🤖 今日安全态势分析

🎯 今日重点关注

• CVE-2026-66803 Azure Cosmos DB（CVSS 10.0）：不安全的访问控制，未授权攻击者可通过网络执行代码，影响云上数据安全，需立即排查。
• CVE-2026-18452 DMS+（CVSS 10.0）：使用硬编码凭据，未认证远程攻击者可利用固定API密钥完全控制所有DMS+设备，风险极高。
• CVE-2026-17566 pgAdmin（CVSS 9.9）：导入/导出工具将用户SQL查询拼接进psql命令，攻击者可通过构造查询实现命令注入进而RCE。
• CVE-2026-8457 WooCommerce Social Login（CVSS 9.8）：Apple登录处理器信任任意id_token，可导致身份验证绕过，大量WordPress站点受影响。
• CVE-2026-65321 PyAthena（CVSS 9.8）：默认参数格式化器引号转义不当，未认证攻击者可注入任意SQL，已有PoC公开。

📈 威胁趋势

• RCE/命令注入：Langflow、pgAdmin、GitPython 存在代码/命令注入向量，需关注依赖链风险。
• 认证/授权绕过：Azure Cosmos DB、better-auth/scim、WooCommerce 均存在访问控制缺陷，可能导致越权或完全接管。
• 拒绝服务（DoS）：AIOHTTP 越界堆读取、Socket.IO 内存耗尽、cryptography 重复自签名证书导致指数级计算，均可被远程利用。
• 信息泄露/主机校验绕过：cryptography PKCS#7 侧信道、Guzzle 非规范主机绕过、fast-uri 反斜杠解析混淆，威胁敏感信息与访问控制。
• SQL注入：Sequelize（Oracle方言）与PyAthena均存在SQL注入，可导致数据泄露或破坏。

🛡️ 缓解建议

• 立即升级存在公开PoC的组件：PyAthena ≥3.5.4、fast-uri ≥2.4.4/3.1.5/4.1.2、Wings ≥1.12.3，并更新受影响容器镜像。
• 对Sequelize、Guzzle、cryptography、aiohttp、Socket.IO、GitPython等依赖，参照官方公告升级至修复版本并及时评估影响。
• 针对Azure Cosmos DB与DMS+，联系厂商获取补丁或缓解方案，同时审查访问策略，轮换硬编码凭据并启用多因素认证。
• 加强Web应用防护：为pgAdmin启用最小权限账户，限制psql命令参数；为WooCommerce Social Login配置签名验证并更新至最新版；部署WAF拦截SQL注入尝试。

🚨 CISA-KEV（1 条）

Unknown (1 条)

• CVE-2026-18577 - N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-18577
  CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability 产品: N-able N-central 描述: N-able N-central contains an…

🐙 GitHub-Advisory（29 条）

Critical (1 条)

• CVE-2026-69240 - Sequelize: SQL Injection (Oracle DB) CVE-2026-69240Critical
  Summary SQL Injection is possible with strings only **if dialect is set to `oracle`**. The vulnerability was confirmed on Sequelize v6.37.3. Details The…

High (13 条)

• CVE-2026-69246 - Guzzle: Noncanonical host can bypass host-based checks CVE-2026-69246High
  Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separately. The cURL handlers set `CURLOPT_URL` to…
• CVE-2026-69247 - cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th CVE-2026-69247High
  Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `RecipientInfo`'s `encryptedKey` in several…
  +OSV
• CVE-2026-69249 - python-cryptography: Duplicate self-signed intermediates can cause exponential p CVE-2026-69249High
  Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same…
  +OSV
• GHSA-3f7w-8rr8-f37f - GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagRefere High
  **Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1` **Reported instances:** 2…
• CVE-2026-69244 - AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed CVE-2026-69244High
  Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled…
• CVE-2026-69185 - Socket.IO: Zero-attachment Memory Exhaustion CVE-2026-69185High
  Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make…
• CVE-2026-18446 - fast-uri vulnerable to host confusion via backslash authority introducer CVE-2026-18446High
  Impact `fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses `\\`, `/\`, or `\/` as the authority…
  +NVD-Latest
• CVE-2026-13697 - undici vulnerable to cross-user information disclosure and parse-time crash via CVE-2026-13697High
  Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared-cache disclosure:** Responses with malformed…
  +NVD-Latest
• CVE-2026-69192 - ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco CVE-2026-69192High
  Summary `Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, `inet_aton`, and `getaddrinfo` all…
• CVE-2026-69149 - Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross CVE-2026-69149High
  A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of fallback…
• CVE-2026-69151 - Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes CVE-2026-69151High
  A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows…
• CVE-2026-69152 - brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1 CVE-2026-69152High
  Summary The `maxLength` mitigation added in `5.0.8` for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are…
• CVE-2026-68945 - Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Respo CVE-2026-68945High
  Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. During SSR,…

