Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-49142 Truy cập trái phép Lộ dữ liệu | OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] | 8.8 HIGH | openemr openemr | NVD, CVE.org | |
| RUSTSEC-2026-0427 Lộ dữ liệu | sn-releases: extract_release_archive writes archive entries without a path-traversal check (zip-slip) | 8.8 HIGH | rust/sn-releases | OSV.dev | |
| CVE-2026-115964 Lộ dữ liệu | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability | 9.3 CRITICAL | StylemixThemes Motors | NVD, CVE.org | |
| CVE-2026-115965 Lộ dữ liệu | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability | 8.5 HIGH | BuddyPress BuddyPress | NVD, CVE.org | |
| CVE-2026-111419 Truy cập trái phép | Hardcoded API Token in Foxit Official Website | 8.6 HIGH | Foxit Software Inc. foxit.com | NVD, CVE.org | |
| CVE-2026-114358 Lộ dữ liệu | SQL Injection Vulnerability in Radius Xenia M2M Platform | 9.3 CRITICAL | Radius Synergies Radius Xenia M2M Platform | NVD, CVE.org | |
| CVE-2026-113616 Truy cập trái phép | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset | 9.8 CRITICAL | Unknown LogixFast Auth | NVD, CVE.org | |
| CVE-2026-113617 Lộ dữ liệu | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal | 9.9 CRITICAL | Unknown Automated Import Products to Cart | NVD, CVE.org | |
| CVE-2026-89216 Lộ dữ liệu | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter | 8.6 HIGH | Unknown vTables | NVD, CVE.org | |
| CVE-2026-96228 Truy cập trái phép | SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover | 8.1 HIGH | sslplugins SSL Wireless SMS Notification | NVD, CVE.org | |
| CVE-2026-109516 Truy cập trái phép | Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token | 9.8 CRITICAL | guruteam Bot for Telegram on WooCommerce | NVD, CVE.org | |
| CVE-2026-113387 Truy cập trái phép | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the... | 8.6 HIGH | canva ortto | NVD, CVE.org | |
| CVE-2026-107015 Truy cập trái phép | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. | 9.1 CRITICAL | NVD, CVE.org | ||
| CVE-2026-107017 Truy cập trái phép | Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions. | 9.1 CRITICAL | NVD, CVE.org | ||
| CVE-2026-107028 Truy cập trái phép | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data. | 9.1 CRITICAL | NVD, CVE.org | ||
| CVE-2026-107034 Truy cập trái phép | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data. | 9.1 CRITICAL | NVD, CVE.org | ||
| CVE-2026-107058 Truy cập trái phép | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state. | 9.8 CRITICAL | NVD, CVE.org | ||
| CVE-2026-51905 Truy cập trái phép | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker... | 8.8 HIGH | NVD, CVE.org | ||
| CVE-2026-85749 Truy cập trái phép | MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail | 8.1 HIGH | mailwatch MailWatch | NVD, CVE.org | |
| CVE-2026-61572 Lộ dữ liệu | AVideo-Encoder: unauthenticated full-response server-side request forgery | 8.6 HIGH | WWBN AVideo-Encoder | NVD, CVE.org | |
| CVE-2026-93851 Lộ dữ liệu | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post | 8.0 HIGH | Mattermost Mattermost | NVD, CVE.org | |
| CVE-2026-118690 Truy cập trái phép | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs | 9.8 CRITICAL | SignalK signalk-server | NVD, CVE.org | |
| CVE-2026-118669 Truy cập trái phép | OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client | 8.4 HIGH | pip/oauthlib, oauthlib oauthlib | GitHub Advisory, NVD, CVE.org, OSV.dev | |
| CVE-2026-118668 Truy cập trái phép | LangGraph JavaScript custom authentication may permit cross-user Store access | 8.6 HIGH | pip/langgraph-api, langchain-ai langgraph-api | GitHub Advisory, NVD, CVE.org, OSV.dev | |
| CVE-2026-118660 Lộ dữ liệu | Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML | 8.6 HIGH | npm/happy-dom, capricorn86 happy-dom | GitHub Advisory, NVD, CVE.org, OSV.dev | |
| CVE-2026-117574 Truy cập trái phép | Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization | 9.1 CRITICAL | Red Hat Red Hat OpenShift AI (RHOAI) | NVD, CVE.org | |
| GHSA-4mfg-r38w-w8fg Lộ dữ liệu | mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 | 8.2 HIGH | npm/mcp-sanitizer | GitHub Advisory, OSV.dev | |
| CVE-2026-58273 Truy cập trái phép | rucio has an Authorization Bypass on REST API endpoint for signing URLs | 8.8 HIGH | pip/rucio | GitHub Advisory, OSV.dev | |
| CVE-2026-61542 Truy cập trái phép | Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools | 8.6 HIGH | drhelius Gearboy | NVD, CVE.org | |
| CVE-2026-63190 Truy cập trái phép Lộ dữ liệu | FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS | 9.4 CRITICAL | fearlessgeekmedia FearlessCMS | NVD, CVE.org | |
| CVE-2025-14260 Lộ dữ liệu | Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources | 8.3 HIGH | WSO2 WSO2 API Manager, WSO2 WSO2 Identity Server as Key Manager +5 | NVD, CVE.org | |
| CVE-2026-118647 Lộ dữ liệu | n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data | 8.2 HIGH | n8n-io n8n | NVD, CVE.org | |
| CVE-2026-118645 Lộ dữ liệu | n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter | 8.7 HIGH | n8n-io n8n | NVD, CVE.org | |
| CVE-2026-118633 RCE Lộ dữ liệu | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks ... | 8.1 HIGH | Sophos SG UTM | NVD, CVE.org | |
| CVE-2026-116794 Truy cập trái phép | russh: Agent server never calls Agent::confirm, so keys added with the confirm constraint (ssh-add -c) sign without confirmation | 8.3 HIGH | rust/russh, Eugeny russh | GitHub Advisory, NVD, CVE.org, OSV.dev | |
| CVE-2026-118619 RCE Lộ dữ liệu | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability | 8.8 HIGH | Ultralytics Ultralytics | NVD, CVE.org | |
| CVE-2026-103506 Truy cập trái phép | SSO settings authorization bypass | 8.9 HIGH | Grafana Grafana Enterprise, Grafana Grafana OSS | NVD, CVE.org | |
| CVE-2026-106079 RCE Truy cập trái phép | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103409 Truy cập trái phép | Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed | 9.8 CRITICAL | Juniper Networks Session Smart Router | NVD, CVE.org | |
| CVE-2026-103407 Lộ dữ liệu | Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103402 RCE Truy cập trái phép | Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-116778 RCE Truy cập trái phép | FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution | 8.8 HIGH | FOGProject fogproject | NVD, CVE.org | |
| CVE-2026-56828 Truy cập trái phép | Shopper: read-only team permissions allow administrator creation and permission escalation | 8.8 HIGH | shopperlabs shopper | NVD, CVE.org | |
| CVE-2026-59979 Truy cập trái phép | YosemiteCrew: Missing organization authorization on service and PMS library/template routes | 8.3 HIGH | YosemiteCrew Yosemite-Crew | NVD, CVE.org | |
| CVE-2026-115603 Lộ dữ liệu | WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability | 8.5 HIGH | Advanced Ads GmbH Advanced Ads – Tracking | NVD, CVE.org | |
| CVE-2026-105420 RCE Lộ dữ liệu | Path Traversal in Wing WFTP Server leading to Remote Code Execution | 9.4 CRITICAL | Wing Soft Technology Wing FTP Server | NVD, CVE.org | |
| CVE-2026-59185 Truy cập trái phép | identrail: Cross-tenant GitHub installation binding without ownership verification | 8.5 HIGH | identrail identrail | NVD, CVE.org | |
| CVE-2026-59179 Lộ dữ liệu | OpenHop: Path Traversal in Flow ID File Operations | 8.3 HIGH | naorsabag openhop | NVD, CVE.org | |
| CVE-2026-111850 Lộ dữ liệu | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability | 8.5 HIGH | BuddyPress BuddyPress | NVD, CVE.org | |
| CVE-2026-111411 Lộ dữ liệu | WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability | 9.3 CRITICAL | Aman FunnelKit Automations | NVD, CVE.org |