Latest Vulnerability Intelligence RSS - BiuPoC

CVE-2022-27925: Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal

Thu, 08 Oct 2026 00:00:00 +0000

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

CVE-2026-0692: BlueSnap Payment Gateway for WooCommerce <=3.4.0 - IPN Authorization Bypass

Thu, 08 Oct 2026 00:00:00 +0000

BlueSnap Payment Gateway for WooCommerce <= 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This detector supplies a generated, non-existent transaction ID, so the vulnerable code reaches the order lookup and returns `Order could not be found` without changing an order.

CVE-2026-10818: WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload

Thu, 08 Oct 2026 00:00:00 +0000

WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content/uploads/wpforms/tmp/ before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.

CVE-2026-21589: Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read

Thu, 08 Oct 2026 00:00:00 +0000

Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.

CVE-2026-26216: Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter

Thu, 08 Oct 2026 00:00:00 +0000

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.

CVE-2026-29058: WWBN AVideo Encoder < 7.0 - Unauthenticated OS Command Injection

Thu, 08 Oct 2026 00:00:00 +0000

AVideo < 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication.

CVE-2026-40281: Gotenberg <= 8.30.1 - Remote Code Execution

Thu, 08 Oct 2026 00:00:00 +0000

Gotenberg through 8.30.1 sanitizes only the keys of the JSON metadata submitted to the PDF metadata write endpoint, leaving the values unvalidated. A newline inside a metadata value is written straight to the ExifTool process standard input, where it terminates the current argument and starts a new one, letting an unauthenticated attacker inject arbitrary ExifTool arguments and execute operating system commands through an advanced formatting expression.

CVE-2026-49468: LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass

Thu, 08 Oct 2026 00:00:00 +0000

LiteLLM Proxy before 1.84.0 derives its public-route authorization check from a URL reconstructed with the unvalidated Host header. A Host value containing a fragment can make a protected request appear to target the public root route, bypassing the API-key check. Version 1.84.0 derives the route from the raw ASGI path instead.

CVE-2026-55552: Yamcs <=5.11.12 - Arbitrary File Read

Thu, 08 Oct 2026 00:00:00 +0000

Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handler returns the referenced file from the underlying host, letting unauthenticated attackers read any non-hidden file readable by the Yamcs service account whose path contains no dot segment.

CVE-2026-86242: Bifrost < 1.6.3 - Unauthenticated Remote Plugin URL Fetch

Thu, 08 Oct 2026 00:00:00 +0000

When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin with an HTTP URL as its path. The gateway fetches the URL before attempting to load it. This template confirms the unauthenticated server-side request with an out-of-band callback; it does not assert code execution on statically linked builds.

serverless-framework-config-exposure: Serverless Framework - Configuration Exposure

Thu, 08 Oct 2026 00:00:00 +0000

A Serverless Framework configuration file (serverless.yml) was found exposed on the web server. The file describes the service, cloud provider, functions and often provider level environment variables, IAM statements and plugin settings, which can disclose the application architecture and occasionally hardcoded secrets to an unauthenticated visitor.

terraformrc-credentials-exposure: Terraform CLI Configuration - Credentials Exposure

Thu, 08 Oct 2026 00:00:00 +0000

A Terraform CLI configuration file (.terraformrc or terraform.rc) containing a credentials block was found exposed. This file stores API tokens used to authenticate the Terraform CLI to remote backends such as Terraform Cloud or Terraform Enterprise, so exposure can leak a valid token that grants access to remote state and workspaces.

terraform-tfstate-exposure: Terraform State - File Exposure

Thu, 08 Oct 2026 00:00:00 +0000

A Terraform state file was found exposed on the web server. State files map real world infrastructure to configuration and frequently store resource attributes such as passwords, private keys, database connection strings and access tokens in clear text, so public exposure can leak sensitive credentials for the managed infrastructure.

