Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-116672 Truy cập trái phép | Authlib RFC 7592 examples omit registration-access-token client binding | 8.8 HIGH | pip/Authlib | GitHub Advisory | |
| CVE-2026-116794 Truy cập trái phép | russh: Agent server never calls Agent::confirm, so keys added with the confirm constraint (ssh-add -c) sign without confirmation | 8.3 HIGH | rust/russh | GitHub Advisory | |
| CVE-2026-118669 Truy cập trái phép | OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client | 8.4 HIGH | pip/oauthlib | GitHub Advisory | |
| GHSA-4xm8-rg9h-jhq2 RCE Lộ dữ liệu | Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | 9.8 CRITICAL | npm/signalk-server, npm/@signalk/resources-provider | GitHub Advisory | |
| GHSA-hff9-5pqw-6w9f RCE | imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | 9.8 CRITICAL | go/github.com/imgproxy/imgproxy/v3, go/github.com/imgproxy/imgproxy/v2 +1 | GitHub Advisory | |
| CVE-2026-96633 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | 8.1 HIGH | composer/adminneo-org/adminneo | GitHub Advisory | |
| CVE-2026-96631 Lộ dữ liệu | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 8.2 HIGH | composer/adminneo-org/adminneo | GitHub Advisory | |
| CVE-2026-96632 | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | 8.2 HIGH | composer/adminneo-org/adminneo | GitHub Advisory | |
| GHSA-5xjx-3w67-w9x9 | pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI | 9.3 CRITICAL | actions/pypa/gh-action-pypi-publish | GitHub Advisory | |
| CVE-2026-118664 | decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs | 8.2 HIGH | npm/decode-uri-component | GitHub Advisory | |
| CVE-2026-9800 | Keycloak vulnerable to authorization bypass via incorrect uri comparison | 8.1 HIGH | maven/org.keycloak:keycloak-services, maven/org.keycloak:keycloak-policy-enforcer | GitHub Advisory | |
| GHSA-w9x9-j56r-h98r Truy cập trái phép | @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy | 8.2 HIGH | npm/@eeacms/volto-chatbot | GitHub Advisory | |
| CVE-2026-62160 | Daptin: ParseAcceptLanguage _ separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware | 8.7 HIGH | go/github.com/daptin/daptin | GitHub Advisory | |
| CVE-2026-115915 RCE | vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE | 8.1 HIGH | pip/vllm | GitHub Advisory | |
| CVE-2026-115893 | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction | 9.9 CRITICAL | rust/wasmtime | GitHub Advisory | |
| CVE-2026-115905 RCE | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE | 10.0 CRITICAL | rust/zip | GitHub Advisory | |
| CVE-2026-118668 Truy cập trái phép | LangGraph JavaScript custom authentication may permit cross-user Store access | 8.6 HIGH | pip/langgraph-api | GitHub Advisory | |
| CVE-2026-118660 Lộ dữ liệu | Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML | 8.6 HIGH | npm/happy-dom | GitHub Advisory | |
| CVE-2026-118665 | GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications | 8.2 HIGH | npm/@graphql-tools/executor-legacy-ws | GitHub Advisory | |
| CVE-2026-118255 | Highcharts Grid: javascript: URL in credits.href runs script on click | 8.4 HIGH | npm/@highcharts/dashboards, npm/@highcharts/grid-pro | GitHub Advisory | |
| CVE-2026-118254 | Highcharts Grid parses pagination language options as HTML | 8.6 HIGH | npm/@highcharts/grid-lite, npm/@highcharts/grid-pro | GitHub Advisory | |
| CVE-2026-118253 | Highcharts Dashboards parses fullscreen labels as HTML | 8.4 HIGH | npm/@highcharts/dashboards | GitHub Advisory | |
| CVE-2026-118252 | Highcharts Dashboards parses sidebar component labels as HTML | 8.4 HIGH | npm/@highcharts/dashboards | GitHub Advisory | |
| CVE-2026-118251 | Highcharts: javascript: URL in credits.href runs script on click | 8.4 HIGH | npm/highcharts | GitHub Advisory | |
| CVE-2026-118246 | Highcharts Core: breadcrumbs.style keys become SVG event-handler attributes | 8.4 HIGH | npm/highcharts | GitHub Advisory | |
| CVE-2026-116797 | Highcharts Grid Pro: cell-renderer attributes map written with raw setAttribute | 8.5 HIGH | npm/@highcharts/grid-pro, npm/@highcharts/dashboards | GitHub Advisory | |
| CVE-2026-118242 | Highcharts Grid: custom icon definition objects written with raw setAttribute on <path> | 8.5 HIGH | npm/@highcharts/grid-lite, npm/@highcharts/grid-pro | GitHub Advisory | |
| CVE-2026-118245 | Highcharts Dashboards: chartConstructor is an unchecked lookup into the Highcharts namespace | 8.6 HIGH | npm/@highcharts/dashboards | GitHub Advisory | |
| GHSA-4mfg-r38w-w8fg Lộ dữ liệu | mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 | 8.2 HIGH | npm/mcp-sanitizer | GitHub Advisory | |
| CVE-2026-58273 Truy cập trái phép | rucio has an Authorization Bypass on REST API endpoint for signing URLs | 8.8 HIGH | pip/rucio | GitHub Advisory | |
| CVE-2026-111357 KEV Truy cập trái phép | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | — | Ivanti Connect Secure | CISA KEV | |
| CVE-2026-118527 KEV | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | — | Ivanti Connect Secure | CISA KEV | |
| CVE-2026-41709 KEV | Broadcom VMWare ESX Insufficient Logging Vulnerability | — | Broadcom VMware ESX | CISA KEV | |
| CVE-2026-46300 KEV | Linux Kernel Missing Initialization of a Variable Vulnerability | — | Linux Kernel | CISA KEV | |
| CVE-2026-76418 KEV | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | — | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software | CISA KEV | |
| CVE-2026-97229 KEV RCE | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | — | GitLab Community Edition and Enterprise Edition | CISA KEV |