Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-120198 RCE | WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection | 10.0 CRITICAL | WAVLINK WL-WN530BE1-A | CVE.org | |
| CVE-2026-120197 RCE | WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection | 9.9 CRITICAL | WAVLINK WL-WN530HG4B | NVD, CVE.org | |
| CVE-2026-120196 RCE | WAVLINK WN579X3-D wapi.cgi port_forward os command injection | 9.9 CRITICAL | WAVLINK WN579X3-D | NVD, CVE.org | |
| CVE-2026-120195 RCE | WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection | 10.0 CRITICAL | WAVLINK WL-WN579A3-A | NVD, CVE.org | |
| CVE-2026-120189 RCE | A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The mani... | 10.0 CRITICAL | D-Link DIR-505 | NVD | |
| CVE-2026-120135 | Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default | 8.2 HIGH | Apache Software Foundation Apache Thrift | NVD, CVE.org | |
| CVE-2026-118636 RCE | Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder | 9.8 CRITICAL | Apache Software Foundation Apache MINA | NVD, CVE.org | |
| CVE-2026-120209 RCE Truy cập trái phép | AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token | 9.8 CRITICAL | anji-plus AJ-Report | NVD, CVE.org | |
| CVE-2026-120205 | Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name | 8.0 HIGH | Thelia Thelia, Thelia Thelia Core | NVD, CVE.org | |
| CVE-2026-120203 RCE | ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates | 8.8 HIGH | ShowDoc ShowDoc | NVD, CVE.org | |
| CVE-2026-120201 Truy cập trái phép Lộ dữ liệu | Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header | 9.8 CRITICAL | dromara Jpom | NVD, CVE.org | |
| CVE-2026-102212 RCE | Pre-Auth Heap Buffer Overflow in the Multipart Request | 8.4 HIGH | Opengear IM7200, Opengear CM7100 +1 | NVD, CVE.org | |
| CVE-2026-76010 RCE Lộ dữ liệu | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal | 8.8 HIGH | smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | NVD, CVE.org | |
| CVE-2026-117681 Truy cập trái phép | Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone | 8.0 HIGH | NVD, CVE.org | ||
| CVE-2026-116964 RCE | Konflux-ci: remote code execution via eval() in manifest scripts | 8.4 HIGH | NVD, CVE.org | ||
| CVE-2026-116086 RCE Lộ dữ liệu | Konflux-ci: jq filter injection in github workflow issue management | 8.8 HIGH | NVD, CVE.org | ||
| CVE-2026-114217 Lộ dữ liệu | Konflux-ci: github token plaintext exposure in ci/cd scripts | 8.6 HIGH | NVD, CVE.org | ||
| CVE-2026-103882 RCE Lộ dữ liệu | Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter | 9.1 CRITICAL | acadlix Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress | NVD, CVE.org | |
| CVE-2026-118235 RCE | SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data | 9.8 CRITICAL | wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications | NVD, CVE.org | |
| CVE-2026-120070 Truy cập trái phép | User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter | 8.8 HIGH | wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | NVD, CVE.org | |
| CVE-2026-103898 Truy cập trái phép | Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback | 8.1 HIGH | roxnor Wp Social Login and Register Social Counter | NVD, CVE.org | |
| CVE-2026-116512 RCE | Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection | 9.8 CRITICAL | wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | NVD, CVE.org | |
| CVE-2026-119096 Truy cập trái phép | Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter | 9.8 CRITICAL | uncannyowl Uncanny Toolkit for LearnDash | NVD, CVE.org | |
| CVE-2026-104012 Truy cập trái phép | Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint | 8.8 HIGH | roxnor Rox Appointment Booking – Event, Calendar & Appointment Scheduling | NVD, CVE.org | |
| CVE-2026-116557 Truy cập trái phép | WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action | 9.1 CRITICAL | murgroland WP Booking System – Booking Calendar | NVD, CVE.org | |
