2026-06-28 归档

今日共收录 725 条安全情报，包含 41 个 CVE，384 篇安全通告，以及 89 篇研究论文。

漏洞预警2026-06-28 发布MEDIUM

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-a...

CVE-2026-58055

nghttp2 的 nghttpx 代理（版本 1.69.0 及之前）在处理 HTTP/1.1 Upgrade 请求时存在一个漏洞。当请求同时携带 Content-Length 头部和请求体时，代理会将该请求转发到可复用的后端 keep-a

历史摘要 · 未重新核验 · NVD

#cve #cwe-444 #http-smuggling #nghttp2 #proxy #response-queue-poisoning

漏洞预警2026-06-28 发布HIGH

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitiv...

CVE-2026-8095

CVE-2026-8095 影响 WordPress 的 Frontend File Manager Plugin 插件（版本 ≤23.6）。漏洞位于 wpfm_file_meta_update AJAX 处理函数中，由于对参数 wpfm_

历史摘要 · 未重新核验 · NVD

#cve #cwe-73

漏洞预警2026-06-27 发布HIGH

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thr...

CVE-2026-49412

该漏洞存在于Linux内核的IPV6_MSFILTER套接字选项处理程序中。处理程序在从用户空间复制源过滤器列表时，会临时释放一个序列化锁，然后重新获取。在锁释放的窗口期内，另一个线程可能释放多播过滤器结构体，导致处理程序持有一个指向已释放

历史摘要 · 未重新核验 · NVD

#cve #cwe-416

漏洞预警2026-06-27 发布MEDIUM

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verifi...

CVE-2026-9242

该漏洞存在于WordPress插件RegistrationMagic（自定义注册表单、用户注册、支付和用户登录）的所有版本直到6.0.8.6。插件将PayPal IPN回调处理器注册为一个无需认证（nopriv）的AJAX动作，没有任何身份

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-06-27 发布INFO

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is du...

CVE-2026-9233

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-27 发布INFO

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all...

CVE-2026-3462

The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-27 发布INFO

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to in...

CVE-2026-13295

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Paramet

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-27 发布INFO

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11...

CVE-2026-12471

The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plu

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-27 发布INFO

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action...

CVE-2026-12432

The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-27 发布INFO

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inc...

CVE-2026-12399

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-27 发布INFO

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in ...

CVE-2026-11987

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-06-27 发布INFO

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Prod...

CVE-2026-11783

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-27 发布INFO

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is du...

CVE-2026-11773

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypas

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-27 发布INFO

The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0...

CVE-2026-11597

The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusions

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-27 发布INFO

The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to and including 0.8.9....

CVE-2026-11364

The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-27 发布INFO

The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the g...

CVE-2026-9677

The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl se

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-27 发布INFO

The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to ...

CVE-2026-13245

The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' para

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-06-27 发布INFO

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the pl...

CVE-2026-12404

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-27 发布INFO

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user perform...

CVE-2026-10820

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress pl

历史摘要 · 未重新核验 · NVD

#cve

漏洞预警2026-06-27 发布INFO

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and inc...

CVE-2026-13331

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

历史摘要 · 未重新核验 · NVD

#cve #cwe-89