Medium (15 条)

• CVE-2026-69248 - python-cryptography verifier accepts wildcard DNS names allowing escape from per CVE-2026-69248Medium
  Summary If an intermediate constrained CA permits the DNS name `foo.example.com`, and the leaf certificate has a wildcard in its DNS SAN of `*.example.com`,…
• GHSA-539m-9xh6-q6rr - GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --a Medium
  **Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1` ## Summary `Repo.archive()`…
• GHSA-p538-c434-8v24 - GitPython: Arbitrary file truncation via git rev-list --output argument injectio Medium
  ## Summary `Commit.count()` forwards `**kwargs` into `rev_list` with **no** `check_unsafe_options` guard (the guard exists only in the sibling `iter_items`,…
• CVE-2026-69207 - Hono: ReDoS in CORS middleware via Access-Control-Request-Headers CVE-2026-69207Medium
  Summary The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers` request header during a preflight…
• CVE-2026-59881 - AIOHTTP: WebSocket client accepts compressed frames without negotiated permessag CVE-2026-59881Medium
  Summary The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extension was not negotiated. Impact A client may…
• CVE-2026-69243 - AIOHTTP: HTTP request smuggling via WebSocket upgrade CVE-2026-69243Medium
  Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. Impact If using the server-side component, it may be…
• CVE-2026-69245 - Guzzle: Noncanonical cookie domain keeps subdomain scope CVE-2026-69245Medium
  Impact `SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the `Domain` as an IP literal or a numeric…
• CVE-2026-16728 - undici vulnerable to downstream response desynchronization via retry interceptor CVE-2026-16728Medium
  Impact Undici's `interceptors.retry()` can deliver a response whose body length does not match the `Content-Length` header exposed to the application after a…

…另有 7 条 Medium 级漏洞（已省略）

🛡️ NVD-Latest（170 条）

Critical (49 条)

