Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-110176 Truy cập trái phép | File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers | 8.7 HIGH | Drupal File Force Download | NVD, CVE.org | |
| CVE-2026-117656 Truy cập trái phép | Unverified Sign in with Apple callback parameter can override verified ID token claims | 9.3 CRITICAL | erlang/assent, pow-auth assent | NVD, OSV.dev | |
| GHSA-4xm8-rg9h-jhq2 RCE Lộ dữ liệu | Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | 9.8 CRITICAL | npm/signalk-server, npm/@signalk/resources-provider | GitHub Advisory, OSV.dev | |
| GHSA-hff9-5pqw-6w9f RCE | imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | 9.8 CRITICAL | go/github.com/imgproxy/imgproxy/v3, go/github.com/imgproxy/imgproxy/v2 +1 | GitHub Advisory, OSV.dev | |
| CVE-2026-63396 Truy cập trái phép | Coop has a data leak via unauthenticated GraphQL Query.allOrgs | 8.7 HIGH | roostorg coop | NVD, CVE.org | |
| CVE-2026-63339 Truy cập trái phép | IXP Manager has authenticated non-administrator privilege escalation | 8.8 HIGH | inex IXP-Manager | NVD, CVE.org | |
| CVE-2026-63338 Truy cập trái phép | IXP Manager has Broken Object-Level Authorization | 8.3 HIGH | inex IXP-Manager | NVD, CVE.org | |
| CVE-2026-63393 RCE | OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution | 8.7 HIGH | opensearch-project sql | NVD, CVE.org | |
| CVE-2026-63378 RCE | TAKO AI Agent for Okta: Authenticated Python execution through validator bypass | 8.8 HIGH | fctr-id okta-ai-agent | NVD, CVE.org | |
| CVE-2026-63377 Truy cập trái phép | TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover | 9.8 CRITICAL | fctr-id okta-ai-agent | NVD, CVE.org | |
| CVE-2026-63346 RCE | Refitter: C# source injection through OpenAPI header parameter names | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63344 RCE | Refitter: C# source injection through OpenAPI content-type map keys | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63345 RCE | Refitter: C# source injection through OpenAPI path keys | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63182 Truy cập trái phép | LightSAML: Signature reference wrapping permits unsigned assertion claims | 8.1 HIGH | litesaml lightsaml | NVD, CVE.org | |
| CVE-2026-118938 RCE | Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysis | 8.8 HIGH | trailofbits fickling | NVD, CVE.org | |
| CVE-2026-16760 RCE | Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables | 8.8 HIGH | trailofbits fickling | NVD, CVE.org | |
| CVE-2026-62990 Truy cập trái phép | Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation | 8.7 HIGH | shopperlabs shopper | NVD, CVE.org | |
| CVE-2026-62989 Truy cập trái phép | Shopper: missing variant-delete authorization permits destructive single and bulk actions | 8.1 HIGH | shopperlabs shopper | NVD, CVE.org | |
| CVE-2026-62967 Truy cập trái phép | ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser | 8.1 HIGH | sinamics ztnet | NVD, CVE.org | |
| CVE-2026-62863 Truy cập trái phép | MoLing: unauthenticated SSE and wildcard CORS expose tool sessions | 9.6 CRITICAL | gojue moling | NVD, CVE.org | |
| CVE-2026-40573 Truy cập trái phép | NovumOS: Nova Interpreter Privilege Escalation | 8.6 HIGH | MinecAnton209 NovumOS | NVD, CVE.org | |
| CVE-2026-62853 RCE | ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks | 9.9 CRITICAL | mqttsnet thinglinks | NVD, CVE.org | |
| CVE-2026-62847 Truy cập trái phép | Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS) | 8.2 HIGH | metalama Metalama | NVD, CVE.org | |
| CVE-2026-58412 Truy cập trái phép | Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow | 8.2 HIGH | filecoin-project filecoin-pin | NVD, CVE.org | |
| CVE-2026-119332 RCE | Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister() | 8.8 HIGH | LadybirdBrowser ladybird | NVD, CVE.org | |
| CVE-2026-116245 Truy cập trái phép | pgAdmin 4: Connection services are not restricted in server mode | 8.2 HIGH | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-116241 RCE | pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier | 9.9 CRITICAL | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-116239 Truy cập trái phép | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username | 8.5 HIGH | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-116238 Truy cập trái phép | pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks | 8.1 HIGH | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-115829 Truy cập trái phép | Secret Server partial login bypass | 8.7 HIGH | Delinea Secret Server | NVD, CVE.org | |
| CVE-2026-115830 Truy cập trái phép | Secret Server JWT issuance error | 8.7 HIGH | Delinea Secret Server | NVD, CVE.org | |
| CVE-2026-61850 Truy cập trái phép | Kargo: Privilege escalation via Project RBAC management in the Kargo API | 9.3 CRITICAL | akuity kargo | NVD, CVE.org | |
| CVE-2026-62302 Truy cập trái phép | MyTube: Unauthenticated Media Access via Static Routes Bypassing Login | 8.7 HIGH | franklioxygen MyTube | NVD, CVE.org | |
| CVE-2026-62284 RCE Lộ dữ liệu | OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy | 8.6 HIGH | osac-project osac-operator | NVD, CVE.org | |
| CVE-2026-78403 RCE Truy cập trái phép | Unauthenticated Stack Buffer Overflow in Sentinel Keys Server | 9.8 CRITICAL | Thalesgroup Sentinel Keys Server | NVD, CVE.org | |
| CVE-2026-118090 RCE | WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability | 8.8 HIGH | Stylemix MasterStudy LMS | NVD, CVE.org | |
| CVE-2026-118086 Truy cập trái phép | WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability | 8.8 HIGH | Hakan Ozevin WP BASE Booking | NVD, CVE.org | |
| CVE-2026-116852 RCE | WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability | 9.1 CRITICAL | Marketing Fire Widget Options | NVD, CVE.org | |
| CVE-2026-116386 Truy cập trái phép | WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability | 9.8 CRITICAL | Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications | NVD, CVE.org | |
| CVE-2026-90888 RCE | WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability | 9.8 CRITICAL | leadsnap LeadSnap | NVD, CVE.org | |
| CVE-2026-78527 RCE | WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability | 8.8 HIGH | GS Plugins GS Testimonial Slider | NVD, CVE.org | |
| CVE-2026-73186 RCE | WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability | 8.8 HIGH | ShortPixel Enable Media Replace | NVD, CVE.org | |
| CVE-2026-39738 RCE | WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability | 9.8 CRITICAL | FunnelKit FunnelKit Automations | NVD, CVE.org | |
| CVE-2026-119526 RCE | WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Royal Event | NVD, CVE.org | |
| CVE-2026-62162 Truy cập trái phép | Hydra: Deposit Claim omits Head state-token spending requirement | 8.2 HIGH | cardano-scaling hydra | NVD, CVE.org | |
| CVE-2026-119978 RCE | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore | 8.5 HIGH | FlowiseAI Flowise | NVD, CVE.org | |
| CVE-2026-105894 Truy cập trái phép | Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update | 8.8 HIGH | akbilisim Ak Framework | NVD, CVE.org | |
| CVE-2026-115346 RCE | Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field | 8.1 HIGH | ThemeFusion Avada | Website Builder For WordPress & WooCommerce | NVD, CVE.org | |
| CVE-2025-8574 Truy cập trái phép | Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion | 8.7 HIGH | tigroumeow Database Cleaner: Cleanup, Optimization & Repair | NVD, CVE.org | |
| CVE-2026-61826 Truy cập trái phép Lộ dữ liệu | Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery | 10.0 CRITICAL | morpheus65535 bazarr | NVD, CVE.org |