Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-39736 Lộ dữ liệu | WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability | 8.5 HIGH | Crocoblock JetEngine | NVD, CVE.org | |
| CVE-2026-119050 RCE | Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection | 8.1 HIGH | agno-agi agno | NVD, CVE.org | |
| CVE-2026-49142 Truy cập trái phép Lộ dữ liệu | OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] | 8.8 HIGH | openemr openemr | NVD, CVE.org | |
| RUSTSEC-2026-0427 Lộ dữ liệu | sn-releases: extract_release_archive writes archive entries without a path-traversal check (zip-slip) | 8.8 HIGH | rust/sn-releases | OSV.dev | |
| CVE-2026-119028 RCE | oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values | 8.8 HIGH | oapi-codegen oapi-codegen | NVD, CVE.org | |
| CVE-2026-97854 RCE | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the ... | 9.8 CRITICAL | Yamaha Corporation NWR100 | NVD, CVE.org | |
| CVE-2026-103665 RCE | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a special... | 8.4 HIGH | Yamaha Corporation Yamaha LAN Monitor for Windows | NVD, CVE.org | |
| CVE-2026-97860 RCE | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary cod... | 8.4 HIGH | Yamaha Corporation YMS-VPN8, Yamaha Corporation YMS-VPN8-CP | NVD, CVE.org | |
| CVE-2026-115964 Lộ dữ liệu | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability | 9.3 CRITICAL | StylemixThemes Motors | NVD, CVE.org | |
| CVE-2026-115965 Lộ dữ liệu | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability | 8.5 HIGH | BuddyPress BuddyPress | NVD, CVE.org | |
| CVE-2026-114358 Lộ dữ liệu | SQL Injection Vulnerability in Radius Xenia M2M Platform | 9.3 CRITICAL | Radius Synergies Radius Xenia M2M Platform | NVD, CVE.org | |
| CVE-2026-115245 RCE | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload | 9.8 CRITICAL | Unknown Chat AI with Dispatcher | NVD, CVE.org | |
| CVE-2026-113617 Lộ dữ liệu | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal | 9.9 CRITICAL | Unknown Automated Import Products to Cart | NVD, CVE.org | |
| CVE-2026-103693 RCE | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection | 9.0 CRITICAL | Unknown Frontend Dashboard, Unknown ProfileGrid | NVD, CVE.org | |
| CVE-2026-89216 Lộ dữ liệu | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter | 8.6 HIGH | Unknown vTables | NVD, CVE.org | |
| CVE-2026-42922 RCE | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can ... | 9.8 CRITICAL | frangoteam Frangoteam | NVD, CVE.org | |
| CVE-2026-66088 RCE | Unrestricted Command Execution via system.execute | 9.4 CRITICAL | Apereo Foundation openEQUELLA | NVD, CVE.org | |
| CVE-2026-61572 Lộ dữ liệu | AVideo-Encoder: unauthenticated full-response server-side request forgery | 8.6 HIGH | WWBN AVideo-Encoder | NVD, CVE.org | |
| CVE-2026-61567 RCE | AVideo-Encoder: unauthenticated command execution through streamer login trust | 10.0 CRITICAL | WWBN AVideo-Encoder | NVD, CVE.org | |
| CVE-2026-61564 RCE | AVideo-Encoder: unauthenticated installer PHP code injection | 10.0 CRITICAL | WWBN AVideo-Encoder | NVD, CVE.org | |
| CVE-2026-93851 Lộ dữ liệu | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post | 8.0 HIGH | Mattermost Mattermost | NVD, CVE.org | |
| CVE-2026-118660 Lộ dữ liệu | Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML | 8.6 HIGH | npm/happy-dom, capricorn86 happy-dom | GitHub Advisory, NVD, CVE.org, OSV.dev | |
| GHSA-4mfg-r38w-w8fg Lộ dữ liệu | mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 | 8.2 HIGH | npm/mcp-sanitizer | GitHub Advisory, OSV.dev | |
| CVE-2026-63190 Truy cập trái phép Lộ dữ liệu | FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS | 9.4 CRITICAL | fearlessgeekmedia FearlessCMS | NVD, CVE.org | |
| CVE-2026-78674 RCE | Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution | 8.8 HIGH | WSO2 Enterprise Integrator (BPS profile), WSO2 Business Process Server | NVD, CVE.org | |
| CVE-2025-14260 Lộ dữ liệu | Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources | 8.3 HIGH | WSO2 WSO2 API Manager, WSO2 WSO2 Identity Server as Key Manager +5 | NVD, CVE.org | |
| CVE-2026-118683 RCE | MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf | 8.8 HIGH | Project-MONAI MONAI | NVD, CVE.org | |
| CVE-2026-118647 Lộ dữ liệu | n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data | 8.2 HIGH | n8n-io n8n | NVD, CVE.org | |
| CVE-2026-118645 Lộ dữ liệu | n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter | 8.7 HIGH | n8n-io n8n | NVD, CVE.org | |
| CVE-2026-118633 RCE Lộ dữ liệu | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks ... | 8.1 HIGH | Sophos SG UTM | NVD, CVE.org | |
| CVE-2026-118619 RCE Lộ dữ liệu | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability | 8.8 HIGH | Ultralytics Ultralytics | NVD, CVE.org | |
| CVE-2026-118610 RCE | Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability | 8.8 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-118606 RCE | Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability | 8.8 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-118605 RCE | Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability | 8.0 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-118603 RCE | Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | 8.0 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-106079 RCE Truy cập trái phép | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103408 RCE | Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options | 8.8 HIGH | Juniper Networks Session Smart Router | NVD, CVE.org | |
| CVE-2026-103407 Lộ dữ liệu | Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103406 RCE | Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. | 9.8 CRITICAL | Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103403 RCE | Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103402 RCE Truy cập trái phép | Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-118510 RCE | Laravel MongoDB whereDoesntHave misses deny records for numeric string IDs | 8.8 HIGH | MongoDB Laravel MongoDB | NVD, CVE.org | |
| CVE-2026-116778 RCE Truy cập trái phép | FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution | 8.8 HIGH | FOGProject fogproject | NVD, CVE.org | |
| CVE-2026-44179 RCE | XWiki Pro Macros: excerpt-include title and content injection executes code | 9.9 CRITICAL | xwikisas xwiki-pro-macros | NVD, CVE.org | |
| CVE-2026-115603 Lộ dữ liệu | WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability | 8.5 HIGH | Advanced Ads GmbH Advanced Ads – Tracking | NVD, CVE.org | |
| CVE-2026-115968 RCE | WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability | 9.8 CRITICAL | Ultimate Member Ultimate Member | NVD, CVE.org | |
| CVE-2026-116389 RCE | WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability | 8.8 HIGH | crossi72 Phoenix Media Rename | NVD, CVE.org | |
| CVE-2026-105420 RCE Lộ dữ liệu | Path Traversal in Wing WFTP Server leading to Remote Code Execution | 9.4 CRITICAL | Wing Soft Technology Wing FTP Server | NVD, CVE.org | |
| CVE-2026-59179 Lộ dữ liệu | OpenHop: Path Traversal in Flow ID File Operations | 8.3 HIGH | naorsabag openhop | NVD, CVE.org | |
| CVE-2026-116391 RCE | WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability | 8.8 HIGH | GS Plugins GS Logo Slider | NVD, CVE.org |