• CVE-2026-18452 DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials v CVE-2026-18452Critical 10.0
  CVE-2026-18452 CVSS:10.0 DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can…
• CVE-2026-66803 Improper access control in Azure Cosmos DB allows an unauthorized attacker to ex CVE-2026-66803Critical 10.0
  CVE-2026-66803 CVSS:10.0 Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. 产品:
• CVE-2026-67330 @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1. CVE-2026-67330Critical 9.9
  CVE-2026-67330 CVSS:9.9 @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9…
• CVE-2026-52855 Wings is the server control plane for Pterodactyl, a free, open-source game serv CVE-2026-52855Critical 9.9
  CVE-2026-52855 CVSS:9.9 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}}…
  +GitHub-Advis
• CVE-2026-17566 pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by in CVE-2026-17566Critical 9.9
  CVE-2026-17566 CVSS:9.9 pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja…
• CVE-2026-12946 IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject ar CVE-2026-12946Critical 9.9
  CVE-2026-12946 CVSS:9.9 IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control…
• CVE-2026-65321 PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unau CVE-2026-65321Critical 9.8
  CVE-2026-65321 CVSS:9.8 PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by…
  +PoC-in-GitHu
• CVE-2026-8457 The WooCommerce - Social Login plugin for WordPress is vulnerable to Authenticat CVE-2026-8457Critical 9.8
  CVE-2026-8457 CVSS:9.8 The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7.…
• CVE-2026-67342 ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in CVE-2026-67342Critical 9.8
  CVE-2026-67342 CVSS:9.8 ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and…
• CVE-2026-67341 ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks o CVE-2026-67341Critical 9.8
  CVE-2026-67341 CVSS:9.8 ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js.…
• CVE-2026-67340 ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host CVE-2026-67340Critical 9.8
  CVE-2026-67340 CVSS:9.8 ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because…
• CVE-2026-67324 GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> CVE-2026-67324Critical 9.8
  CVE-2026-67324 CVSS:9.8 GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when…
• CVE-2026-67289 FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and c CVE-2026-67289Critical 9.8
  CVE-2026-67289 CVSS:9.8 FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP…
• CVE-2026-66402 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certif CVE-2026-66402Critical 9.8
  CVE-2026-66402 CVSS:9.8 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in…
• CVE-2026-15964 The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication CVE-2026-15964Critical 9.8
  CVE-2026-15964 CVSS:9.8 The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all…
  +PoC-in-GitHu
• CVE-2026-68771 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrai CVE-2026-68771Critical 9.8
  CVE-2026-68771 CVSS:9.8 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote…
  +PoC-in-GitHu
• CVE-2026-68770 sentence-transformers contains a security control bypass vulnerability that allo CVE-2026-68770Critical 9.8
  CVE-2026-68770 CVSS:9.8 sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by…
• CVE-2026-67822 Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in CVE-2026-67822Critical 9.8
  CVE-2026-67822 CVSS:9.8 Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function…
• CVE-2026-17561 Improper Control of Generation of Code ('Code Injection') vulnerability in Innot CVE-2026-17561Critical 9.8
  CVE-2026-17561 CVSS:9.8 Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade…
• CVE-2026-14919 The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its CVE-2026-14919Critical 9.8
  CVE-2026-14919 CVSS:9.8 The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a…
• CVE-2026-14483 The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulner CVE-2026-14483Critical 9.8
  CVE-2026-14483 CVSS:9.8 The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to,…
  +PoC-in-GitHu
• CVE-2026-63223 CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and CVE-2026-63223Critical 9.8
  CVE-2026-63223 CVSS:9.8 CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently…
  +PoC-in-GitHu
• CVE-2026-43830 Full details and mitigation steps are currently restricted and will be published CVE-2026-43830Critical 9.8
  CVE-2026-43830 CVSS:9.8 Full details and mitigation steps are currently restricted and will be published at a later date. 产品:
• CVE-2026-38709 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W CVE-2026-38709Critical 9.8
  CVE-2026-38709 CVSS:9.8 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and…
• CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framew CVE-2026-68503Critical 9.8
  CVE-2026-68503 CVSS:9.8 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2…
• CVE-2026-68502 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framew CVE-2026-68502Critical 9.8
  CVE-2026-68502 CVSS:9.8 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an…
• CVE-2026-35847 An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrar CVE-2026-35847Critical 9.8
  CVE-2026-35847 CVSS:9.8 An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file…
• CVE-2025-69947 SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in cu CVE-2025-69947Critical 9.8
  CVE-2025-69947 CVSS:9.8 SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. 产品:
• CVE-2025-69941 SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in ad CVE-2025-69941Critical 9.8
  CVE-2025-69941 CVSS:9.8 SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. 产品:
• CVE-2025-69938 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in ren CVE-2025-69938Critical 9.8
  CVE-2025-69938 CVSS:9.8 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. 产品:
• CVE-2025-69937 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the CVE-2025-69937Critical 9.8
  CVE-2025-69937 CVSS:9.8 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. 产品:
• CVE-2025-69936 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /ed CVE-2025-69936Critical 9.8
  CVE-2025-69936 CVSS:9.8 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. 产品:
• CVE-2025-69935 CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the CVE-2025-69935Critical 9.8
  CVE-2025-69935 CVSS:9.8 CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate…
• CVE-2025-69934 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /de CVE-2025-69934Critical 9.8
  CVE-2025-69934 CVSS:9.8 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. 产品:
• CVE-2025-69933 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /me CVE-2025-69933Critical 9.8
  CVE-2025-69933 CVSS:9.8 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. 产品:
• CVE-2025-69930 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /pr CVE-2025-69930Critical 9.8
  CVE-2025-69930 CVSS:9.8 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1. 产品:
• CVE-2025-65336 Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Inje CVE-2025-65336Critical 9.8
  CVE-2025-65336 CVSS:9.8 Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. 产品:
• CVE-2026-67594 Spikster through commit e1cdf8c contains a missing authentication vulnerability CVE-2026-67594Critical 9.8
  CVE-2026-67594 CVSS:9.8 Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access…
• CVE-2026-67208 Juggle through 1.6.0 contains a remote code execution vulnerability that allows CVE-2026-67208Critical 9.8
  CVE-2026-67208 CVSS:9.8 Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary…
• CVE-2026-68579 FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the W CVE-2026-68579Critical 9.6
  CVE-2026-68579 CVSS:9.6 FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function…
• CVE-2026-54725 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret CVE-2026-54725Critical 9.6
  CVE-2026-54725 CVSS:9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1,…
  +GitHub-Advis
• CVE-2026-17349 /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced CVE-2026-17349Critical 9.6
  CVE-2026-17349 CVSS:9.6 /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing…
• CVE-2026-63221 CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query B CVE-2026-63221Critical 9.4
  CVE-2026-63221 CVSS:9.4 CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from…
• CVE-2026-66421 OpenClaw Dashboard contains a stored cross-site scripting vulnerability that all CVE-2026-66421Critical 9.3
  CVE-2026-66421 CVSS:9.3 OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute…
  +PoC-in-GitHu
• CVE-2026-66418 OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability t CVE-2026-66418Critical 9.3
  CVE-2026-66418 CVSS:9.3 OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject…
  +PoC-in-GitHu
• CVE-2026-3141 The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file d CVE-2026-3141Critical 9.1
  CVE-2026-3141 CVSS:9.1 The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the…
• CVE-2026-52539 Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOK CVE-2026-52539Critical 9.1
  CVE-2026-52539 CVSS:9.1 Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the…
• CVE-2026-17351 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query pas CVE-2026-17351Critical 9.0
  CVE-2026-17351 CVSS:9.0 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to…
  +PoC-in-GitHu
• CVE-2026-18245 Improper control of code generation in Amazon @aws-amplify/codegen-ui-react befo CVE-2026-18245Critical 9.0
  CVE-2026-18245 CVSS:9.0 Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to…