| CVE-2026-109220 RCE | PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field | 9.8 CRITICAL | addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder | NVD, CVE.org | |
| CVE-2026-89270 Truy cập trái phép | Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters | 9.1 CRITICAL | popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups. | NVD, CVE.org | |
| CVE-2026-119977 RCE | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution | 8.1 HIGH | WordPress Foundation WordPress | NVD, CVE.org | |
| CVE-2026-110176 Truy cập trái phép | File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers | 8.7 HIGH | Drupal File Force Download | NVD, CVE.org | |
| CVE-2026-117656 Truy cập trái phép | Unverified Sign in with Apple callback parameter can override verified ID token claims | 9.3 CRITICAL | erlang/assent, pow-auth assent | NVD, OSV.dev | |
| GHSA-4xm8-rg9h-jhq2 RCE Lộ dữ liệu | Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | 9.8 CRITICAL | npm/signalk-server, npm/@signalk/resources-provider | GitHub Advisory, OSV.dev | |
| GHSA-hff9-5pqw-6w9f RCE | imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution | 9.8 CRITICAL | go/github.com/imgproxy/imgproxy/v3, go/github.com/imgproxy/imgproxy/v2 +1 | GitHub Advisory, OSV.dev | |
| CVE-2026-96633 | AdminNeo SQLite Database-List Drop Arbitrary File Deletion | 8.1 HIGH | composer/adminneo-org/adminneo | GitHub Advisory, OSV.dev | |
| CVE-2026-96631 Lộ dữ liệu | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 8.2 HIGH | composer/adminneo-org/adminneo | GitHub Advisory, OSV.dev | |
| CVE-2026-96632 | AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) | 8.2 HIGH | composer/adminneo-org/adminneo | GitHub Advisory, OSV.dev | |
| CVE-2026-63396 Truy cập trái phép | Coop has a data leak via unauthenticated GraphQL Query.allOrgs | 8.7 HIGH | roostorg coop | NVD, CVE.org | |
| CVE-2026-63339 Truy cập trái phép | IXP Manager has authenticated non-administrator privilege escalation | 8.8 HIGH | inex IXP-Manager | NVD, CVE.org | |
| CVE-2026-63338 Truy cập trái phép | IXP Manager has Broken Object-Level Authorization | 8.3 HIGH | inex IXP-Manager | NVD, CVE.org | |
| CVE-2026-63393 RCE | OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution | 8.7 HIGH | opensearch-project sql | NVD, CVE.org | |
| CVE-2026-63378 RCE | TAKO AI Agent for Okta: Authenticated Python execution through validator bypass | 8.8 HIGH | fctr-id okta-ai-agent | NVD, CVE.org | |
| CVE-2026-63377 Truy cập trái phép | TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover | 9.8 CRITICAL | fctr-id okta-ai-agent | NVD, CVE.org | |
| CVE-2026-63346 RCE | Refitter: C# source injection through OpenAPI header parameter names | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63344 RCE | Refitter: C# source injection through OpenAPI content-type map keys | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63345 RCE | Refitter: C# source injection through OpenAPI path keys | 8.6 HIGH | christianhelle refitter | NVD, CVE.org | |
| CVE-2026-63182 Truy cập trái phép | LightSAML: Signature reference wrapping permits unsigned assertion claims | 8.1 HIGH | litesaml lightsaml | NVD, CVE.org | |
| CVE-2026-118938 RCE | Fickling check_safety() bypass: dotted qualname in STACK_GLOBAL resolves a class-method attribute path that evades call analysis | 8.8 HIGH | trailofbits fickling | NVD, CVE.org | |
| CVE-2026-16760 RCE | Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables | 8.8 HIGH | trailofbits fickling | NVD, CVE.org | |
| CVE-2026-62990 Truy cập trái phép | Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation | 8.7 HIGH | shopperlabs shopper | NVD, CVE.org | |
| CVE-2026-62989 Truy cập trái phép | Shopper: missing variant-delete authorization permits destructive single and bulk actions | 8.1 HIGH | shopperlabs shopper | NVD, CVE.org | |
| CVE-2026-62979 Lộ dữ liệu | jack: upstream error responses expose backend and peer credentials | 8.4 HIGH | roziscoding jack | NVD, CVE.org |