Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-61654 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-61645 RCE Lộ dữ liệu | Docat has Arbitrary File Upload exists in Upload API | 9.1 CRITICAL | docat-org docat | NVD, CVE.org | |
| CVE-2026-13303 Lộ dữ liệu | Boundary vulnerable to server-side request forgery in Vault credential store | 8.7 HIGH | HashiCorp Boundary, HashiCorp Boundary Enterprise | NVD, CVE.org | |
| CVE-2026-61576 Lộ dữ liệu | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key | 8.3 HIGH | lightdash lightdash | NVD, CVE.org | |
| CVE-2026-103093 RCE Truy cập trái phép | Sandbox Escape via Table Rotation in ServiceNow AI Platform | 9.4 CRITICAL | ServiceNow ServiceNow AI Platform | NVD, CVE.org | |
| CVE-2026-119168 Truy cập trái phép | Nomad allocation data migration may allow host directory permission modification via symlink following | 8.8 HIGH | HashiCorp Nomad, HashiCorp Nomad Enterprise | NVD, CVE.org | |
| CVE-2026-118769 RCE | Botan: Integer overflow when reporting block size in FFI can cause memory corruption | 9.2 CRITICAL | randombit botan | NVD, CVE.org | |
| CVE-2023-7357 RCE | FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability | 8.6 HIGH | Revera FlexNet Publisher | NVD, CVE.org | |
| CVE-2026-119115 Truy cập trái phép | Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes | 8.5 HIGH | AWS aws-privateca-issuer | NVD, CVE.org | |
| GHSA-w9x9-j56r-h98r Truy cập trái phép | @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy | 8.2 HIGH | npm/@eeacms/volto-chatbot | GitHub Advisory, OSV.dev | |
| CVE-2026-119145 RCE Lộ dữ liệu | Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload | 9.9 CRITICAL | frappe frappe | NVD, CVE.org | |
| CVE-2026-119144 RCE | Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields | 8.8 HIGH | frappe frappe | NVD, CVE.org | |
| CVE-2026-119129 Truy cập trái phép | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval | 8.1 HIGH | zitadel zitadel | NVD, CVE.org | |
| CVE-2026-119127 Truy cập trái phép | ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection | 8.1 HIGH | zitadel zitadel | NVD, CVE.org | |
| CVE-2026-90868 RCE | OS Command Injection in Progress WS_FTP Server | 9.9 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90867 Truy cập trái phép | Improper Access Control of Web Admin Console in Progress WS_FTP Server | 8.1 HIGH | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90866 RCE Lộ dữ liệu | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90865 RCE | Command Injection via FTP Notification Variables in Progress WS_FTP Server | 9.0 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90864 RCE Lộ dữ liệu | Host Administrator Path Containment Bypass in Progress WS_FTP Server | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-90863 RCE Truy cập trái phép | Privilege Escalation via Missing Authorization in WS_FTP Manager | 9.1 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-84295 Truy cập trái phép | Improper Authentication in Progress WS_FTP Server | 10.0 CRITICAL | Progress Software WS_FTP Server | NVD, CVE.org | |
| CVE-2026-111732 RCE | Out-of-bounds write when parsing AR Vendor Block requests | 9.3 CRITICAL | RT-Labs P-Net | NVD, CVE.org | |
| CVE-2026-118082 Truy cập trái phép | WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability | 8.8 HIGH | BuddyBoss Buddyboss Platform | NVD, CVE.org | |
| CVE-2026-118080 RCE | WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability | 8.8 HIGH | Social Snap Social Snap | NVD, CVE.org | |
| CVE-2026-118081 RCE | WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability | 8.8 HIGH | 10Web 10Web Social Photo Feed | NVD, CVE.org | |
| CVE-2026-118076 RCE | WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability | 8.8 HIGH | Frisbii Frisbii Pay | NVD, CVE.org | |
| CVE-2026-118075 RCE | WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability | 8.8 HIGH | dbarrere WP Media folders | NVD, CVE.org | |
| CVE-2026-118073 RCE | WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability | 8.8 HIGH | blazethemes News Kit Elementor Addons | NVD, CVE.org | |
| CVE-2026-116868 RCE | WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability | 8.8 HIGH | BuddyDev BuddyPress Xprofile Custom Field Types | NVD, CVE.org | |
| CVE-2026-116867 RCE | WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability | 8.8 HIGH | sosidee Dynamic QR Code – generator | NVD, CVE.org | |
| CVE-2026-116866 RCE | WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability | 8.8 HIGH | Dotstore Extra Fees Plugin for WooCommerce | NVD, CVE.org | |
| CVE-2026-62018 RCE | WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Gunslinger | NVD, CVE.org | |
| CVE-2026-62131 RCE | WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability | 9.8 CRITICAL | Zoho Flow Zoho Flow | NVD, CVE.org | |
| CVE-2026-62017 RCE | WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Good Homes | NVD, CVE.org | |
| CVE-2026-62016 RCE | WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Gamic | NVD, CVE.org | |
| CVE-2026-62014 RCE | WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX EmojiNation | NVD, CVE.org | |
| CVE-2026-62015 RCE | WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Gamezone | NVD, CVE.org | |
| CVE-2026-62013 RCE | WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Edge Decor | NVD, CVE.org | |
| CVE-2026-62012 RCE | WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Coinpress | NVD, CVE.org | |
| CVE-2026-62010 RCE | WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Avventure | NVD, CVE.org | |
| CVE-2026-62011 RCE | WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Bonbon | NVD, CVE.org | |
| CVE-2026-62009 RCE | WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Filmax | NVD, CVE.org | |
| CVE-2026-62008 RCE | WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Orpheus | NVD, CVE.org | |
| CVE-2026-62005 RCE | WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Muzicon | NVD, CVE.org | |
| CVE-2026-62006 RCE | WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Nuts | NVD, CVE.org | |
| CVE-2026-62004 RCE | WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Motorix | NVD, CVE.org | |
| CVE-2026-62003 RCE | WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Mission | NVD, CVE.org | |
| CVE-2026-62001 RCE | WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Marcell | NVD, CVE.org | |
| CVE-2026-62002 RCE | WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Meals & Wheels | NVD, CVE.org | |
| CVE-2026-61998 RCE | WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Le Truffe | NVD, CVE.org |