High (121 条)

• CVE-2026-67356 ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigg CVE-2026-67356High 8.8
  CVE-2026-67356 CVSS:8.8 ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins…
• CVE-2026-67343 ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the CVE-2026-67343High 8.8
  CVE-2026-67343 CVSS:8.8 ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated…
• CVE-2026-67325 GitPython before 3.1.51 contains an incomplete command injection blocklist that CVE-2026-67325High 8.8
  CVE-2026-67325 CVSS:8.8 GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix…
• CVE-2026-16635 The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in a CVE-2026-16635High 8.8
  CVE-2026-16635 CVSS:8.8 The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to…
• CVE-2026-15988 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre CVE-2026-15988High 8.8
  CVE-2026-15988 CVSS:8.8 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…
• CVE-2026-15414 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privileg CVE-2026-15414High 8.8
  CVE-2026-15414 CVSS:8.8 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0.…
• CVE-2026-17346 The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched six CVE-2026-17346High 8.8
  CVE-2026-17346 CVSS:8.8 The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates…
• CVE-2026-16236 The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Up CVE-2026-16236High 8.8
  CVE-2026-16236 CVSS:8.8 The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is…
• CVE-2026-13609 The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML ent CVE-2026-13609High 8.8
  CVE-2026-13609 CVSS:8.8 The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing…
• CVE-2026-66420 MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass v CVE-2026-66420High 8.8
  CVE-2026-66420 CVSS:8.8 MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote…
• CVE-2026-65423 An integer overflow in the UA_Variant arrayDimensions product computation in op CVE-2026-65423High 8.8
  CVE-2026-65423 CVSS:8.8 An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an…
• CVE-2026-12562 The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that CVE-2026-12562High 8.8
  CVE-2026-12562 CVSS:8.8 The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level…
• CVE-2026-67207 Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in Backu CVE-2026-67207High 8.8
  CVE-2026-67207 CVSS:8.8 Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated…
• CVE-2026-67206 Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileM CVE-2026-67206High 8.8
  CVE-2026-67206 CVSS:8.8 Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to…
  +PoC-in-GitHu
• CVE-2026-66416 Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows u CVE-2026-66416High 8.8
  CVE-2026-66416 CVSS:8.8 Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing…
• CVE-2026-67336 better-auth versions before 1.6.11 contain insecure cryptographic defaults in th CVE-2026-67336High 8.7
  CVE-2026-67336 CVSS:8.7 better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none…
• CVE-2025-71399 Better Auth relies on better-call, which uses the rou3 router library. In affect CVE-2025-71399High 8.6
  CVE-2025-71399 CVSS:8.6 Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing…
• CVE-2026-12721 The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape CVE-2026-12721High 8.6
  CVE-2026-12721 CVSS:8.6 The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL…
• CVE-2026-10079 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Wh CVE-2026-10079High 8.5
  CVE-2026-10079 CVSS:8.5 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces…
• CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, CVE-2026-62246High 8.5
  CVE-2026-62246 CVSS:8.5 Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema,…
• CVE-2026-11536 IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execu CVE-2026-11536High 8.5
  CVE-2026-11536 CVSS:8.5 IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. 产品:
• CVE-2026-66415 Leantime 3.6.2 contains a server-side request forgery and local file inclusion v CVE-2026-66415High 8.5
  CVE-2026-66415 CVSS:8.5 Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to…
• CVE-2026-67323 GitPython before 3.1.51 fails to guard against dangerous Git options passed as k CVE-2026-67323High 8.4
  CVE-2026-67323 CVSS:8.4 GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(),…
• CVE-2026-67331 better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organi CVE-2026-67331High 8.3
  CVE-2026-67331 CVSS:8.3 better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default,…
• CVE-2026-67327 better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-be CVE-2026-67327High 8.3
  CVE-2026-67327 CVSS:8.3 better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account…
• CVE-2026-53501 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, CVE-2026-53501High 8.2
  CVE-2026-53501 CVSS:8.2 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the…
  +GitHub-Advis
• CVE-2026-53500 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, CVE-2026-53500High 8.2
  CVE-2026-53500 CVSS:8.2 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings…
  +GitHub-Advis
• CVE-2026-18141 A flaw was found in aap-gateway, a component of Ansible Automation Platform's Ev CVE-2026-18141High 8.2
  CVE-2026-18141 CVSS:8.2 A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote…
• CVE-2026-56672 ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, CVE-2026-56672High 8.2
  CVE-2026-56672 CVSS:8.2 ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and…
• CVE-2026-56670 ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int CVE-2026-56670High 8.2
  CVE-2026-56670 CVSS:8.2 ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served…
• CVE-2026-20465 In wlan AP driver, there is a possible out of bounds write due to a missing boun CVE-2026-20465High 8.1
