Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-120209 RCE Truy cập trái phép | AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token | 9.8 CRITICAL | anji-plus AJ-Report | NVD, CVE.org | |
| CVE-2026-120201 Truy cập trái phép Lộ dữ liệu | Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header | 9.8 CRITICAL | dromara Jpom | NVD, CVE.org | |
| CVE-2026-117681 Truy cập trái phép | Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone | 8.0 HIGH | NVD, CVE.org | ||
| CVE-2026-120070 Truy cập trái phép | User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter | 8.8 HIGH | wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | NVD, CVE.org | |
| CVE-2026-103898 Truy cập trái phép | Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback | 8.1 HIGH | roxnor Wp Social Login and Register Social Counter | NVD, CVE.org | |
| CVE-2026-119096 Truy cập trái phép | Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter | 9.8 CRITICAL | uncannyowl Uncanny Toolkit for LearnDash | NVD, CVE.org | |
| CVE-2026-104012 Truy cập trái phép | Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint | 8.8 HIGH | roxnor Rox Appointment Booking – Event, Calendar & Appointment Scheduling | NVD, CVE.org | |
| CVE-2026-116557 Truy cập trái phép | WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action | 9.1 CRITICAL | murgroland WP Booking System – Booking Calendar | NVD, CVE.org | |
| CVE-2026-89270 Truy cập trái phép | Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters | 9.1 CRITICAL | popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups. | NVD, CVE.org | |
| CVE-2026-110176 Truy cập trái phép | File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers | 8.7 HIGH | Drupal File Force Download | NVD, CVE.org | |
| CVE-2026-117656 Truy cập trái phép | Unverified Sign in with Apple callback parameter can override verified ID token claims | 9.3 CRITICAL | erlang/assent, pow-auth assent | NVD, OSV.dev | |
| CVE-2026-63396 Truy cập trái phép | Coop has a data leak via unauthenticated GraphQL Query.allOrgs | 8.7 HIGH | roostorg coop | NVD, CVE.org | |
| CVE-2026-63339 Truy cập trái phép | IXP Manager has authenticated non-administrator privilege escalation | 8.8 HIGH | inex IXP-Manager | NVD, CVE.org | |
| CVE-2026-63338 Truy cập trái phép | IXP Manager has Broken Object-Level Authorization | 8.3 HIGH | inex IXP-Manager | NVD, CVE.org | |
| CVE-2026-63377 Truy cập trái phép | TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover | 9.8 CRITICAL | fctr-id okta-ai-agent | NVD, CVE.org | |
| CVE-2026-63182 Truy cập trái phép | LightSAML: Signature reference wrapping permits unsigned assertion claims | 8.1 HIGH | litesaml lightsaml | NVD, CVE.org | |
| CVE-2026-62990 Truy cập trái phép | Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation | 8.7 HIGH | shopperlabs shopper | NVD, CVE.org | |
| CVE-2026-62989 Truy cập trái phép | Shopper: missing variant-delete authorization permits destructive single and bulk actions | 8.1 HIGH | shopperlabs shopper | NVD, CVE.org | |
| CVE-2026-62967 Truy cập trái phép | ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser | 8.1 HIGH | sinamics ztnet | NVD, CVE.org | |
| CVE-2026-62863 Truy cập trái phép | MoLing: unauthenticated SSE and wildcard CORS expose tool sessions | 9.6 CRITICAL | gojue moling | NVD, CVE.org | |
| CVE-2026-40573 Truy cập trái phép | NovumOS: Nova Interpreter Privilege Escalation | 8.6 HIGH | MinecAnton209 NovumOS | NVD, CVE.org | |
| CVE-2026-62847 Truy cập trái phép | Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS) | 8.2 HIGH | metalama Metalama | NVD, CVE.org | |
| CVE-2026-58412 Truy cập trái phép | Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow | 8.2 HIGH | filecoin-project filecoin-pin | NVD, CVE.org | |
