漏洞分析 [hardware] Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE) CVE-2025-60690 Linksys E1200路由器apply.cgi存在认证后的栈缓冲区溢出，可导致远程代码执行。 High · CVSS 8.8 📋 漏洞基础信息 CVECVE-2025-60690漏洞类型栈缓冲区溢出（Authenticated Stack Buffer Overflow）受影响版本Linksys E1200 固件版本 <= v2.0.04危害等级High · CVSS 8.8发布日期2026-05-04提交者JarrettgxzSec来源Exploit-DB 原文 ↗ 🔬 漏洞根因 在/apply.cgi处理HTTP POST请求时，对'lan_ipaddr_3'参数的值未进行长度校验，直接将用户输入拷贝到栈缓冲区，导致溢出覆盖返回地址。 🎯 攻击场景 1. 攻击者需拥有路由器管理凭据（默认admin:admin）； 2. 通过HTTP POST请求向/apply.cgi发送精心构造的payload，
漏洞分析 [webapps] MindsDB 25.9.1.1 - Path Traversal CVE-2026-27483 MindsDB API文件上传路径遍历导致远程代码执行 Critical · CVSS 估计9.8 📋 漏洞基础信息 CVECVE-2026-27483漏洞类型路径遍历RCE受影响版本MindsDB < 25.9.1.1危害等级Critical · CVSS 估计9.8发布日期2026-05-04提交者Lohitya Pushkar (thewhiteh4t)来源Exploit-DB 原文 ↗ 🔬 漏洞根因 /api/files/{fname}端点未对上传文件路径进行有效限制，导致攻击者可通过路径遍历字符串（如../../../../../../venv/lib/python3.10/site-packages/pip/__init__.py）覆盖任意文件，结合后续handler安装触发恶意代码执行。 🎯 攻击场景 1. 检查目标MindsDB版本和认证状态；2. 若认证启用则先通过/api/login获取Bearer token；3. 构造一个Python反弹shell载荷（文件名随机）；4.
安全情报 Essential Data Sources for Detection Beyond the Endpoint 📡 Tenable Blog · 2026-05-01 Essential Data Sources for Detection Beyond the Endpoint The 2026 Unit 42 Global Incident Response Report delivers a sharp wake-up call: Threat actors are now moving 4x faster to exfiltration than in 2025. By striking across three or more surfaces simultaneously, adversaries are intentionally exploiting the blind
安全情报 CVE-2026-7784 (CVSS 7.3) - A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue aff 📡 NVD-Latest · 2026-05-05 CVE-2026-7784 (CVSS 7.3) - A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue aff CVE-2026-7784 CVE-2026-7784 CVSS:7.3 A vulnerability has been found in RTGS2017 NagaAgent up to 5.1.0. This issue affects some unknown processing of the file
安全情报 CVE-2026-44028 (CVSS 7.5) - An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded re 📡 NVD-Latest · 2026-05-05 CVE-2026-44028 (CVSS 7.5) - An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded re CVE-2026-44028 CVE-2026-44028 CVSS:7.5 An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the
安全情报 CVE-2026-43527 (CVSS 7.7) - OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability i 📡 NVD-Latest · 2026-05-05 CVE-2026-43527 (CVSS 7.7) - OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability i CVE-2026-43527 CVE-2026-43527 CVSS:7.7 OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration
安全情报 CVE-2026-43530 (CVSS 8.8) - OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval bi 📡 NVD-Latest · 2026-05-05 CVE-2026-43530 (CVSS 8.8) - OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval bi CVE-2026-43530 CVE-2026-43530 CVSS:8.8 OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that
安全情报 CVE-2026-7833 (CVSS 7.2) - A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerabilit 📡 NVD-Latest · 2026-05-05 CVE-2026-7833 (CVSS 7.2) - A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerabilit CVE-2026-7833 CVE-2026-7833 CVSS:7.2 A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file
安全情报 GHSA-3h96-34p3-xm76 - GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_ 📡 GitHub-Advisory · 2026-05-05 GHSA-3h96-34p3-xm76 - GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_ GHSA-3h96-34p3-xm76 MEDIUM rubygems/graphql CVE: GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured
安全情报 CVE-2026-32688 - Plug.Cowboy vulnerable to unauthenticated remote DoS via HTTP/2 `:scheme` atom-t 📡 GitHub-Advisory · 2026-05-05 CVE-2026-32688 - Plug.Cowboy vulnerable to unauthenticated remote DoS via HTTP/2 `:scheme` atom-t CVE-2026-32688 GHSA-q8x4-x7mp-5vg2 HIGH erlang/plug_cowboy CVE: CVE-2026-32688 Summary An unauthenticated remote denial-of-service vulnerability in Plug.Cowboy.Conn allows any attacker who can reach an HTTPS Plug.Cowboy listener via HTTP/2 to permanently
安全情报 CVE-2026-7750 (CVSS 8.8) - A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerabil 📡 NVD-Latest · 2026-05-04 CVE-2026-7750 (CVSS 8.8) - A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerabil CVE-2026-7750 CVE-2026-7750 CVSS:8.8 A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerability affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component POST
安全情报 CVE-2026-24072 (CVSS 8.8) - An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earl 📡 NVD-Latest · 2026-05-04 CVE-2026-24072 (CVSS 8.8) - An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earl CVE-2026-24072 CVE-2026-24072 CVSS:8.8 An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read
安全情报 CVE-2026-23918 (CVSS 8.8) - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 📡 NVD-Latest · 2026-05-04 CVE-2026-23918 (CVSS 8.8) - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 CVE-2026-23918 CVE-2026-23918 CVSS:8.8 Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66.