  CVE-2026-20465 CVSS:8.1 In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent)…
• CVE-2026-68581 Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API CVE-2026-68581High 8.1
  CVE-2026-68581 CVSS:8.1 Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs…
• CVE-2026-67328 @better-auth/sso versions before 1.6.21 contain multiple authentication bypass v CVE-2026-67328High 8.1
  CVE-2026-67328 CVSS:8.1 @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow…
• CVE-2026-16144 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vu CVE-2026-16144High 8.1
  CVE-2026-16144 CVSS:8.1 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up…
• CVE-2026-15450 The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable CVE-2026-15450High 8.1
  CVE-2026-15450 CVSS:8.1 The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in…
• CVE-2026-53510 Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operatio CVE-2026-53510High 8.1
  CVE-2026-53510 CVSS:8.1 Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation…
  +GitHub-Advis
• CVE-2026-62391 The security fix for CVE-2025-66518 is incomplete. Any client who can access to CVE-2026-62391High 8.1
  CVE-2026-62391 CVSS:8.1 The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can…
• CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engin CVE-2026-65313High 8.1
  CVE-2026-65313 CVSS:8.1 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc…
• CVE-2026-15258 The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not CVE-2026-15258High 8.1
  CVE-2026-15258 CVSS:8.1 The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom…
• CVE-2026-12695 The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitte CVE-2026-12695High 8.1
  CVE-2026-12695 CVSS:8.1 The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored…
• CVE-2026-12251 The Ultimate Member WordPress plugin before 2.12.1 does not filter administrato CVE-2026-12251High 8.1
  CVE-2026-12251 CVSS:8.1 The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable…
• CVE-2026-63035 A heap use-after-free vulnerability in the TransferSubscriptions service in ope CVE-2026-63035High 8.1
  CVE-2026-63035 CVSS:8.1 A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a…
• CVE-2026-34641 Premiere Pro is affected by an out-of-bounds write vulnerability that could resu CVE-2026-34641High 7.8
  CVE-2026-34641 CVSS:7.8 Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the…
• CVE-2026-18157 A flaw was found in yggdrasil-worker-package-manager. A local attacker with exis CVE-2026-18157High 7.8
  CVE-2026-18157 CVSS:7.8 A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument…
• CVE-2026-20483 In Telephony, there is a possible escalation of privilege due to a missing permi CVE-2026-20483High 7.7
  CVE-2026-20483 CVSS:7.7 In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of…
• CVE-2026-67352 luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in CVE-2026-67352High 7.6
  CVE-2026-67352 CVSS:7.6 luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated…
• CVE-2026-10685 The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() CVE-2026-10685High 7.6
  CVE-2026-10685 CVSS:7.6 The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the…
• CVE-2026-67527 OpenProject is open-source, web-based project management software. Prior to 17.6 CVE-2026-67527High 7.6
  CVE-2026-67527 CVSS:7.6 OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted…
• CVE-2026-20479 In Modem, there is a possible out of bounds read due to a missing bounds check. CVE-2026-20479High 7.5
  CVE-2026-20479 CVSS:7.5 In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE…
• CVE-2026-16540 The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not corre CVE-2026-16540High 7.5
  CVE-2026-16540 CVSS:7.5 The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the…
  +PoC-in-GitHu
• CVE-2026-16285 The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not pe CVE-2026-16285High 7.5
  CVE-2026-16285 CVSS:7.5 The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media…
• CVE-2026-16261 The login-social WordPress plugin through 1.0.4 does not validate password-reset CVE-2026-16261High 7.5
  CVE-2026-16261 CVSS:7.5 The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's…
• CVE-2026-15241 The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform a CVE-2026-15241High 7.5
  CVE-2026-15241 CVSS:7.5 The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX…
• CVE-2026-15236 The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly r CVE-2026-15236High 7.5
  CVE-2026-15236 CVSS:7.5 The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth…
• CVE-2026-15206 The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" CVE-2026-15206High 7.5
  CVE-2026-15206 CVSS:7.5 The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually…
• CVE-2026-15151 The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not p CVE-2026-15151High 7.5
  CVE-2026-15151 CVSS:7.5 The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions,…
• CVE-2026-3245 A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that CVE-2026-3245High 7.5
  CVE-2026-3245 CVSS:7.5 A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. 产品:
• CVE-2026-68580 FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio inp CVE-2026-68580High 7.5
  CVE-2026-68580 CVSS:7.5 FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio,…
• CVE-2026-68578 ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the CVE-2026-68578High 7.5
  CVE-2026-68578 CVSS:7.5 ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission…
• CVE-2026-67357 ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability CVE-2026-67357High 7.5
  CVE-2026-67357 CVSS:7.5 ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the…
• CVE-2026-18352 The User Access Manager plugin for WordPress is vulnerable to Directory Traversa CVE-2026-18352High 7.5
  CVE-2026-18352 CVSS:7.5 The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the…
