-55391 CVSS:7.5 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL,…
+GitHub-Advis - CVE-2026-55390 datamodel-code-generator generates Python data models from schema definitions. F
CVE-2026-55390High 7.5
CVE-2026-55390 CVSS:7.5 datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in…
+GitHub-Advis - CVE-2026-55389 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a
CVE-2026-55389High 7.5
CVE-2026-55389 CVSS:7.5 datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL,…
+GitHub-Advis - CVE-2026-15280 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collecti
CVE-2026-15280High 7.5
CVE-2026-15280 CVSS:7.5 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection… - CVE-2026-15057 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerab
CVE-2026-15057High 7.5
CVE-2026-15057 CVSS:7.5 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap… - CVE-2026-14981 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv
CVE-2026-14981High 7.5
CVE-2026-14981 CVSS:7.5 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by… - CVE-2026-13463 IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive in
CVE-2026-13463High 7.5
CVE-2026-13463 CVSS:7.5 IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log… - CVE-2026-66745 Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) con
CVE-2026-66745High 7.5
CVE-2026-66745 CVSS:7.5 Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows… - CVE-2026-59932 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
CVE-2026-59932High 7.5
CVE-2026-59932 CVSS:7.5 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6,…
+GitHub-Advis - CVE-2026-59933 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.
CVE-2026-59933High 7.5
CVE-2026-59933 CVSS:7.5 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6,…
+GitHub-Advis - CVE-2026-54635 pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webho
CVE-2026-54635High 7.5
CVE-2026-54635 CVSS:7.5 pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0,…
+GitHub-Advis - CVE-2026-67185 TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauth
CVE-2026-67185High 7.5
CVE-2026-67185 CVSS:7.5 TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by…
+PoC-in-GitHu - CVE-2026-67184 TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that all
CVE-2026-67184High 7.5
CVE-2026-67184 CVSS:7.5 TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker…
+PoC-in-GitHu - CVE-2026-67183 TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthent
CVE-2026-67183High 7.5
CVE-2026-67183 CVSS:7.5 TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending…
+PoC-in-GitHu - CVE-2026-67182 Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability tha
CVE-2026-67182High 7.5
CVE-2026-67182 CVSS:7.5 Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by…
+PoC-in-GitHu - CVE-2026-61609 Pterodactyl is a free, open-source game server management panel. From 1.7.0 unti
CVE-2026-61609High 7.5
CVE-2026-61609 CVSS:7.5 Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in…
+GitHub-Advis - CVE-2026-47427 GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the Completio
CVE-2026-47427High 7.5
CVE-2026-47427 CVSS:7.5 GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses…
+GitHub-Advis - CVE-2026-66299 Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket cha
CVE-2026-66299High 7.5
CVE-2026-66299 CVSS:7.5 Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from… - CVE-2026-13690 The UsersWP WordPress plugin before 1.2.67 does not validate the selected authe
CVE-2026-13690High 7.4
CVE-2026-13690 CVSS:7.4 The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler,… - CVE-2026-56822 Netty is an asynchronous, event-driven network application framework. Prior to v
CVE-2026-56822High 7.4
CVE-2026-56822 CVSS:7.4 Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the… - CVE-2026-56821 Netty is an asynchronous, event-driven network application framework. Prior to v
CVE-2026-56821High 7.4
CVE-2026-56821 CVSS:7.4 Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the… - CVE-2026-15328 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv
CVE-2026-15328High 7.4
CVE-2026-15328 CVSS:7.4 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to… - CVE-2026-14528 IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote a
CVE-2026-14528High 7.4
CVE-2026-14528 CVSS:7.4 IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information. 产品: - CVE-2026-23904 Kyuubi Engine UI proxy accepts a host and port from the request path and proxies
CVE-2026-23904High 7.3
CVE-2026-23904 CVSS:7.3 Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester… - CVE-2026-14893 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana
CVE-2026-14893High 7.3
CVE-2026-14893 CVSS:7.3 IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1… - CVE-2026-8164 Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardwar
CVE-2026-8164High 7.3
CVE-2026-8164 CVSS:7.3 Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client… - CVE-2026-16655 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Fo
CVE-2026-16655High 7.2
CVE-2026-16655 CVSS:7.2 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored… - CVE-2026-16597 The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPres
CVE-2026-16597High 7.2
CVE-2026-16597 CVSS:7.2 The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… - CVE-2026-13425 The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scr
CVE-2026-13425High 7.2
CVE-2026-13425 CVSS:7.2 The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up… - CVE-2026-24033 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2026-24033High 7.2
CVE-2026-24033 CVSS:7.2 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue… - CVE-2026-12476 The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File
CVE-2026-12476High 7.2
CVE-2026-12476 CVSS:7.2 The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is… - CVE-2026-54605 OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients
CVE-2026-54605High 7.2
CVE-2026-54605 CVSS:7.2 OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5,…
+GitHub-Advis - CVE-2026-14234 The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability c
CVE-2026-14234High 7.1
CVE-2026-14234 CVSS:7.1 The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an… - CVE-2026-14976 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected
CVE-2026-14976High 7.1
CVE-2026-14976 CVSS:7.1 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the… - CVE-2026-13442 IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another use
CVE-2026-13442High 7.1
CVE-2026-13442 CVSS:7.1 IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content… - CVE-2026-16192 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected
CVE-2026-16192High 7.1
CVE-2026-16192 CVSS:7.1 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the… - CVE-2026-54545 wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0
CVE-2026-54545High 7.1
CVE-2026-54545 CVSS:7.1 wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module…
+GitHub-Advis - CVE-2026-16184 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b
CVE-2026-16184High 7.0
CVE-2026-16184 CVSS:7.0 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted…
⚔️ Sploitus（31 条）
Unknown (31 条)
- Exploit for Code Injection in Craftcms Craft_Cms exploit
Exploit for Code Injection in Craftcms Craft_Cms exploit - exploit-dev-1 exploit
exploit-dev-1 exploit
…另有 29 条 Unknown 级漏洞（已省略）
🤖 漏洞情报自动汇总 · 2026-07-31 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV