Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-120201 Truy cập trái phép Lộ dữ liệu | Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header | 9.8 CRITICAL | dromara Jpom | NVD, CVE.org | |
| CVE-2026-76010 RCE Lộ dữ liệu | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal | 8.8 HIGH | smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | NVD, CVE.org | |
| CVE-2026-116086 RCE Lộ dữ liệu | Konflux-ci: jq filter injection in github workflow issue management | 8.8 HIGH | NVD, CVE.org | ||
| CVE-2026-114217 Lộ dữ liệu | Konflux-ci: github token plaintext exposure in ci/cd scripts | 8.6 HIGH | NVD, CVE.org | ||
| CVE-2026-103882 RCE Lộ dữ liệu | Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter | 9.1 CRITICAL | acadlix Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress | NVD, CVE.org | |
| GHSA-4xm8-rg9h-jhq2 RCE Lộ dữ liệu | Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution | 9.8 CRITICAL | npm/signalk-server, npm/@signalk/resources-provider | GitHub Advisory, OSV.dev | |
| CVE-2026-96631 Lộ dữ liệu | AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers | 8.2 HIGH | composer/adminneo-org/adminneo | GitHub Advisory, OSV.dev | |
| CVE-2026-62979 Lộ dữ liệu | jack: upstream error responses expose backend and peer credentials | 8.4 HIGH | roziscoding jack | NVD, CVE.org | |
| CVE-2026-62849 Lộ dữ liệu | ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection | 9.1 CRITICAL | mqttsnet thinglinks | NVD, CVE.org | |
| CVE-2026-61620 Lộ dữ liệu | HoneySQL unchecked entity names can lead to SQL injection results | 9.8 CRITICAL | seancorfield honeysql | NVD, CVE.org | |
| CVE-2026-116249 Lộ dữ liệu | pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory | 8.4 HIGH | pgadmin.org pgAdmin 4 | NVD, CVE.org | |
| CVE-2026-55598 Lộ dữ liệu | PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation) | 9.1 CRITICAL | madeofpendletonwool PinePods | NVD, CVE.org | |
| CVE-2026-62284 RCE Lộ dữ liệu | OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy | 8.6 HIGH | osac-project osac-operator | NVD, CVE.org | |
| CVE-2026-62331 Lộ dữ liệu | praktor: Telegram upload traversal permits persistent agent instruction injection | 8.2 HIGH | mtzanidakis praktor | NVD, CVE.org | |
| CVE-2026-61586 Lộ dữ liệu | Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider) | 8.2 HIGH | copernik-eu copernik-xml-factory | NVD, CVE.org | |
| CVE-2026-39732 Lộ dữ liệu | WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability | 9.3 CRITICAL | Ivijan-Stefan Stipic Transliterator | NVD, CVE.org | |
| CVE-2026-119979 Lộ dữ liệu | LM Studio before 0.4.22+1 Path Traversal via Model Downloader | 8.8 HIGH | Element Labs LM Studio | NVD, CVE.org | |
| CVE-2026-61826 Truy cập trái phép Lộ dữ liệu | Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery | 10.0 CRITICAL | morpheus65535 bazarr | NVD, CVE.org | |
| CVE-2026-61738 RCE Lộ dữ liệu | SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) | 10.0 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-61730 Truy cập trái phép Lộ dữ liệu | SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount | 9.3 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2025-68394 Lộ dữ liệu | SQL Injection in Protectel | 8.4 HIGH | ARKETEAM PROTECTELMAJ, ARKETEAM BDF | NVD, CVE.org | |
| CVE-2025-68393 Lộ dữ liệu | SQL Injection in Protectel | 8.4 HIGH | ARKETEAM PROTECTELMAJ, ARKETEAM BDF | NVD, CVE.org | |
| CVE-2026-119418 Lộ dữ liệu | CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() | 8.1 HIGH | cakephp cakephp | NVD, CVE.org | |
| CVE-2026-119419 Lộ dữ liệu | CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation | 8.1 HIGH | cakephp cakephp | NVD, CVE.org | |
| CVE-2026-14467 Lộ dữ liệu | Display of information in the Forocoches comments editor | 8.2 HIGH | Forocoches Forocoches comments editor | NVD, CVE.org | |
| CVE-2026-107239 RCE Lộ dữ liệu | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center ... | 8.8 HIGH | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-61654 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-61645 RCE Lộ dữ liệu | Docat has Arbitrary File Upload exists in Upload API | 9.1 CRITICAL | docat-org docat | NVD, CVE.org | |
| CVE-2026-13303 Lộ dữ liệu | Boundary vulnerable to server-side request forgery in Vault credential store | 8.7 HIGH | HashiCorp Boundary, HashiCorp Boundary Enterprise | NVD, CVE.org | |
| CVE-2026-61576 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-119145 RCE Lộ dữ liệu | Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload | 9.9 CRITICAL | frappe frappe | NVD, CVE.org | |
| CVE-2026-90866 RCE Lộ dữ liệu | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90864 RCE Lộ dữ liệu | Host Administrator Path Containment Bypass in Progress WS_FTP Server | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-61996 Lộ dữ liệu | WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability | 8.5 HIGH | favethemes MLS On The Fly | NVD, CVE.org | |
| CVE-2026-93570 Lộ dữ liệu | XML External Entity injection in Szafir and Szafir Weryfikująca | 8.2 HIGH | Krajowa Izba Rozliczeniowa Szafir, Krajowa Izba Rozliczeniowa Szafir Weryfikująca | NVD, CVE.org | |
| CVE-2026-115709 Lộ dữ liệu | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss | 8.2 HIGH | Elastic Elastic Cloud Enterprise | NVD, CVE.org | |
| CVE-2026-39736 Lộ dữ liệu | WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability | 8.5 HIGH | Crocoblock JetEngine | NVD, CVE.org | |
| CVE-2026-49142 Truy cập trái phép Lộ dữ liệu | OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] | 8.8 HIGH | openemr openemr | NVD, CVE.org | |
| RUSTSEC-2026-0427 Lộ dữ liệu | sn-releases: extract_release_archive writes archive entries without a path-traversal check (zip-slip) | 8.8 HIGH | rust/sn-releases | OSV.dev | |
| CVE-2026-115964 Lộ dữ liệu | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability | 9.3 CRITICAL | StylemixThemes Motors | NVD, CVE.org | |
| CVE-2026-115965 Lộ dữ liệu | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability | 8.5 HIGH | BuddyPress BuddyPress | NVD, CVE.org | |
| CVE-2026-114358 Lộ dữ liệu | SQL Injection Vulnerability in Radius Xenia M2M Platform | 9.3 CRITICAL | Radius Synergies Radius Xenia M2M Platform | NVD, CVE.org |