• CVE-2026-13339 The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal i CVE-2026-13339High 7.5
  CVE-2026-13339 CVSS:7.5 The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the…
• CVE-2026-67322 GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Re CVE-2026-67322High 7.5
  CVE-2026-67322 CVSS:7.5 GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is…
• CVE-2026-67304 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smart CVE-2026-67304High 7.5
  CVE-2026-67304 CVSS:7.5 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state…
• CVE-2026-67301 FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async u CVE-2026-67301High 7.5
  CVE-2026-67301 CVSS:7.5 FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB…
• CVE-2026-67300 FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities i CVE-2026-67300High 7.5
  CVE-2026-67300 CVSS:7.5 FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL…
• CVE-2026-67299 FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async up CVE-2026-67299High 7.5
  CVE-2026-67299 CVSS:7.5 FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when…
• CVE-2026-67298 FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server CVE-2026-67298High 7.5
  CVE-2026-67298 CVSS:7.5 FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler…
• CVE-2026-67297 FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing T CVE-2026-67297High 7.5
  CVE-2026-67297 CVSS:7.5 FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in…
• CVE-2026-67296 FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI se CVE-2026-67296High 7.5
  CVE-2026-67296 CVSS:7.5 FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU…
• CVE-2026-67291 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bound CVE-2026-67291High 7.5
  CVE-2026-67291 CVSS:7.5 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in…
• CVE-2026-67290 FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TS CVE-2026-67290High 7.5
  CVE-2026-67290 CVSS:7.5 FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO…
• CVE-2026-67288 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smart CVE-2026-67288High 7.5
  CVE-2026-67288 CVSS:7.5 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR…
• CVE-2026-15006 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email CVE-2026-15006High 7.5
  CVE-2026-15006 CVSS:7.5 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to…
• CVE-2026-62999 Copier is a library and CLI app for rendering project templates. From 9.5.0 thro CVE-2026-62999High 7.5
  CVE-2026-62999 CVSS:7.5 Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments…
• CVE-2026-53599 REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_m CVE-2026-53599High 7.5
  CVE-2026-53599 CVSS:7.5 REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in…
  +GitHub-Advis
• CVE-2026-53505 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, CVE-2026-53505High 7.5
  CVE-2026-53505 CVSS:7.5 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not…
  +GitHub-Advis
• CVE-2026-53504 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, CVE-2026-53504High 7.5
  CVE-2026-53504 CVSS:7.5 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs…
  +GitHub-Advis
• CVE-2026-53503 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, CVE-2026-53503High 7.5
  CVE-2026-53503 CVSS:7.5 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>,…
  +GitHub-Advis
• CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game serv CVE-2026-52856High 7.5
  CVE-2026-52856 CVSS:7.5 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed…
  +GitHub-Advis
• CVE-2026-17347 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administr CVE-2026-17347High 7.5
  CVE-2026-17347 CVSS:7.5 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a…
• CVE-2026-18446 fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash CVE-2026-18446High 7.5
  CVE-2026-18446 CVSS:7.5 fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses…
  +GitHub-Advis
• CVE-2026-18358 A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. CVE-2026-18358High 7.5
  CVE-2026-18358 CVSS:7.5 A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP…
• CVE-2026-15722 A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). Th CVE-2026-15722High 7.5
  CVE-2026-15722 CVSS:7.5 A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c…
• CVE-2026-11770 A flaw was found in 389 Directory Server. An unauthenticated remote attacker can CVE-2026-11770High 7.5
  CVE-2026-11770 CVSS:7.5 A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV…
• CVE-2026-65310 ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affecte CVE-2026-65310High 7.5
  CVE-2026-65310 CVSS:7.5 ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint…
• CVE-2026-65309 ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmit CVE-2026-65309High 7.5
  CVE-2026-65309 CVSS:7.5 ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a…
• CVE-2026-15048 The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization c CVE-2026-15048High 7.5
  CVE-2026-15048 CVSS:7.5 The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing…
• CVE-2026-14930 The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorizati CVE-2026-14930High 7.5
  CVE-2026-14930 CVSS:7.5 The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request…
• CVE-2026-14830 The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment proces CVE-2026-14830High 7.5
  CVE-2026-14830 CVSS:7.5 The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before…
• CVE-2026-14333 The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in CVE-2026-14333High 7.5
  CVE-2026-14333 CVSS:7.5 The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable…
• CVE-2026-14319 The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to CVE-2026-14319High 7.5
  CVE-2026-14319 CVSS:7.5 The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation…
