Mercury 框架未授权远程代码执行漏洞 (RCE) 深度剖析

严重 漏洞预警

Java 反序列化从 Redis 开始Rce

**审计方法**：全局搜索 `readObject` → 逐层向上追踪调用链 → 定位 HTTP 入口 → 确认数据源为 Redis key → RCE

奇安信攻防社区 · 4 小时前

高危 漏洞预警 CVSS 8.3

CVE-2026-83594：Memory allocation with an excessive size value in Apache Wicket. org.a

Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and…

NVD · 15 小时前 CVE-2026-83594

高危 漏洞预警 CVSS 8.3

CVE-2026-84170：Allocation of resources without limits or throttling in Apache Wicket

Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResou…

NVD · 15 小时前 CVE-2026-84170

高危 漏洞预警 CVSS 7.6

CVE-2026-111089：Apache Wicket reads texts from the application's resource bundles — a

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed in…

NVD · 15 小时前 CVE-2026-111089