天健智能ERP系统data.xml存在敏感信息泄露

Thu, 08 Oct 2026 00:00:00 +0000

ERP企业资源计划系统data.xml存在敏感信息泄露，攻击者可以利用此漏洞获取数据库账号密码。

天健智能ERP系统EmpModel.ashx存在SQL注入漏洞

Thu, 08 Oct 2026 00:00:00 +0000

天健智能ERP系统EmpModel.ashx存在SQL注入漏洞，攻击者可以利用此漏洞获取数据库敏感数据。

天健智能ERP系统存在任意文件读取漏洞

Thu, 08 Oct 2026 00:00:00 +0000

天健智能ERP系统存在任意文件读取漏洞，攻击者可以利用此漏洞获取服务敏感配置文件源码等。

畅捷通 T+ GetAnonymousTPlusToken 接口SQL注入漏洞

Wed, 07 Oct 2026 00:00:00 +0000

攻击者通过GetAnonymousTPlusToken接口构造相关payload，进一步利用，可能会导致SQL注入。

月子会所ERP管理云平台存在任意文件读取漏洞

Wed, 07 Oct 2026 00:00:00 +0000

武汉金同方科技有限公司月子会所ERP管理云平台存在任意文件读取漏洞，攻击者可以利用该漏洞获取服务器敏感信息。

月子会所ERP管理云平台GetData.ashx clientid参数存在SQL注入漏洞

Mon, 05 Oct 2026 00:00:00 +0000

武汉金同方科技有限公司月子会所ERP管理云平台存在SQL注入漏洞，攻击者可以利用该漏洞获取数据库敏感信息。

鼎新數智｜EasyFlow .NET - 存在5個漏洞

Wed, 30 Sep 2026 00:00:00 +0000

【CVE-2026-102455(Insecure Deserialization)】未經身分鑑別之遠端攻擊者可透過發送惡意序列化內容於伺服器端執行任意程式碼。【CVE-2026-102456(SQL Injection)】已通過身分鑑別之遠端攻擊者可注入任意SQL指令讀取資料庫內容。【CVE-2026-102457(Arbitrary File Read)】已通過身分鑑別之遠端攻擊者可利用此漏洞下載任意系統檔案。【CVE-2026-102458(Missing Authentication)】未經身分鑑別之遠端攻擊者可透過特定API取得其他使用者之明文密碼。【CVE-2026-102459(Reflected Cross-site Scripting)】未經身分鑑別之遠端攻擊者可利用釣魚攻擊於使用者端瀏覽器執行任意JavaScript程式碼。

用友时空KSOA /vote/joinvoting.jsp SQL 注入漏洞

Tue, 29 Sep 2026 00:00:00 +0000

用友时空KSOA是用友网络科技股份有限公司推出的协同办公与企业管理平台，面向企业组织提供知识管理、流程协作、投票调查、论坛交流、通讯录等办公自动化能力，帮助企业实现信息共享和业务协同。用友时空KSOA /vote/joinvoting.jsp 接口存在SQL注入漏洞，攻击者可获取数据库敏感信息。

用友政务系统 /ma/api/selectMaEmpByOrgCode 未授权访问漏洞

Tue, 29 Sep 2026 00:00:00 +0000

用友政务系统是用友公司面向政府机构和事业单位开发的一体化政务管理平台，涵盖预算管理、财务管理、人力资源、资产管理等多个业务模块，广泛应用于各级政府部门和公共组织。该系统采用B/S架构，支持多级组织管理、工作流程自动化、数据统计分析等功能。其 /ma/api/selectMaEmpByOrgCode 接口存在未授权访问漏洞，未认证攻击者可直接调用该接口查询员工与组织信息，获取员工姓名、联系方式、组织架构等敏感数据，造成企业人员信息泄露。

Apache Cocoon /xmlui/themes/Mirage2 目录遍历漏洞

Tue, 29 Sep 2026 00:00:00 +0000

Apache Cocoon 是基于 Java 的 Web 开发框架，提供 XML 发布与内容聚合能力，常用于 XML/发布型站点（如 DSpace 的门户前端）。其静态资源映射对图片目录的路径跳转缺乏有效校验，未认证攻击者可构造跨目录路径读取服务器上的 package-lock.json 等文件，泄露项目依赖结构与内部路径信息，造成信息泄露。

中科商软云连ERP /admin/session!ajaxList.action 未授权访问漏洞

Tue, 29 Sep 2026 00:00:00 +0000

中科商软云连ERP是中科商软推出的企业资源计划管理系统，提供采购、销售、仓储、供应链等企业管理与电商业务能力，广泛应用于贸易与零售流通行业。其 /admin/session!ajaxList.action 后台接口存在未授权访问漏洞，未认证攻击者可直接调用该后台接口，获取管理员会话列表等敏感后台数据，造成会话凭据泄露并为后续接管后台提供条件。

ZKTeco-百傲瑞达安防管理系统平台 /authLicenseAction!getLicenseInfo.do 代码执行漏洞

Tue, 29 Sep 2026 00:00:00 +0000

ZKTeco 百傲瑞达安防管理系统平台是 ZKTeco 推出的门禁安防综合管理平台，提供门禁控制、人员权限管理与安防设备统一管理能力，广泛应用于园区、楼宇与政企安防场景。其 2.3.15 及之前版本的 /authLicenseAction!getLicenseInfo.do 接口在调试处理流程中对提交的表达式缺少安全限制，未认证攻击者可提交可控 OGNL 表达式触发表达式注入，并扩大为服务端代码执行，完全控制目标服务器。公开复现材料完整，厂商未发布官方安全公告。

CRMEB /api/remote_register 权限绕过漏洞

Tue, 29 Sep 2026 00:00:00 +0000

CRMEB 是一套基于 PHP 的开源电商零售分销管理系统，提供商城、分销、多商户等零售电商能力，广泛应用于电商零售场景。其 /api/remote_register 登录注册接口存在未授权访问缺陷，攻击者无需有效凭据即可调用该接口，在已知用户标识存在时修改其积分信息并获取可用的会话令牌，实现对目标账号的越权接管。漏洞影响 v5.4.0、v5.6.1、v5.6.3.1、v6.0.0 等版本，PoC/EXP 与在野利用均已公开。

鼎游票务系统 /saleVersionUpdate.jsp 文件读取漏洞

Tue, 29 Sep 2026 00:00:00 +0000

鼎游票务系统是一款面向旅游行业的票务销售与管理业务系统，提供门票销售、订单管理、景区检票等业务功能，广泛应用于景区、场馆等旅游场景。其 /saleVersionUpdate.jsp 接口存在文件读取漏洞，攻击者可构造特殊请求读取服务器上的任意文件，获取系统配置、数据库凭据等敏感信息，进而可能进一步控制服务器。

Flowise /api/v1/chatflows 未授权访问漏洞

Tue, 29 Sep 2026 00:00:00 +0000

Flowise 是 FlowiseAI 开发的开源低代码 LLM 应用构建平台（GitHub 约 55k star），提供拖拽式可视化编排、聊天流（Chatflow）管理与大模型集成能力，广泛用于企业 AI 应用与智能体搭建场景。其 /api/v1/chatflows 接口在未启用认证的部署中可被未授权访问，接口直接返回包含聊天流配置（flowData）与部署状态（deployed）的 JSON 列表，泄露可视化 LLM 聊天流定义、组件节点、模型与集成配置及内部命名等信息，并可为后续攻击提供侦察基础。

Langflow /api/v1/flows/ 未授权访问漏洞

Tue, 29 Sep 2026 00:00:00 +0000

Langflow 是 DataStax/IBM 体系下的开源低代码 AI 工作流与智能体构建平台（GitHub 约 154k star），提供可视化工作流编排、组件节点管理与大模型应用集成能力，广泛用于企业 AI 应用与智能体搭建场景。其 /api/v1/flows/ 接口在未启用认证的部署中可被未授权访问，接口直接返回全部工作流定义的 JSON 数据，泄露工作流结构、组件节点与模型集成配置等敏感信息，并可为后续攻击提供侦察基础。

QAnything /api/local_doc_qa/upload_files 文件上传漏洞（CVE-2026-88533）

Tue, 29 Sep 2026 00:00:00 +0000

QAnything是网易有道开源的企业级知识库问答与检索增强（RAG）平台，支持多格式文档导入、向量检索与大模型问答，广泛应用于企业知识管理、智能客服与内部检索场景。QAnything /api/local_doc_qa/upload_files 接口存在文件上传漏洞，攻击者可未经身份验证在服务进程权限允许的任意路径创建新文件，读取设备配置与账号凭据等敏感信息，并可进一步实现远程代码执行。

Apache Kafka UI /smartfilters/testexecutions 代码执行漏洞（CVE-2026-78166）

Tue, 29 Sep 2026 00:00:00 +0000

Apache Kafka UI是一款开源的 Apache Kafka 集群可视化管理与监控面板。其 /api/smartfilters/testexecutions 接口在处理用户提交的 JSON 数据时，未对 filterCode 字段的内容进行充分的过滤与沙箱隔离，导致存在远程代码执行（RCE）漏洞。攻击者通过构造恶意的 Groovy 表达式，即可在目标服务器上以 Web 服务进程权限执行任意系统命令。该漏洞利用难度极低、危害性极高，成功利用可导致服务器被完全控制、敏感数据泄露或被用作内网横向移动的跳板。

用友NC /ebvp/infopub/showcontent SQL 注入漏洞

Tue, 29 Sep 2026 00:00:00 +0000

用友NC（Yonyou NC）是用友网络科技股份有限公司面向大型企业集团推出的企业级 ERP 管理平台，是大型企业数字化转型的首选平台。该产品采用多层架构设计，涵盖财务管理、供应链管理、人力资源管理、资产管理等核心业务模块，支持多组织、多账簿、多币种的复杂业务场景，广泛应用于制造、能源、交通、金融等国民经济重点行业。用友NC /ebvp/infopub/showcontent 接口存在 SQL 注入漏洞，攻击者可获取数据库敏感信息，在数据库连接用户具备高权限时可能进一步获取服务器控制权限。

Netbox-Docker /api/status/ 默认口令漏洞（CVE-2023-27573）

Tue, 29 Sep 2026 00:00:00 +0000

Netbox-Docker 是 NetBox 网络资源管理系统的官方 Docker 部署项目。其 2.5.0 之前版本为超级用户账户（admin）与 API Token 设置硬编码默认值且不强制修改，保留默认值的部署实例可被攻击者以超级管理员权限直接接管。

Xboot /xboot/common/swagger/login 服务器端请求伪造漏洞

Tue, 29 Sep 2026 00:00:00 +0000

XBoot是基于Spring Boot 2.x的一站式前后端分离快速开发平台。XBoot /xboot/common/swagger/login 接口存在服务器端请求伪造漏洞，攻击者可构造恶意请求使服务器向任意地址发起HTTP请求并回显响应，探测和利用目标内网服务。

CVE-2024-57728: SimpleHelp <= 5.5.7 - Arbitrary File Upload

Mon, 28 Sep 2026 00:00:00 +0000

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. This template is a version-based check: it reads the version banner exposed by the vendor's own /allversions page and flags branches that predate the January 2025 fixes.

CVE-2025-11452: Asgaros Forum < 3.2.0 - SQL Injection

Mon, 28 Sep 2026 00:00:00 +0000

Asgaros Forum for WordPress versions prior to 3.2.0 is vulnerable to unauthenticated SQL injection through the asgarosforum_unread_exclude cookie. The cookie is JSON-decoded and its object keys are imploded into a NOT IN() clause without sanitisation. The vulnerable query only runs while rendering the forum page, so the payload must be sent there rather than to the site root.

CVE-2025-34033: Blue Angel Software Suite (5V Technologies) - OS Command Injection

Mon, 28 Sep 2026 00:00:00 +0000

Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter (ATA) and Voice over IP (VoIP) devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the ping_addr parameter to webctrl.cgi?action=pingtest_update.

CVE-2025-62593: Ray < 2.52.0 - Remote Code Execution

Mon, 28 Sep 2026 00:00:00 +0000

Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic (rejecting Mozilla-prefixed headers) can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable.

CVE-2025-68273: Signal K Server <= 2.18.0 - Information Disclosure

Mon, 28 Sep 2026 00:00:00 +0000

Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the full Signal K data schema, the list of connected serial devices, and whether traffic analyzer tools are installed. This template fingerprints the server via the public /signalk discovery endpoint and flags builds older than the fixed 2.19.0 release.

CVE-2026-12227: Visual Composer <= 45.16.0 - Unauthenticated LFI

Mon, 28 Sep 2026 00:00:00 +0000

Visual Composer Website Builder for WordPress <= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.

CVE-2026-25703: NeuVector - Information Disclosure

Mon, 28 Sep 2026 00:00:00 +0000

NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges.

CVE-2026-56681: 9router <=0.5.4 - Authentication Bypass

Mon, 28 Sep 2026 00:00:00 +0000

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation.

CVE-2026-61560: GitLab MCP Server < 2.1.27 - Unauthenticated SSE Transport Access

Mon, 28 Sep 2026 00:00:00 +0000

The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including upload_markdown, which reads arbitrary files from the server filesystem via an unsanitized file_path parameter.

CVE-2026-87902: WordPress Core - PHP Template Path Traversal

Mon, 28 Sep 2026 00:00:00 +0000

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

CVE-2026-89013: Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter

Mon, 28 Sep 2026 00:00:00 +0000

Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp value. This bypass allows unauthenticated remote attackers to read arbitrary files from all Dolibarr managed directories including logs, SQL database backups, invoices, contracts, user vcards, and custom module sources.

CVE-2026-89063: Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access

Mon, 28 Sep 2026 00:00:00 +0000

Bookly WordPress plugin <= 28.1 contains an insecure direct object reference caused by missing validation on 'conversation_id' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication.

mcp-streamable-http-exposure: MCP Streamable HTTP Server - Unauthenticated Initialize

Mon, 28 Sep 2026 00:00:00 +0000

Detects a Model Context Protocol server exposing the Streamable HTTP transport that completes the JSON-RPC 2.0 `initialize` handshake without any credentials. The MCP lifecycle requires `initialize` to be the first interaction on a connection, and a spec-compliant server answers it with an InitializeResult carrying `protocolVersion`, `capabilities` and `serverInfo`. Receiving that result from an unauthenticated POST shows the endpoint performs no authorization before entering the operation phase, so any caller can go on to enumerate and invoke the tools, resources and prompts the server exposes.

关于U9 cloud存在命令执行漏洞的安全通告

Thu, 24 Sep 2026 00:00:00 +0000

U9团队在获知命令执行漏洞后第一时间组织团队进行应急响应，分析接口带来的漏洞问题，现已修复。

关于U9 cloud存在接口反序列化漏洞的安全通告

Thu, 24 Sep 2026 00:00:00 +0000

U9团队在获知接口反序列化漏洞后第一时间组织团队进行应急响应，分析接口带来的漏洞问题，并针对该漏洞规避可能引起的其他漏洞如代码执行、信息泄露和数据库提权等；现已修复以上漏洞。

浪潮GS7前台SQL注入漏洞

Thu, 24 Sep 2026 00:00:00 +0000

浪潮GS7参数过滤不严，攻击者可直接执行sql注入

致远互联分析云 DownloadFile 接口存在任意文件读取漏洞

Thu, 24 Sep 2026 00:00:00 +0000

致远互联分析云 DownloadFile 接口存在任意文件读取漏洞，攻击者可以利用该漏洞获取服务器敏感信息。

融易網路｜GPM LIGHT - Sensitive Data Exposure

Thu, 24 Sep 2026 00:00:00 +0000

融易網路開發之GPM LIGHT存在Sensitive Data Exposure漏洞，未經身分鑑別之遠端攻擊者可直接存取系統日誌。

银河麒麟桌面操作系统权限提升漏洞

Wed, 23 Sep 2026 15:10:48 +0000

银河麒麟桌面操作系统是麒麟软件面向政务、企业和行业终端提供的国产桌面系统，承担日常办公、身份认证和系统服务运行。该系统存在权限提升漏洞，攻击者可获取系统控制权。提权后可能读取敏感文件、关闭安全防护，或在终端植入持久化。厂商已发布漏洞修复程序，请通过麒麟软件官方渠道获取更新。

达梦新云缓存数据库二进制漏洞

Wed, 23 Sep 2026 15:10:47 +0000

达梦新云缓存数据库（DMCDM）是武汉达梦数据库股份有限公司推出的 Key-Value 数据库，深度兼容 Redis 协议，常用于缓存、会话和高速数据访问。该产品存在二进制漏洞，攻击者可导致拒绝服务，造成进程异常或服务中断。缓存中断会导致会话丢失、页面变慢以及依赖该缓存的业务不可用。厂商已发布漏洞修复程序，请通过达梦官方渠道获取更新。

山石网科下一代防火墙SG-6000弱口令漏洞

Wed, 23 Sep 2026 15:10:47 +0000

山石网科下一代防火墙 SG-6000 用于访问控制、入侵防御、应用识别和边界防护，通常部署在数据中心或园区网出口。该设备存在弱口令漏洞，攻击者可登录后台管理系统。后台失守后，可能修改放行规则、关闭防护、窃取证书，或将防火墙作为进入内网的跳板。

统信UOS操作系统本地提权漏洞

Wed, 23 Sep 2026 15:10:47 +0000

统信 UOS 桌面专业版用于国产化办公和行业终端，承担日常办公、身份认证、外设管理和系统服务运行。该系统存在本地提权漏洞，已能访问终端的攻击者可突破原有权限边界，获得更高系统权限。提权后可能读取办公文档和凭据、关闭安全软件，或在终端植入持久化。

天融信上网行为管理系统命令执行漏洞

Wed, 23 Sep 2026 15:10:46 +0000

天融信上网行为管理系统部署在网络出口或关键链路，用于访问控制、行为审计、流量管理和安全策略执行。该系统存在命令执行漏洞，攻击者可在设备上执行任意命令。由于设备位于网络关键路径，命令执行成功后可能篡改上网策略、破坏审计能力、劫持流量，或将设备作为进入内网的跳板。

南大通用GBase 8c二进制漏洞

Wed, 23 Sep 2026 15:10:46 +0000

GBase 8c 是天津南大通用数据技术股份有限公司推出的分析型数据库，用于数据存储、查询和统计分析。GBase 8c 存在多个二进制漏洞，攻击者可利用这些缺陷造成拒绝服务，使数据库进程异常退出或无法继续提供查询。服务中断会影响报表查询、监管统计以及依赖该库的业务系统。

SISCO MMSLite MMS协议字段拒绝服务漏洞

Wed, 23 Sep 2026 15:10:46 +0000

MMSLite 是美国 SISCO 公司基于 IEC 61850 标准开发的通讯组件库，用于智能电子设备的 MMS 协议交互。SISCO MMS 协议某字段存在拒绝服务漏洞。向采用 MMSLite 开发的设备发送 MMS-Write 服务中某个字段 Length 值为 0 的畸形报文后，可导致设备 MMS 模块崩溃，MMS 协议对应 102 端口无法连通。102 端口中断后，主站将无法继续通过 MMS 采集数据或下发控制指令。该问题已由 CNVD 向厂商通报。

SISCO MMSLite MMS协议OSI层拒绝服务漏洞

Wed, 23 Sep 2026 15:10:45 +0000

MMSLite 是美国 SISCO 公司基于变电站通信 IEC 61850 标准开发的通讯组件库，用于远程终端单元 RTU、保护装置、可编程逻辑控制器 PLC 等智能电子设备的 MMS 协议解析与交互。SISCO MMSLite 的 MMS 协议 OSI 层存在拒绝服务漏洞。攻击者向采用该套件开发的设备发送恶意构造的协议数据后，可造成设备通信异常或服务中断，影响站内监控采集和控制指令下发。相关设备的 MMS 服务应限制在可信工控或站内网络中使用。

统信操作系统拒绝服务漏洞

Wed, 23 Sep 2026 15:10:45 +0000

统信操作系统用于政务、企业和行业桌面终端，承担日常办公、身份认证、软件分发和系统服务运行。该系统存在拒绝服务漏洞。攻击者触发该缺陷后，可造成系统服务异常、系统重启或业务中断，使终端无法持续提供桌面服务。由于操作系统位于终端底层，拒绝服务会导致用户会话中断、本地应用不可用，并影响依赖该终端的办公流程。

统信桌面操作系统任意文件写入漏洞

Wed, 23 Sep 2026 15:10:34 +0000

统信桌面操作系统是统信软件面向政务、企业和行业终端提供的国产桌面系统，其中 uos-service-support 负责本地服务协同以及与桌面环境相关的文件和配置处理，通常以较高权限运行。该系统存在任意文件写入漏洞。攻击者在能够触发该缺陷时，可向非预期路径写入或覆盖文件，破坏系统完整性，并可能进一步用于篡改配置、破坏安全策略或为本地提权创造条件。写入一旦成功，可能覆盖系统配置、服务脚本、授权文件或业务数据，导致终端不可用或敏感配置被篡改。

CVE-2026-49060: Hippoo Mobile App for WooCommerce - Broken Access Control

Wed, 23 Sep 2026 00:00:00 +0000

Hippoo Mobile App for WooCommerce <= 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.

CVE-2026-58467: Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion

Wed, 23 Sep 2026 00:00:00 +0000

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.

CVE-2026-6639: AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure

Wed, 23 Sep 2026 00:00:00 +0000

AIWU AI Chatbot & Workflow Automation WordPress plugin <= 1.4.6 contains a sensitive information exposure caused by unauthenticated access to getCurrentTaskResults() method, letting unauthenticated attackers retrieve API keys and configuration data, exploit requires no authentication.

CVE-2026-80099: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret

Wed, 23 Sep 2026 00:00:00 +0000

Newfold Digital WordPress plugins bundling wp-module-data <=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.

oidc-signing-alg-none-supported: OpenID Connect - Unsigned (alg none) ID Token Supported

Wed, 23 Sep 2026 00:00:00 +0000

The OpenID Connect discovery document advertises "none" among its id_token_signing_alg_values_supported, meaning the authorization server is willing to issue ID tokens with no signature. A relying party that accepts such a token cannot verify its integrity, enabling JWT "alg:none" forgery and authentication bypass. The "none" algorithm should never be offered for ID tokens in production.

powerdns-monitor-exposure: PowerDNS Authoritative Server Monitor - Unauthenticated Exposure

Wed, 23 Sep 2026 00:00:00 +0000

Exposed PowerDNS Authoritative Server monitor allows unauthenticated access to operational stats, aiding reconnaissance but not zone takeover.

qdrant-telemetry-exposure: Qdrant - Telemetry Exposure

Wed, 23 Sep 2026 00:00:00 +0000

Qdrant ships with no API key configured. When service.api_key is unset, the internal /telemetry endpoint answers unauthenticated requests and returns the instance UUID, the running Qdrant version, the number of collections, the cluster configuration, and per-endpoint REST and gRPC request statistics. Reaching this endpoint without a credential also proves that no API key is enforced on the instance at all, since Qdrant gates /telemetry behind the same key as the rest of its REST API.

关于NC系统的文件控制台SQL注入漏洞的安全通告

Wed, 23 Sep 2026 00:00:00 +0000

NC系统存在文件控制台的sql注入漏洞，存在窃取服务器敏感信息的风险。

全景軟體｜CGServiSign - OS Command Injection

Wed, 23 Sep 2026 00:00:00 +0000

关于U8+渠道管理(高级版)存在sql注入漏洞的公告

Mon, 21 Sep 2026 00:00:00 +0000

U8+渠道管理(高级版)存在sql注入漏洞，攻击者可通过此漏洞获取服务器敏感信息。

CVE-2021-42392: H2 Database Console - JNDI Injection RCE

Mon, 21 Sep 2026 00:00:00 +0000

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution via the H2 web console (versions before 2.0.206 / 1.4.198 with the console enabled).

CVE-2026-13153: Essential Blocks < 6.4.0 - Information Disclosure

Mon, 21 Sep 2026 00:00:00 +0000

Gutenberg Essential Blocks WordPress plugin < 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data.

CVE-2026-1340: Ivanti EPMM < 12.8.0.0 - Remote Code Execution

Mon, 21 Sep 2026 00:00:00 +0000

Ivanti Endpoint Manager Mobile contains a code injection vulnerability allowing unauthenticated attackers to execute arbitrary code remotely, exploit requires no authentication.

CVE-2026-42018: JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass

Mon, 21 Sep 2026 00:00:00 +0000

JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled.

CVE-2026-55549: Yamcs <=5.8.6 - Cross-Site Scripting

Mon, 21 Sep 2026 00:00:00 +0000

Yamcs < 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.

CVE-2026-69085: SiYuan <=3.7.2 - SQL Injection

Mon, 21 Sep 2026 00:00:00 +0000

SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content.

CVE-2026-82456: argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access

Mon, 21 Sep 2026 00:00:00 +0000

argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token.

CVE-2026-84434: WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload

Mon, 21 Sep 2026 00:00:00 +0000

Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.

CVE-2026-85688: TEN Framework - Arbitrary File Read & Write

Mon, 21 Sep 2026 00:00:00 +0000

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication.

CVE-2026-86218: N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution

Mon, 21 Sep 2026 00:00:00 +0000

N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection (CWE-96). An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every managed endpoint under the platform's control. Huntress confirmed active in-the-wild exploitation. N-able's hosted (NCOD) instances were automatically patched, on-premises deployments require manual upgrade to 2026.3.1.14. The N-central build version is exposed pre-authentication in the login page JavaScript object (ncentralVersion), enabling reliable version-based detection.

CVE-2026-9103: Langflow OSS - Superuser Token Issuance

Mon, 21 Sep 2026 00:00:00 +0000

Langflow OSS with default AUTO_LOGIN exposes `/api/v1/auto_login`, which returns a superuser access token to any unauthenticated request.

http-etcd-unauthenticated-api-v3: etcd v3 Unauthenticated API

Mon, 21 Sep 2026 00:00:00 +0000

etcd's v3 API is reachable and authentication is disabled or not configured. With auth disabled, the v3 API grants full read and write access to every key in the store to anyone who can reach it.

http-etcd-unauthenticated-raft: etcd RAFT Unauthenticated API

Mon, 21 Sep 2026 00:00:00 +0000

etcd's v2 API is reachable without authentication, exposing the /v2/members endpoint. This endpoint discloses the full cluster membership list, including each member's name, internal peer URLs, and client URLs, without requiring any credentials.

wordpress-click2shell: WordPress Click2Shell Theme Preview Selector Injection

Mon, 21 Sep 2026 00:00:00 +0000

WordPress contains a client-side selector injection in the theme installer preview route. A crafted URL opened by an authenticated administrator can cause WordPress to automatically install and preview an attacker-selected inactive theme from WordPress.org. The issue can be chained with a separate vulnerability in an installed theme to achieve code execution.

森鑫炬水务企业综合运营平台GetByName存在SQL注入漏洞

Sat, 19 Sep 2026 00:00:00 +0000

森鑫炬水务企业综合运营平台GetByName存在SQL注入漏洞，攻击者可以利用此漏洞获取数据库敏感数据

桓基科技｜OAKlouds - 存在2個漏洞

Fri, 18 Sep 2026 00:00:00 +0000

云智慧数据中心智能运维管理平台存在任意用户登录漏洞

Fri, 18 Sep 2026 00:00:00 +0000

云智慧数据中心智能运维管理平台存在任意用户登录漏洞，攻击者可以构造payload直接登录到后台，获取后台权限。

大洋融云融媒体系统存在未授权访问漏洞

Fri, 18 Sep 2026 00:00:00 +0000

大洋融云融媒体系统存在未授权访问漏洞，攻击者可以通过该漏洞获取账号密码等敏感信息。

索贝凌云商城单点登录存在登录绕过

Fri, 18 Sep 2026 00:00:00 +0000

索贝凌云商城单点登录存在登录绕过，攻击者可直接通过结果绕过登录权限直接获取Token信息

北信源防病毒系统存在SQL注入

Fri, 18 Sep 2026 00:00:00 +0000

北信源防病毒系统存在SQL注入，攻击者可通过SQL注入获取管理员密码。

安天智甲终端防御系统存在任意文件读取

Fri, 18 Sep 2026 00:00:00 +0000

安天智甲终端防御系统存在任意文件读取，攻击者可通过该读取漏洞获取系统敏感文件数据。

VX Talent人事管理云存在前台任意文件上传

Fri, 18 Sep 2026 00:00:00 +0000

VX Talent人事管理云存在前台任意文件上传，攻击者可通过该漏洞获取服务器权限。

无人值守称重管理系统存在SQL注入漏洞

Fri, 18 Sep 2026 00:00:00 +0000

无人值守称重管理系统存在SQL注入漏洞,攻击者可以通过该漏洞获取数据库敏感信息。

成都冠唐科技设备云维保管理系统存在未授权访问漏洞

Fri, 18 Sep 2026 00:00:00 +0000

成都冠唐科技设备云维保管理系统存在未授权访问漏洞，攻击者可以通过该漏洞构造payload获取已知账户的密码，从而登录到后台获取后台权限。

成都冠唐科技设备云维保管理系统存在sql注入漏洞

Fri, 18 Sep 2026 00:00:00 +0000

成都冠唐科技设备云维保管理系统存在sql注入漏洞，攻击者可以通过该漏洞获取数据库敏感信息。

CuteHttpFileServer/chfs存在未授权任意文件上传

Fri, 18 Sep 2026 00:00:00 +0000

CuteHttpFileServer/chfs存在未授权任意文件上传漏洞，攻击者可以在未授权的情况下上传任意跨目录文件，获取服务器权限,例如传入ssh key。

杭州加砖信息科技有限公司智慧监测系统存在SQL注入

Fri, 18 Sep 2026 00:00:00 +0000

杭州加砖信息科技有限公司智慧监测系统存在SQL注入，攻击者可通过该漏洞获取数据库敏感数据。

金富瑞-UCML 应用框架存在文件上传漏洞

Fri, 18 Sep 2026 00:00:00 +0000

金富瑞-UCML 应用框架存在文件上传漏洞。恶意攻击者可以利用该漏洞获取服务器权限。