安全情报 CVE-2026-40563 (CVSS 7.1) - Description: Improper Control of Generation of Code ('Code Injection') vulnerabi 📡 NVD-Latest · 2026-05-04 CVE-2026-40563 (CVSS 7.1) - Description: Improper Control of Generation of Code ('Code Injection') vulnerabi CVE-2026-40563 CVE-2026-40563 CVSS:7.1 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query
安全情报 CVE-2026-5100 (CVSS 7.5) - The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 📡 NVD-Latest · 2026-05-05 CVE-2026-5100 (CVSS 7.5) - The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the CVE-2026-5100 CVE-2026-5100 CVSS:7.5 The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including,
安全情报 CVE-2026-3456 (CVSS 7.5) - The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation p 📡 NVD-Latest · 2026-05-05 CVE-2026-3456 (CVSS 7.5) - The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation p CVE-2026-3456 CVE-2026-3456 CVSS:7.5 The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in
安全情报 CVE-2026-4803 (CVSS 7.2) - The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Si 📡 NVD-Latest · 2026-05-05 CVE-2026-4803 (CVSS 7.2) - The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Si CVE-2026-4803 CVE-2026-4803 CVSS:7.2 The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in the wpr_update_form_action_meta
安全情报 CVE-2026-34408 (CVSS 9.1) - An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4. 📡 NVD-Latest · 2026-05-05 CVE-2026-34408 (CVSS 9.1) - An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4. CVE-2026-34408 CVE-2026-34408 CVSS:9.1 An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.
安全情报 CVE-2026-44456 - Hono: bodyLimit() can be bypassed for chunked / unknown-length requests 📡 GitHub-Advisory · 2026-05-06 CVE-2026-44456 - Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44456 GHSA-9vqf-7f2p-gf9v MEDIUM npm/hono CVE: CVE-2026-44456 Summary bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized requests can reach handlers and return 200 instead of 413. Details For
安全情报 CVE-2026-44455 - hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection 📡 GitHub-Advisory · 2026-05-06 CVE-2026-44455 - hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection CVE-2026-44455 GHSA-69xw-7hcm-h432 MEDIUM npm/hono CVE: CVE-2026-44455 Summary Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML output. When untrusted input
安全情报 GHSA-qxrw-f6fh-34r7 - Lemmy resend-verification endpoint exposes registered email addresses to unauthe 📡 GitHub-Advisory · 2026-05-06 GHSA-qxrw-f6fh-34r7 - Lemmy resend-verification endpoint exposes registered email addresses to unauthe GHSA-qxrw-f6fh-34r7 MEDIUM rust/lemmy_api CVE: Summary The unauthenticated resend-verification endpoint returns different responses for registered and unregistered email addresses. A malicious third party can submit candidate addresses to /api/v4/account/auth/resend_verification_email and
安全情报 CVE-2026-44439 - Playwright Capture permits access to local files and internal network resources 📡 GitHub-Advisory · 2026-05-06 CVE-2026-44439 - Playwright Capture permits access to local files and internal network resources CVE-2026-44439 GHSA-687h-xw6f-q2qw MEDIUM pip/PlaywrightCapture CVE: CVE-2026-44439 Playwright Capture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to
安全情报 CVE-2026-44437 - Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefi 📡 GitHub-Advisory · 2026-05-06 CVE-2026-44437 - Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefi CVE-2026-44437 GHSA-69xr-m8h6-h664 MEDIUM npm/@angular/ssr CVE: CVE-2026-44437 Description A vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly account for URL-encoded characters, specifically dots (%2e%
安全情报 GHSA-qcxq-75wr-5cm8 - ldap3_proto has LDAP Filter stack exhaustion 📡 GitHub-Advisory · 2026-05-06 GHSA-qcxq-75wr-5cm8 - ldap3_proto has LDAP Filter stack exhaustion GHSA-qcxq-75wr-5cm8 HIGH rust/ldap3_proto CVE: Impact LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries.
安全情报 GHSA-84jc-3hj2-hwc7 - kanidmd_lib: Image upload validators run before authorization; PNG validator pan 📡 GitHub-Advisory · 2026-05-06 GHSA-84jc-3hj2-hwc7 - kanidmd_lib: Image upload validators run before authorization; PNG validator pan GHSA-84jc-3hj2-hwc7 MEDIUM rust/kanidmd_lib CVE: Summary The POST /v1/domain/_image and POST /v1/oauth2/{rs_name}/_image handlers call validate_image() on the uploaded body before the ACL check that restricts image upload
