📊 2026-08-05 漏洞情报日报 · 200 条 · 高危 154
每日漏洞情报汇总 · 2026-08-05
📊 2026-08-05 漏洞情报日报
📋 共 200 条
🔥 高危/严重 154 条
🚨 CISA-KEV 4 条
🐙 GitHub-Advisory 86 条 🔥44
🛡️ NVD-Latest 110 条 🔥110
🤖 今日安全态势分析
🎯 今日重点关注
- Flowise 多链 RCE 集群（CVE-2026-70477/70470/69264/69255/69253/69254 等）：影响 AI 工作流平台 Flowise。攻击者可通过 CSV Agent 提示注入、Pyodide Unicode 同形字绕过、NodeVM 沙箱逃逸及 TypeORM DataSource 等路径实现未授权或低权限远程代码执行，已有以 root 权限建立 Meterpreter 会话的实证。
- pgAdmin4 Import/Export 工具 RCE（CVE-2026-17566，CVSS 9.9）：psql 命令构造中存在反斜杠转义不一致，用户提交的 SQL 查询被拼入 Jijna 模板，导致任意命令注入；PoC 已公开，需紧急处置。
- Pterodactyl Wings 权限提升（CVE-2026-52855，CVSS 9.9）：游戏服务器控制平面 Wings 在 1.12.3 前，egg 配置文件模板中的 {{config.}} 占位符可被低权限用户读取敏感配置，进而提升权限。
- @better-auth/scim 授权绕过（CVE-2026-67330，CVSS 9.9）：SCIM 令牌发放未拒绝已使用的 provider ID，攻击者可绕过授权访问管理接口，影响 1.4.0-beta.27 至 1.6.21 及 1.7.0-beta.x 版本。
- WooCommerce Social Login 认证绕过（CVE-2026-8457，CVSS 9.8）：Apple 登录处理器未正确校验 id_token，未授权用户可登录任意账户，影响 <=2.8.7 版本，电商站点风险高。
📈 威胁趋势
- RCE/代码执行（占多数）：除 Flowise 多条链外，pgAdmin4、WordPress 的 “Insert or Embed Articulate Content” 及 “Personal QR Message” 插件均存在可致任意文件上传或命令执行的漏洞。
- 认证/授权绕过：@better-auth/scim、WooCommerce Social Login、ChamaWP 密码重置漏洞，均允许未授权访问或接管账户。
- 权限提升/信息泄露：Wings 低权限读配置；Flowise OAuth2 token 刷新端点（CVE-2026-70478）未授权返回访问令牌。
- 注入类：PyAthena 3.35.4 前存在 SQL 注入（CVE-2026-65321），可致任意 SQL 执行。
🛡️ 缓解建议
- 立即升级 Flowise 至官方最新修复版本；若无法升级，应禁止公网访问管理界面，并避免使用 CSVAgent、NodeVM 及 OAuth2 credential 相关高危组件。
- 升级 pgAdmin4 至修复版本，限制 Import/Export 功能仅对可信管理员开放；同时排查已有暴露面。
- 升级 Wings 至 1.12.3+，并同步更新 Pterodactyl 面板；对 @better-auth/scim 更新至不受影响的版本。
- 更新存在漏洞的 WordPress 插件（含 WooCommerce Social Login、Personal QR Message 等），移除不再使用的插件，并审计已有用户账户和上传文件。
🚨 CISA-KEV（4 条）
Unknown (4 条)
- CVE-2026-9198 - IBM Langflow Code Injection Vulnerability
CVE-2026-9198
CVE-2026-9198 IBM Langflow Code Injection Vulnerability 产品: IBM Langflow 描述: Langflow contains a code injection vulnerability that allows unauthenticated… - CVE-2026-34486 - Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
CVE-2026-34486
CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability 产品: Apache Tomcat 描述: Apache Tomcat contains a missing encryption of sensitive…
…另有 2 条 Unknown 级漏洞（已省略）
🐙 GitHub-Advisory（86 条）
Critical (11 条)
- CVE-2026-70477 - Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
CVE-2026-70477Critical
-- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: Flowise -… - CVE-2026-70478 - Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — e
CVE-2026-70478Critical
Summary The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is in `WHITELIST_URLS`, meaning it requires **no… - CVE-2026-70470 - Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
CVE-2026-70470Critical
Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers,… - CVE-2026-69264 - Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into P
CVE-2026-69264Critical
Summary Flowise's `CSVAgent` interpolates an attacker-controlled segment of the `csvFile` data URI directly into a Python source-code template that is then… - CVE-2026-69251 - Flowise RCE via TypeORM DataSource
CVE-2026-69251Critical
============================================================================= Security Advisory elttam Topic: Flowise RCE via TypeORM DataSource… - CVE-2026-69253 - Flowise Sandbox Escape to RCE
CVE-2026-69253Critical
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape… - CVE-2026-69254 - Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions
CVE-2026-69254Critical
Summary A sandbox escape vulnerability in `executeJavaScriptCode()` allows any authenticated user to execute arbitrary system commands as root on the Flowise… - CVE-2026-69255 - Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell
CVE-2026-69255Critical
## UPDATE 2026-05-20: Full RCE as root VERIFIED **This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise… - CVE-2026-69256 - Remote Code Execution Vulnerability in CSVAgent
CVE-2026-69256Critical
Summary The CSVAgent node was observed to allow users to write Python code which gets executed via `pyodide`. The original intent was to allow users to utilise… - CVE-2026-69259 - Flowise RCE via SQLite Record Manager Node
CVE-2026-69259Critical
============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager… - CVE-2026-69240 - Sequelize: SQL Injection (Oracle DB)
