Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-115603 Lộ dữ liệu | WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability | 8.5 HIGH | Advanced Ads GmbH Advanced Ads – Tracking | NVD, CVE.org | |
| CVE-2026-105420 RCE Lộ dữ liệu | Path Traversal in Wing WFTP Server leading to Remote Code Execution | 9.4 CRITICAL | Wing Soft Technology Wing FTP Server | NVD, CVE.org | |
| CVE-2026-59179 Lộ dữ liệu | OpenHop: Path Traversal in Flow ID File Operations | 8.3 HIGH | naorsabag openhop | NVD, CVE.org | |
| CVE-2026-111850 Lộ dữ liệu | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability | 8.5 HIGH | BuddyPress BuddyPress | NVD, CVE.org | |
| CVE-2026-111411 Lộ dữ liệu | WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability | 9.3 CRITICAL | Aman FunnelKit Automations | NVD, CVE.org | |
| CVE-2026-115607 Lộ dữ liệu | WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability | 9.3 CRITICAL | Crowd Favorite DXP ToolKit | NVD, CVE.org | |
| CVE-2026-67073 RCE Truy cập trái phép Lộ dữ liệu | HCL BigFix AEX is affected by multiple security vulnerabilities. | 8.6 HIGH | HCL Software BigFix AEX | NVD, CVE.org | |
| CVE-2026-118485 Lộ dữ liệu | Axel Download Accelerator Path Traversal via URL Filename Decoding | 8.1 HIGH | Axel Download Accelerator Axel | NVD, CVE.org | |
| CVE-2026-103792 Lộ dữ liệu | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40... | 9.6 CRITICAL | Dell PowerProtect Data Domain Management Center | NVD, CVE.org | |
| CVE-2026-112198 Lộ dữ liệu | Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App | 8.3 HIGH | Tactis NoviGest Desktop App | NVD, CVE.org | |
| CVE-2026-14571 Lộ dữ liệu | SQL injection (SQLi) in the user authentication module of Futurum Software | 9.1 CRITICAL | Futurum Software Futurum Software User Authentication Module | NVD, CVE.org | |
| CVE-2026-86398 Lộ dữ liệu | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 8.8 HIGH | Dell PowerProtect Data Domain | NVD, CVE.org |