Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-110799 Truy cập trái phép | Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover | 9.8 CRITICAL | givanz Vvveb | NVD, CVE.org | |
| CVE-2026-119662 Truy cập trái phép | Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend | 8.8 HIGH | songloft-org songloft | NVD, CVE.org | |
| CVE-2026-119660 Truy cập trái phép | MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key | 9.8 CRITICAL | yincongcyincong MuseBot | NVD, CVE.org | |
| CVE-2026-119654 Truy cập trái phép | DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization | 8.8 HIGH | devlive-community DataCap | NVD, CVE.org | |
| CVE-2026-119572 Truy cập trái phép | Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider | 8.7 HIGH | traefik traefik | NVD, CVE.org | |
| CVE-2026-75882 Truy cập trái phép | Improper access control vulnerability in ESET Encryption products for Windows | 8.5 HIGH | ESET spol. s.r.o. ESET Endpoint Encryption, ESET spol. s.r.o. ESET Full Disk Encryption | NVD, CVE.org | |
| CVE-2025-68394 Lộ dữ liệu | SQL Injection in Protectel | 8.4 HIGH | ARKETEAM PROTECTELMAJ, ARKETEAM BDF | NVD, CVE.org | |
| CVE-2025-68393 Lộ dữ liệu | SQL Injection in Protectel | 8.4 HIGH | ARKETEAM PROTECTELMAJ, ARKETEAM BDF | NVD, CVE.org | |
| CVE-2026-119420 Truy cập trái phép | Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation | 8.8 HIGH | getlago lago | NVD, CVE.org | |
| CVE-2026-119418 Lộ dữ liệu | CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() | 8.1 HIGH | cakephp cakephp | NVD, CVE.org | |
| CVE-2026-119419 Lộ dữ liệu | CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation | 8.1 HIGH | cakephp cakephp | NVD, CVE.org | |
| CVE-2026-22110 Truy cập trái phép | Missing authentication check on POST/PUT requests | 8.7 HIGH | Delta Electronics Delta UFC500 | NVD, CVE.org | |
| CVE-2026-22105 Truy cập trái phép | Use of default password based on serial number | 8.7 HIGH | Delta Electronics Delta UFC500 | NVD, CVE.org | |
| CVE-2026-22109 Truy cập trái phép | Default WebUI passwords stored in plaintext | 8.4 HIGH | Delta Electronics Delta UFC500 | NVD, CVE.org | |
| CVE-2026-14467 Lộ dữ liệu | Display of information in the Forocoches comments editor | 8.2 HIGH | Forocoches Forocoches comments editor | NVD, CVE.org | |
| CVE-2026-59387 Truy cập trái phép | Broken access control restriction in Cloud Controller API | 8.8 HIGH | Cloud Foundry CAPI (Cloud Controller API), Cloud Foundry cf-deployment | NVD, CVE.org | |
| CVE-2026-82104 Truy cập trái phép | API permission bypass via logic bug | 9.4 CRITICAL | Teltonika Networks RUT, Teltonika Networks RUTX +12 | NVD, CVE.org | |
| CVE-2026-104368 Truy cập trái phép | Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field | 8.8 HIGH | webtoffee Export and Import Users and Customers | NVD, CVE.org | |
| CVE-2026-92744 RCE Truy cập trái phép | Delinea Privilege Manager agent unauthenticated remote code execution vulnerability | 8.7 HIGH | Delinea Privilege Manager | NVD, CVE.org | |
| CVE-2026-107239 RCE Lộ dữ liệu | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center ... | 8.8 HIGH | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-61707 RCE Truy cập trái phép | SOCFortress CoPilot: Stored case-report template injection permits backend code execution | 9.0 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-61671 Truy cập trái phép | WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes | 8.1 HIGH | LabRedesCefetRJ WeGIA | NVD, CVE.org | |
| CVE-2026-61654 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-61645 RCE Lộ dữ liệu | Docat has Arbitrary File Upload exists in Upload API | 9.1 CRITICAL | docat-org docat | NVD, CVE.org | |
| CVE-2026-13303 Lộ dữ liệu | Boundary vulnerable to server-side request forgery in Vault credential store | 8.7 HIGH | HashiCorp Boundary, HashiCorp Boundary Enterprise | NVD, CVE.org | |
| CVE-2026-61576 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-103093 RCE Truy cập trái phép | Sandbox Escape via Table Rotation in ServiceNow AI Platform | 9.4 CRITICAL | ServiceNow ServiceNow AI Platform | NVD, CVE.org | |
| CVE-2026-119168 Truy cập trái phép | Nomad allocation data migration may allow host directory permission modification via symlink following | 8.8 HIGH | HashiCorp Nomad, HashiCorp Nomad Enterprise | NVD, CVE.org | |
| CVE-2026-119115 Truy cập trái phép | Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes | 8.5 HIGH | AWS aws-privateca-issuer | NVD, CVE.org | |
| GHSA-w9x9-j56r-h98r Truy cập trái phép | @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy | 8.2 HIGH | npm/@eeacms/volto-chatbot | GitHub Advisory, OSV.dev | |
| CVE-2026-119145 RCE Lộ dữ liệu | Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload | 9.9 CRITICAL | frappe frappe | NVD, CVE.org | |
| CVE-2026-119129 Truy cập trái phép | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval | 8.1 HIGH | zitadel zitadel | NVD, CVE.org | |
| CVE-2026-119127 Truy cập trái phép | ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection | 8.1 HIGH | zitadel zitadel | NVD, CVE.org | |
| CVE-2026-90867 Truy cập trái phép | Improper Access Control of Web Admin Console in Progress WS_FTP Server | 8.1 HIGH | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90866 RCE Lộ dữ liệu | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90864 RCE Lộ dữ liệu | Host Administrator Path Containment Bypass in Progress WS_FTP Server | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90863 RCE Truy cập trái phép | Privilege Escalation via Missing Authorization in WS_FTP Manager | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-84295 Truy cập trái phép | Improper Authentication in Progress WS_FTP Server | 10.0 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-118082 Truy cập trái phép | WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability | 8.8 HIGH | BuddyBoss Buddyboss Platform | NVD, CVE.org | |
| CVE-2026-61996 Lộ dữ liệu | WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability | 8.5 HIGH | favethemes MLS On The Fly | NVD, CVE.org | |
| CVE-2026-88077 Truy cập trái phép | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-85899 RCE Truy cập trái phép | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 8.1 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-96203 RCE Truy cập trái phép | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-93680 Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-103092 Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107327 RCE Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110196 RCE Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-93570 Lộ dữ liệu | XML External Entity injection in Szafir and Szafir Weryfikująca | 8.2 HIGH | Krajowa Izba Rozliczeniowa Szafir, Krajowa Izba Rozliczeniowa Szafir Weryfikująca | NVD, CVE.org | |
| CVE-2026-115709 Lộ dữ liệu | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss | 8.2 HIGH | Elastic Elastic Cloud Enterprise | NVD, CVE.org | |
| CVE-2026-39736 Lộ dữ liệu | WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability | 8.5 HIGH | Crocoblock JetEngine | NVD, CVE.org |