CVE-2026-69240Critical
Summary SQL Injection is possible with strings only **if dialect is set to `oracle`**. The vulnerability was confirmed on Sequelize v6.37.3. Details The…
High (33 条)
- CVE-2026-53950 - XSS in Ghost's ActivityPub client
CVE-2026-53950High
Impact The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. Vulnerable… - CVE-2026-70492 - Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered mes
CVE-2026-70492High
## Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens… - CVE-2026-70494 - Open WebUI: A folder write-collaborator can permanently delete the owner's chats
CVE-2026-70494High
## Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder… - CVE-2026-70475 - Flowise: Missing Authorization on Execution Update Endpoint
CVE-2026-70475High
# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: https://github.com/Dimpyj1604… - CVE-2026-70476 - Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Ten
CVE-2026-70476High
Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) without verifying that the identifier belongs to… - CVE-2026-70479 - Open WebUI: SSRF into internal services via unvalidated sub-resource requests in
CVE-2026-70479High
## Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing… - CVE-2026-70482 - Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to
CVE-2026-70482High
## Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo… - CVE-2026-70485 - Open WebUI: Any authenticated user can reach internal services and cloud metadat
CVE-2026-70485High
## Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion, URL-to-markdown conversion and web-search content retrieval, and decides… - CVE-2026-70486 - Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe
CVE-2026-70486High
## Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file… - CVE-2026-69263 - Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment var
CVE-2026-69263High
## Summary The mitigation shipped for CVE-2025-8943 blocks the `-y` and `--yes` flags on `npx` to stop auto-installation of arbitrary packages. That flag… - CVE-2026-70471 - Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
CVE-2026-70471High
## Finding — Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view) What’s wrong (code locations) - Variables for the active… - GHSA-88pr-878c-24wf - Flowise: Authenticated arbitrary file write in the `S3 Directory` document loade High
## Summary Flowise on current `main` allows an authenticated user with `documentStores:preview-process` permission to trigger the `S3 Directory` document… - CVE-2026-70472 - Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
CVE-2026-70472High
# Summary These endpoints accept a client-controlled `credential` parameter. The server loads credentials by `id` and uses them directly, without checking… - CVE-2026-70473 - Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire
CVE-2026-70473High
Summary The **GET `/api/v1/upsert-history`** endpoint returns the **entire server-wide upsert history** (response size **>100MB**) instead of being scoped to… - CVE-2026-70474 - Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
CVE-2026-70474High
## Summary Three OAuth2 credential endpoints look up credentials by `id` alone with no `workspaceId` filter. Two of these endpoints (`callback`, `refresh`) are… - CVE-2026-69262 - Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowin
CVE-2026-69262High
# summary: In Flowise, `DELETE /api/v1/chatflows/:id` authorizes requests with `checkAnyPermission('chatflows:delete,agentflows:delete')`. Possession of either… - CVE-2026-69250 - Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfilt
CVE-2026-69250High
Summary The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is unauthenticated by design (it is in the public whitelist)… - CVE-2026-69252 - Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys
CVE-2026-69252High
# summary: In Flowise, the `/api/v1/files` route is protected only by the `feat:files` feature gate and does not enforce `checkPermission(...)` on either `GET`… - CVE-2026-69257 - Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
CVE-2026-69257High
## Summary Flowise's HTTP security module (`httpSecurity.ts`) fails to normalize IPv4-mapped IPv6 addresses (e.g., `::ffff:127.0.0.1`,… - CVE-2026-69258 - Flowise: Unauthenticated Property Injection into Flow Execution Context via Unga
CVE-2026-69258High
#### Summary The `POST /api/v1/prediction/:id` endpoint — which is unauthenticated (whitelisted in `WHITELIST_URLS`) — accepts an `overrideConfig` object in… - CVE-2026-69246 - Guzzle: Noncanonical host can bypass host-based checks
CVE-2026-69246High
Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the `Host` header separately. The cURL handlers set `CURLOPT_URL` to… - CVE-2026-69247 - cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle th
CVE-2026-69247High
Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `RecipientInfo`'s `encryptedKey` in several…
+OSV - CVE-2026-69249 - python-cryptography: Duplicate self-signed intermediates can cause exponential p
CVE-2026-69249High
Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same…
+OSV - GHSA-3f7w-8rr8-f37f - GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagRefere High
**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1` **Reported instances:** 2… - CVE-2026-69244 - AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed
CVE-2026-69244High
Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. Impact An attacker controlled… - CVE-2026-69185 - Socket.IO: Zero-attachment Memory Exhaustion
CVE-2026-69185High
Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make… - CVE-2026-18446 - fast-uri vulnerable to host confusion via backslash authority introducer
CVE-2026-18446High
Impact `fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses `\\`, `/\`, or `\/` as the authority…
+NVD-Latest - CVE-2026-13697 - undici vulnerable to cross-user information disclosure and parse-time crash via
CVE-2026-13697High
Summary Two issues in undici's cache interceptor, both fixed by the same patch on `lib/util/cache.js`: 1. **Shared-cache disclosure:** Responses with malformed…
+NVD-Latest - CVE-2026-69192 - ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco
CVE-2026-69192High
Summary `Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, `inet_aton`, and `getaddrinfo` all… - CVE-2026-69149 - Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross
CVE-2026-69149High
A Cross-Site Scripting (XSS) vulnerability exists in `@angular/platform-server`'s DOM emulation dependency (`domino`) when serializing the content of fallback… - CVE-2026-69151 - Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
CVE-2026-69151High
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular compiler's internationalization (i18n) pipeline. Although Angular disallows… - CVE-2026-69152 - brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1
CVE-2026-69152High
Summary The `maxLength` mitigation added in `5.0.8` for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are… - CVE-2026-68945 - Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Respo
CVE-2026-68945High
Angular's `HttpTransferCache` caches HTTP requests made during Server-Side Rendering (SSR) so that they can be reused during client-side hydration. During SSR,…
Medium (41 条)
- CVE-2026-70589 - Ghost: Archived Offers can be Redeemed
CVE-2026-70589Medium
Impact A missing validation check allowed users to redeem subscription offers that were no longer active. Vulnerable versions This vulnerability is present in… - CVE-2026-53944 - Ghost: Private IP filtering bypass to make server-side requests to internal serv
CVE-2026-53944Medium
Impact When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6… - CVE-2026-53945 - Ghost: Server-side request forgery via DNS rebinding in external request handlin
CVE-2026-53945Medium
Impact Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching… - CVE-2026-53946 - Ghost: Mobiledoc image-size fetch SSRF
CVE-2026-53946Medium
Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without… - CVE-2026-70590 - Ghost: Blind Password Hash Disclosure in Ghost Admin API
CVE-2026-70590Medium
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to… - CVE-2026-70591 - Ghost: Server-Side Request Forgery in Image Fetching
CVE-2026-70591Medium
Impact A Server-Side Request Forgery (SSRF) in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output… - CVE-2026-70592 - Ghost: Database Backup Path Traversal
CVE-2026-70592Medium
Impact An Administrator-level user could remotely overwrite certain files on the filesystem leading to integrity and availability issues. Vulnerable versions… - CVE-2026-70593 - Ghost: Theme Upload Path Traversal
CVE-2026-70593Medium
Impact A vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to alter the behavior of the…
…另有 33 条 Medium 级漏洞（已省略）
Low (1 条)
- CVE-2026-70483 - Open WebUI: Any authenticated user can cancel another user's chat generation via
CVE-2026-70483Low
## Summary `DELETE /api/v1/chats/{id}` cancelled a chat's in-flight tasks before it checked whether the caller was allowed to delete that chat. Any…
🛡️ NVD-Latest（110 条）
Critical (29 条)
- CVE-2026-67330 @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.
CVE-2026-67330Critical 9.9
CVE-2026-67330 CVSS:9.9 @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9… - CVE-2026-52855 Wings is the server control plane for Pterodactyl, a free, open-source game serv
CVE-2026-52855Critical 9.9
CVE-2026-52855 CVSS:9.9 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}}…
+GitHub-Advis - CVE-2026-17566 pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by in
CVE-2026-17566Critical 9.9
CVE-2026-17566 CVSS:9.9 pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja…
+PoC-in-GitHu - CVE-2026-16060 The Insert or Embed Articulate Content into WordPress plugin through 4.300000002
CVE-2026-16060Critical 9.8
CVE-2026-16060 CVSS:9.8 The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an… - CVE-2026-16250 The Personal QR Message WordPress plugin through 1.0 does not restrict the file
CVE-2026-16250Critical 9.8
CVE-2026-16250 CVSS:9.8 The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated… - CVE-2026-16300 The ChamaWP WordPress plugin before 1.0.13 does not properly validate a passwor
CVE-2026-16300Critical 9.8
CVE-2026-16300 CVSS:9.8 The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to… - CVE-2026-65321 PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unau
CVE-2026-65321Critical 9.8
CVE-2026-65321 CVSS:9.8 PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by…
+PoC-in-GitHu - CVE-2026-8457 The WooCommerce - Social Login plugin for WordPress is vulnerable to Authenticat
CVE-2026-8457Critical 9.8
CVE-2026-8457 CVSS:9.8 The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7.… - CVE-2026-67342 ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in
CVE-2026-67342Critical 9.8
CVE-2026-67342 CVSS:9.8 ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and… - CVE-2026-67341 ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks o
CVE-2026-67341Critical 9.8
CVE-2026-67341 CVSS:9.8 ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js.… - CVE-2026-67340 ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host
CVE-2026-67340Critical 9.8
CVE-2026-67340 CVSS:9.8 ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because…
+PoC-in-GitHu - CVE-2026-67324 GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value>
CVE-2026-67324Critical 9.8
CVE-2026-67324 CVSS:9.8 GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when… - CVE-2026-67289 FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and c
CVE-2026-67289Critical 9.8
CVE-2026-67289 CVSS:9.8 FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP… - CVE-2026-66402 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certif
CVE-2026-66402Critical 9.8
CVE-2026-66402 CVSS:9.8 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in… - CVE-2026-15964 The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication
CVE-2026-15964Critical 9.8
CVE-2026-15964 CVSS:9.8 The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all…
+PoC-in-GitHu - CVE-2026-68771 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrai
CVE-2026-68771Critical 9.8
CVE-2026-68771 CVSS:9.8 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote…
+PoC-in-GitHu - CVE-2026-68770 sentence-transformers contains a security control bypass vulnerability that allo
CVE-2026-68770Critical 9.8
CVE-2026-68770 CVSS:9.8 sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by… - CVE-2026-67822 Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in
CVE-2026-67822Critical 9.8
CVE-2026-67822 CVSS:9.8 Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function… - CVE-2026-17561 Improper Control of Generation of Code ('Code Injection') vulnerability in Innot
CVE-2026-17561Critical 9.8
CVE-2026-17561 CVSS:9.8 Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade… - CVE-2026-68579 FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the W
CVE-2026-68579Critical 9.6
CVE-2026-68579 CVSS:9.6 FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function… - CVE-2026-54725 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret
CVE-2026-54725Critical 9.6
CVE-2026-54725 CVSS:9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1,…
+GitHub-Advis - CVE-2026-17349 /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced
CVE-2026-17349Critical 9.6
CVE-2026-17349 CVSS:9.6 /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing… - CVE-2026-15930 The Simple Membership WordPress plugin before 4.7.8 does not verify whether user
CVE-2026-15930Critical 9.4
CVE-2026-15930 CVSS:9.4 The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the… - CVE-2026-14557 The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not pro
CVE-2026-14557Critical 9.1
CVE-2026-14557 CVSS:9.1 The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of… - CVE-2026-16534 The Import and export users and customers WordPress plugin before 2.4.2 does not
CVE-2026-16534Critical 9.1
CVE-2026-16534 CVSS:9.1 The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit… - CVE-2026-16532 The Link Library WordPress plugin before 7.9.3 does not properly sanitise and es
CVE-2026-16532Critical 9.1
CVE-2026-16532 CVSS:9.1 The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL… - CVE-2026-12965 The Super Store Finder WordPress plugin through 7.8 does not sanitize a paramete
CVE-2026-12965Critical 9.1
CVE-2026-12965 CVSS:9.1 The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in… - CVE-2026-3141 The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file d
CVE-2026-3141Critical 9.1
CVE-2026-3141 CVSS:9.1 The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the… - CVE-2026-17351 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query pas
CVE-2026-17351Critical 9.0
CVE-2026-17351 CVSS:9.0 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to…
+PoC-in-GitHu
High (81 条)
- CVE-2026-67356 ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigg
CVE-2026-67356High 8.8
CVE-2026-67356 CVSS:8.8 ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins… - CVE-2026-67343 ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the
CVE-2026-67343High 8.8
CVE-2026-67343 CVSS:8.8 ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated… - CVE-2026-67325 GitPython before 3.1.51 contains an incomplete command injection blocklist that
CVE-2026-67325High 8.8
CVE-2026-67325 CVSS:8.8 GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix… - CVE-2026-16635 The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in a
CVE-2026-16635High 8.8
CVE-2026-16635 CVSS:8.8 The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to… - CVE-2026-15988 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPre
CVE-2026-15988High 8.8
CVE-2026-15988 CVSS:8.8 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… - CVE-2026-15414 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privileg
CVE-2026-15414High 8.8
CVE-2026-15414 CVSS:8.8 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0.… - CVE-2026-17346 The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched six
CVE-2026-17346High 8.8
CVE-2026-17346 CVSS:8.8 The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates… - CVE-2026-67336 better-auth versions before 1.6.11 contain insecure cryptographic defaults in th
CVE-2026-67336High 8.7
CVE-2026-67336 CVSS:8.7 better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none… - CVE-2025-71399 Better Auth relies on better-call, which uses the rou3 router library. In affect
CVE-2025-71399High 8.6
CVE-2025-71399 CVSS:8.6 Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing… - CVE-2026-10079 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Wh
CVE-2026-10079High 8.5
CVE-2026-10079 CVSS:8.5 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces… - CVE-2026-67323 GitPython before 3.1.51 fails to guard against dangerous Git options passed as k
CVE-2026-67323High 8.4
CVE-2026-67323 CVSS:8.4 GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(),… - CVE-2026-67331 better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organi
CVE-2026-67331High 8.3
CVE-2026-67331 CVSS:8.3 better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default,… - CVE-2026-67327 better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-be
CVE-2026-67327High 8.3
CVE-2026-67327 CVSS:8.3 better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vulnerable to account… - CVE-2026-53501 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0,
CVE-2026-53501High 8.2
CVE-2026-53501 CVSS:8.2 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the…
+GitHub-Advis - CVE-2026-53500 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0,
CVE-2026-53500High 8.2
CVE-2026-53500 CVSS:8.2 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings…
+GitHub-Advis - CVE-2026-18141 A flaw was found in aap-gateway, a component of Ansible Automation Platform's Ev
CVE-2026-18141High 8.2
CVE-2026-18141 CVSS:8.2 A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote… - CVE-2025-15672 The ChamaWP WordPress plugin before 1.0.13 does not properly validate user inpu
CVE-2025-15672High 8.1
CVE-2025-15672 CVSS:8.1 The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function,… - CVE-2026-16539 The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and esca
CVE-2026-16539High 8.1
CVE-2026-16539 CVSS:8.1 The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement… - CVE-2026-18577 An incomplete patch for CVE-2026-18556 allows for authentication bypass and acco
CVE-2026-18577High 8.1
CVE-2026-18577 CVSS:8.1 An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 产品:…
+CISA-KEV+PoC-in-GitHu - CVE-2026-20465 In wlan AP driver, there is a possible out of bounds write due to a missing boun
CVE-2026-20465High 8.1
CVE-2026-20465 CVSS:8.1 In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent)… - CVE-2026-68581 Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API
CVE-2026-68581High 8.1
CVE-2026-68581 CVSS:8.1 Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs… - CVE-2026-67328 @better-auth/sso versions before 1.6.21 contain multiple authentication bypass v
CVE-2026-67328High 8.1
CVE-2026-67328 CVSS:8.1 @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow… - CVE-2026-16144 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vu
CVE-2026-16144High 8.1
CVE-2026-16144 CVSS:8.1 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up… - CVE-2026-15450 The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable
CVE-2026-15450High 8.1
CVE-2026-15450 CVSS:8.1 The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in… - CVE-2026-53510 Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operatio
CVE-2026-53510High 8.1
CVE-2026-53510 CVSS:8.1 Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation…
+GitHub-Advis - CVE-2026-62391 The security fix for CVE-2025-66518 is incomplete. Any client who can access to
CVE-2026-62391High 8.1
CVE-2026-62391 CVSS:8.1 The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can… - CVE-2026-34641 Premiere Pro is affected by an out-of-bounds write vulnerability that could resu
CVE-2026-34641High 7.8
CVE-2026-34641 CVSS:7.8 Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the… - CVE-2026-20483 In Telephony, there is a possible escalation of privilege due to a missing permi
CVE-2026-20483High 7.7
CVE-2026-20483 CVSS:7.7 In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of… - CVE-2026-67352 luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in
CVE-2026-67352High 7.6
CVE-2026-67352 CVSS:7.6 luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated… - CVE-2026-10685 The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp()
CVE-2026-10685High 7.6
CVE-2026-10685 CVSS:7.6 The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the… - CVE-2026-20479 In Modem, there is a possible out of bounds read due to a missing bounds check.
CVE-2026-20479High 7.5
CVE-2026-20479 CVSS:7.5 In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE… - CVE-2026-16540 The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not corre
CVE-2026-16540High 7.5
CVE-2026-16540 CVSS:7.5 The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the…
+PoC-in-GitHu - CVE-2026-16285 The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not pe
CVE-2026-16285High 7.5
CVE-2026-16285 CVSS:7.5 The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media… - CVE-2026-16261 The login-social WordPress plugin through 1.0.4 does not validate password-reset
CVE-2026-16261High 7.5
CVE-2026-16261 CVSS:7.5 The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's… - CVE-2026-15241 The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform a
CVE-2026-15241High 7.5
CVE-2026-15241 CVSS:7.5 The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX… - CVE-2026-15236 The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly r
CVE-2026-15236High 7.5
CVE-2026-15236 CVSS:7.5 The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth… - CVE-2026-15206 The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified"
CVE-2026-15206High 7.5
CVE-2026-15206 CVSS:7.5 The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually… - CVE-2026-15151 The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not p
CVE-2026-15151High 7.5
CVE-2026-15151 CVSS:7.5 The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions,… - CVE-2026-3245 A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that
CVE-2026-3245High 7.5
CVE-2026-3245 CVSS:7.5 A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. 产品: - CVE-2026-68580 FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio inp
CVE-2026-68580High 7.5
CVE-2026-68580 CVSS:7.5 FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio,… - CVE-2026-68578 ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the
CVE-2026-68578High 7.5
CVE-2026-68578 CVSS:7.5 ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission… - CVE-2026-67357 ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability
CVE-2026-67357High 7.5
CVE-2026-67357 CVSS:7.5 ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the… - CVE-2026-18352 The User Access Manager plugin for WordPress is vulnerable to Directory Traversa
CVE-2026-18352High 7.5
CVE-2026-18352 CVSS:7.5 The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the… - CVE-2026-13339 The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal i
CVE-2026-13339High 7.5
CVE-2026-13339 CVSS:7.5 The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the… - CVE-2026-67322 GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Re
CVE-2026-67322High 7.5
CVE-2026-67322 CVSS:7.5 GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is… - CVE-2026-67304 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smart
CVE-2026-67304High 7.5
CVE-2026-67304 CVSS:7.5 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state… - CVE-2026-67301 FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async u
CVE-2026-67301High 7.5
CVE-2026-67301 CVSS:7.5 FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB… - CVE-2026-67300 FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities i
CVE-2026-67300High 7.5
CVE-2026-67300 CVSS:7.5 FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL… - CVE-2026-67299 FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async up
CVE-2026-67299High 7.5
CVE-2026-67299 CVSS:7.5 FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOW_ICON_ORDER when… - CVE-2026-67298 FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server
CVE-2026-67298High 7.5
CVE-2026-67298 CVSS:7.5 FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler… - CVE-2026-67297 FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing T
CVE-2026-67297High 7.5
CVE-2026-67297 CVSS:7.5 FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in… - CVE-2026-67296 FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI se
CVE-2026-67296High 7.5
CVE-2026-67296 CVSS:7.5 FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU… - CVE-2026-67291 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bound
CVE-2026-67291High 7.5
CVE-2026-67291 CVSS:7.5 FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in… - CVE-2026-67290 FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TS
CVE-2026-67290High 7.5
CVE-2026-67290 CVSS:7.5 FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO… - CVE-2026-67288 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smart
CVE-2026-67288High 7.5
CVE-2026-67288 CVSS:7.5 FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR… - CVE-2026-15006 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email
CVE-2026-15006High 7.5
CVE-2026-15006 CVSS:7.5 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to… - CVE-2026-62999 Copier is a library and CLI app for rendering project templates. From 9.5.0 thro
CVE-2026-62999High 7.5
CVE-2026-62999 CVSS:7.5 Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments… - CVE-2026-53599 REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_m
CVE-2026-53599High 7.5
CVE-2026-53599 CVSS:7.5 REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in…
+GitHub-Advis - CVE-2026-53505 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0,
CVE-2026-53505High 7.5
CVE-2026-53505 CVSS:7.5 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not…
+GitHub-Advis - CVE-2026-53504 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0,
CVE-2026-53504High 7.5
CVE-2026-53504 CVSS:7.5 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs…
+GitHub-Advis - CVE-2026-53503 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0,
CVE-2026-53503High 7.5
CVE-2026-53503 CVSS:7.5 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution(<matrix>, <columns>,…
+GitHub-Advis - CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game serv
CVE-2026-52856High 7.5
CVE-2026-52856 CVSS:7.5 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed…
+GitHub-Advis - CVE-2026-17347 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administr
CVE-2026-17347High 7.5
CVE-2026-17347 CVSS:7.5 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a… - CVE-2026-18446 fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash
CVE-2026-18446High 7.5
CVE-2026-18446 CVSS:7.5 fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses…
+GitHub-Advis - CVE-2026-18358 A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux.