• CVE-2026-12720 The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be CVE-2026-12720High 7.5
  CVE-2026-12720 CVSS:7.5 The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that…
• CVE-2026-63222 CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedF CVE-2026-63222High 7.5
  CVE-2026-63222 CVSS:7.5 CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the…
• CVE-2026-56673 ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node CVE-2026-56673High 7.5
  CVE-2026-56673 CVSS:7.5 ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0,…
• CVE-2026-56671 ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int CVE-2026-56671High 7.5
  CVE-2026-56671 CVSS:7.5 ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in…
• CVE-2026-43832 Full details and mitigation steps are currently restricted and will be published CVE-2026-43832High 7.5
  CVE-2026-43832 CVSS:7.5 Full details and mitigation steps are currently restricted and will be published at a later date. 产品:
• CVE-2026-43831 Full details and mitigation steps are currently restricted and will be published CVE-2026-43831High 7.5
  CVE-2026-43831 CVSS:7.5 Full details and mitigation steps are currently restricted and will be published at a later date. 产品:
• CVE-2026-43829 Full details and mitigation steps are currently restricted and will be published CVE-2026-43829High 7.5
  CVE-2026-43829 CVSS:7.5 Full details and mitigation steps are currently restricted and will be published at a later date. 产品:
• CVE-2026-66360 The ISO Presentation layer contains a flaw in the handling of specific paramete CVE-2026-66360High 7.5
  CVE-2026-66360 CVSS:7.5 The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length…
• CVE-2026-63559 An integer overflow in the UA_Variant arrayDimensions product computation in op CVE-2026-63559High 7.5
  CVE-2026-63559 CVSS:7.5 An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read…
• CVE-2026-18064 An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Healt CVE-2026-18064High 7.5
  CVE-2026-18064 CVSS:7.5 An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL…
• CVE-2026-68500 Sylius Mollie Plugin provides Mollie payment integration for Sylius applications CVE-2026-68500High 7.5
  CVE-2026-68500 CVSS:7.5 Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie…
  +GitHub-Advis
• CVE-2026-61536 Banks generates meaningful LLM prompts using a simple template language. In vers CVE-2026-61536High 7.5
  CVE-2026-61536 CVSS:7.5 Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects…
• CVE-2026-18140 Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runti CVE-2026-18140High 7.5
  CVE-2026-18140 CVSS:7.5 Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code…
• CVE-2026-18394 Incorrect authorization in the http_request tool in Strands Agents Tools before CVE-2026-18394High 7.4
  CVE-2026-18394 CVSS:7.4 Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain…
• CVE-2026-18481 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel be CVE-2026-18481High 7.3
  CVE-2026-18481 CVSS:7.3 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to…
• CVE-2026-54737 @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preserva CVE-2026-54737High 7.3
  CVE-2026-54737 CVSS:7.3 @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5,…
  +GitHub-Advis
• CVE-2026-67333 better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-bet CVE-2026-67333High 7.2
  CVE-2026-67333 CVSS:7.2 better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris…
• CVE-2026-15052 The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin CVE-2026-15052High 7.2
  CVE-2026-15052 CVSS:7.2 The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site…
• CVE-2026-16843 Some Hikvision Wireless Access Points are vulnerable to authenticated command ex CVE-2026-16843High 7.2
  CVE-2026-16843 CVSS:7.2 Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers…
• CVE-2026-13392 The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not preve CVE-2026-13392High 7.2
  CVE-2026-13392 CVSS:7.2 The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with…
• CVE-2026-65875 BaserCMS provided by baserCMS Users Community contains a CSV file injection vuln CVE-2026-65875High 7.1
  CVE-2026-65875 CVSS:7.1 BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file…
• CVE-2026-9856 A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an atta CVE-2026-9856High 7.1
  CVE-2026-9856 CVSS:7.1 A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path…
• CVE-2025-71400 better-auth passkey versions before 1.4.0 contain an insecure direct object refe CVE-2025-71400High 7.1
  CVE-2025-71400 CVSS:7.1 better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint…
• CVE-2026-67329 @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1 CVE-2026-67329High 7.1
  CVE-2026-67329 CVSS:7.1 @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in…
• CVE-2025-71403 better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrig CVE-2025-71403High 7.1
  CVE-2025-71403 CVSS:7.1 better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and…
• CVE-2026-65981 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4. CVE-2026-65981High 7.1
  CVE-2026-65981 CVSS:7.1 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed…
• CVE-2026-55502 Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, CVE-2026-55502High 7.1
  CVE-2026-55502 CVSS:7.1 Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only…
• CVE-2026-10848 The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in par CVE-2026-10848High 7.0
  CVE-2026-10848 CVSS:7.0 The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a…
• CVE-2026-67326 GitPython before 3.1.50 fails to validate newline characters in the section para CVE-2026-67326High 7.0
  CVE-2026-67326 CVSS:7.0 GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject…

🤖 漏洞情报自动汇总 · 2026-08-04 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV