Lỗ hổng mới

Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.

/
RCE172 Truy cập trái phép108 Lộ dữ liệu62

266 lỗ hổng

ID Tóm tắt CVSS Sản phẩm / package Công bố Nguồn
CVE-2026-115642 Truy cập trái phép In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restri... 8.3 HIGH OpenStack keystonemiddleware NVD, CVE.org
CVE-2026-119287 Truy cập trái phép Zuke: Command-form registry descriptors bypass the MCP launch policy 8.0 HIGH zuke-build zuke NVD, CVE.org
CVE-2026-119716 RCE pybars3 through 0.9.7 Code Injection via Bracketed Path Segments 8.1 HIGH wbond pybars3 NVD, CVE.org
CVE-2026-119717 RCE pybars4 through 0.9.13 Code Injection via Bracketed Path Segments 8.1 HIGH up9inc pybars4 NVD, CVE.org
CVE-2026-119713 RCE Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands 8.8 HIGH paperclipai @paperclipai/server NVD, CVE.org
CVE-2026-119706 RCE LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization 9.8 CRITICAL InternLM lmdeploy NVD, CVE.org
CVE-2026-93327 RCE Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution 9.4 CRITICAL Google Cloud Application Integration NVD, CVE.org
CVE-2026-61738 RCE Lộ dữ liệu SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) 10.0 CRITICAL socfortress CoPilot NVD, CVE.org
CVE-2026-61737 Truy cập trái phép ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin 9.8 CRITICAL huajian123 ng-antd-admin NVD, CVE.org
CVE-2026-45144 Truy cập trái phép Chamilo LMS: Stored XSS in public user-profile fields 8.9 HIGH chamilo chamilo-lms NVD, CVE.org
CVE-2026-61730 Truy cập trái phép Lộ dữ liệu SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount 9.3 CRITICAL socfortress CoPilot NVD, CVE.org
CVE-2026-61729 Truy cập trái phép SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection 9.4 CRITICAL socfortress CoPilot NVD, CVE.org
CVE-2026-61728 Truy cập trái phép SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover 9.9 CRITICAL socfortress CoPilot NVD, CVE.org
CVE-2026-61708 Truy cập trái phép SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user) 8.5 HIGH socfortress CoPilot NVD, CVE.org
CVE-2026-112905 Truy cập trái phép Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft 9.0 CRITICAL givanz Vvveb NVD, CVE.org
CVE-2026-110799 Truy cập trái phép Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover 9.8 CRITICAL givanz Vvveb NVD, CVE.org
CVE-2026-119662 Truy cập trái phép Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend 8.8 HIGH songloft-org songloft NVD, CVE.org
CVE-2026-119660 Truy cập trái phép MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key 9.8 CRITICAL yincongcyincong MuseBot NVD, CVE.org
CVE-2026-119654 Truy cập trái phép DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization 8.8 HIGH devlive-community DataCap NVD, CVE.org
CVE-2026-91913 RCE Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker ... 8.8 HIGH Dell OpenManage Enterprise NVD, CVE.org
CVE-2026-119572 Truy cập trái phép Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider 8.7 HIGH traefik traefik NVD, CVE.org
CVE-2026-118992 RCE CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup 8.4 HIGH NVD, CVE.org
CVE-2026-75882 Truy cập trái phép Improper access control vulnerability in ESET Encryption products for Windows 8.5 HIGH ESET spol. s.r.o. ESET Endpoint Encryption, ESET spol. s.r.o. ESET Full Disk Encryption NVD, CVE.org
CVE-2026-111505 RCE Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker ... 8.8 HIGH Dell OpenManage Enterprise NVD, CVE.org
CVE-2026-119420 Truy cập trái phép Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation 8.8 HIGH getlago lago NVD, CVE.org
CVE-2026-119408 RCE n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes 8.8 HIGH n8n-io n8n NVD, CVE.org
CVE-2026-116366 RCE Unauthenticated RCE vulnerability against ClickHouse Server 9.5 CRITICAL ClickHouse ClickHouse, ClickHouse ClickHouse Cloud NVD, CVE.org
CVE-2026-22110 Truy cập trái phép Missing authentication check on POST/PUT requests 8.7 HIGH Delta Electronics Delta UFC500 NVD, CVE.org
CVE-2026-22105 Truy cập trái phép Use of default password based on serial number 8.7 HIGH Delta Electronics Delta UFC500 NVD, CVE.org
CVE-2026-22109 Truy cập trái phép Default WebUI passwords stored in plaintext 8.4 HIGH Delta Electronics Delta UFC500 NVD, CVE.org
CVE-2025-31704 RCE Dahua Intelligent Connection Center command injection 9.8 CRITICAL Dahua Intelligent Connection Center NVD, CVE.org
CVE-2026-59387 Truy cập trái phép Broken access control restriction in Cloud Controller API 8.8 HIGH Cloud Foundry CAPI (Cloud Controller API), Cloud Foundry cf-deployment NVD, CVE.org
CVE-2026-82104 Truy cập trái phép API permission bypass via logic bug 9.4 CRITICAL Teltonika Networks RUT, Teltonika Networks RUTX +12 NVD, CVE.org
CVE-2026-103039 RCE Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field 9.8 CRITICAL Gravity Forms Gravity Forms NVD, CVE.org
CVE-2026-104368 Truy cập trái phép Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field 8.8 HIGH webtoffee Export and Import Users and Customers NVD, CVE.org
CVE-2026-119270 RCE Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromi... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119271 RCE Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119263 RCE Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium... 9.6 CRITICAL Google Chrome NVD, CVE.org
CVE-2026-119264 RCE Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security seve... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119265 RCE Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sev... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119266 RCE Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severi... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119267 RCE Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sever... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119268 RCE Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119269 RCE Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119260 RCE Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-119261 RCE Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu... 9.6 CRITICAL Google Chrome NVD, CVE.org
CVE-2026-119262 RCE Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-76028 RCE Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-76029 RCE Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s... 8.8 HIGH Google Chrome NVD, CVE.org
CVE-2026-76030 RCE Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit... 8.8 HIGH Google Chrome NVD, CVE.org