CVE-2026-18358High 7.5
CVE-2026-18358 CVSS:7.5 A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP… - CVE-2026-15722 A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). Th
CVE-2026-15722High 7.5
CVE-2026-15722 CVSS:7.5 A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c… - CVE-2026-11770 A flaw was found in 389 Directory Server. An unauthenticated remote attacker can
CVE-2026-11770High 7.5
CVE-2026-11770 CVSS:7.5 A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV… - CVE-2026-18394 Incorrect authorization in the http_request tool in Strands Agents Tools before
CVE-2026-18394High 7.4
CVE-2026-18394 CVSS:7.4 Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain… - CVE-2026-18481 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel be
CVE-2026-18481High 7.3
CVE-2026-18481 CVSS:7.3 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to… - CVE-2026-54737 @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preserva
CVE-2026-54737High 7.3
CVE-2026-54737 CVSS:7.3 @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5,…
+GitHub-Advis - CVE-2026-67333 better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-bet
CVE-2026-67333High 7.2
CVE-2026-67333 CVSS:7.2 better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris… - CVE-2026-15052 The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin
CVE-2026-15052High 7.2
CVE-2026-15052 CVSS:7.2 The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site… - CVE-2026-16843 Some Hikvision Wireless Access Points are vulnerable to authenticated command ex
CVE-2026-16843High 7.2
CVE-2026-16843 CVSS:7.2 Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers… - CVE-2026-65875 BaserCMS provided by baserCMS Users Community contains a CSV file injection vuln
CVE-2026-65875High 7.1
CVE-2026-65875 CVSS:7.1 BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file… - CVE-2026-9856 A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an atta
CVE-2026-9856High 7.1
CVE-2026-9856 CVSS:7.1 A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path… - CVE-2025-71400 better-auth passkey versions before 1.4.0 contain an insecure direct object refe
CVE-2025-71400High 7.1
CVE-2025-71400 CVSS:7.1 better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint… - CVE-2026-67329 @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1
CVE-2026-67329High 7.1
CVE-2026-67329 CVSS:7.1 @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in… - CVE-2025-71403 better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrig
CVE-2025-71403High 7.1
CVE-2025-71403 CVSS:7.1 better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and… - CVE-2026-65981 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.
CVE-2026-65981High 7.1
CVE-2026-65981 CVSS:7.1 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed… - CVE-2026-10848 The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in par
CVE-2026-10848High 7.0
CVE-2026-10848 CVSS:7.0 The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a… - CVE-2026-67326 GitPython before 3.1.50 fails to validate newline characters in the section para
CVE-2026-67326High 7.0
CVE-2026-67326 CVSS:7.0 GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject…
🤖 漏洞情报自动汇总 · 2026-08-05 · 数据来源: NVD / GitHub Advisory / Sploitus / CISA-KEV