| CVE-2026-116245 Truy cập trái phép | pgAdmin 4: Connection services are not restricted in server mode | 8.2 HIGH | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-116239 Truy cập trái phép | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username | 8.5 HIGH | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-116238 Truy cập trái phép | pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks | 8.1 HIGH | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-115829 Truy cập trái phép | Secret Server partial login bypass | 8.7 HIGH | Delinea Secret Server | NVD, CVE.org | |
| CVE-2026-115830 Truy cập trái phép | Secret Server JWT issuance error | 8.7 HIGH | Delinea Secret Server | NVD, CVE.org | |
| CVE-2026-61850 Truy cập trái phép | Kargo: Privilege escalation via Project RBAC management in the Kargo API | 9.3 CRITICAL | akuity kargo | NVD, CVE.org | |
| CVE-2026-62302 Truy cập trái phép | MyTube: Unauthenticated Media Access via Static Routes Bypassing Login | 8.7 HIGH | franklioxygen MyTube | NVD, CVE.org | |
| CVE-2026-78403 RCE Truy cập trái phép | Unauthenticated Stack Buffer Overflow in Sentinel Keys Server | 9.8 CRITICAL | Thalesgroup Sentinel Keys Server | NVD, CVE.org | |
| CVE-2026-118086 Truy cập trái phép | WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability | 8.8 HIGH | Hakan Ozevin WP BASE Booking | NVD, CVE.org | |
| CVE-2026-116386 Truy cập trái phép | WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability | 9.8 CRITICAL | Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications | NVD, CVE.org | |
| CVE-2026-62162 Truy cập trái phép | Hydra: Deposit Claim omits Head state-token spending requirement | 8.2 HIGH | cardano-scaling hydra | NVD, CVE.org | |
| CVE-2026-105894 Truy cập trái phép | Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update | 8.8 HIGH | akbilisim Ak Framework | NVD, CVE.org | |
| CVE-2025-8574 Truy cập trái phép | Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion | 8.7 HIGH | tigroumeow Database Cleaner: Cleanup, Optimization & Repair | NVD, CVE.org | |
| CVE-2026-61826 Truy cập trái phép Lộ dữ liệu | Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery | 10.0 CRITICAL | morpheus65535 bazarr | NVD, CVE.org | |
| CVE-2026-115642 Truy cập trái phép | In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restri... | 8.3 HIGH | OpenStack keystonemiddleware | NVD, CVE.org | |
| CVE-2026-119287 Truy cập trái phép | Zuke: Command-form registry descriptors bypass the MCP launch policy | 8.0 HIGH | zuke-build zuke | NVD, CVE.org | |
| CVE-2026-61737 Truy cập trái phép | ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin | 9.8 CRITICAL | huajian123 ng-antd-admin | NVD, CVE.org | |
| CVE-2026-45144 Truy cập trái phép | Chamilo LMS: Stored XSS in public user-profile fields | 8.9 HIGH | chamilo chamilo-lms | NVD, CVE.org | |
| CVE-2026-61730 Truy cập trái phép Lộ dữ liệu | SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount | 9.3 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-61729 Truy cập trái phép | SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection | 9.4 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-61728 Truy cập trái phép | SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover | 9.9 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-61708 Truy cập trái phép | SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user) | 8.5 HIGH | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-112905 Truy cập trái phép | Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft | 9.0 CRITICAL | givanz Vvveb | NVD, CVE.org | |
| CVE-2026-110799 Truy cập trái phép | Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover | 9.8 CRITICAL | givanz Vvveb | NVD, CVE.org | |
| CVE-2026-119662 Truy cập trái phép | Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend | 8.8 HIGH | songloft-org songloft | NVD, CVE.org | |
| CVE-2026-119660 Truy cập trái phép | MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key | 9.8 CRITICAL | yincongcyincong MuseBot | NVD, CVE.org | |
| CVE-2026-119654 Truy cập trái phép | DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization | 8.8 HIGH | devlive-community DataCap | NVD, CVE.org |