严重
漏洞预警
Java 反序列化从 Redis 开始Rce
**审计方法**：全局搜索 `readObject` → 逐层向上追踪调用链 → 定位 HTTP 入口 → 确认数据源为 Redis key → RCE
ARCHIVE
历史归档
按时间、分类、严重程度检索全部安全漏洞与安全信息。当前共收录 37 条记录。
当前筛选：
#RCE
高危
漏洞预警
CVSS 8.3
CVE-2026-83594：Memory allocation with an excessive size value in Apache Wicket. org.a
Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and…
高危
漏洞预警
CVSS 8.3
CVE-2026-84170：Allocation of resources without limits or throttling in Apache Wicket
Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResou…
高危
漏洞预警
CVSS 7.6
CVE-2026-111089：Apache Wicket reads texts from the application's resource bundles — a
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed in…
严重
漏洞预警
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of re…
严重
漏洞预警
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization af…
严重
漏洞预警
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitati…
严重
漏洞预警
A quiet week in infosec
In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all, there are still good people doing good work.
严重
漏洞预警
CVSS 9.3
CVE-2023-22793：A vulnerability allowing an unauthenticated attacker to perform remote
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.
高危
漏洞预警
CVSS 8.8
CVE-2026-107239：A vulnerability allowing a member of the Veeam Virtualization Extensio
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.
高危
漏洞预警
CVSS 8.7
CVE-2026-107238：A vulnerability allowing an authenticated domain user to perform remot
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
高危
漏洞预警
CVSS 8.3
CVE-2026-61654：Lightdash is an open source business intelligence platform. In affecte
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signatu…
严重
安全事件
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.
高危
漏洞预警
CVSS 8.3
CVE-2026-61576：Lightdash is an open source business intelligence platform. In affecte
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signatu…
高危
漏洞预警
CVSS 7.1
CVE-2026-119209：pypdf is a free and open-source pure-python PDF library. Prior to 6.21
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly com…
高危
漏洞预警
CVSS 7.1
CVE-2026-119208：pypdf is a free and open-source pure-python PDF library. Prior to 6.21
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an application accesses the page count of a crafted encrypted PDF whose page tree declares a forg…
高危
漏洞预警
CVSS 7.1
CVE-2026-119204：pypdf is a free and open-source pure-python PDF library. Prior to 6.21
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a crafted PDF page tree containing many shared resources. Page-tree flattening copies page dictio…
高危
漏洞预警
CVSS 7.1
CVE-2026-119207：pypdf is a free and open-source pure-python PDF library. Prior to 6.21
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory when strict mode loads a crafted invalid PDF dictionary. Nested parsing failures add repeated exception text to…
高危
漏洞预警
CVSS 7.1
CVE-2026-119206：pypdf is a free and open-source pure-python PDF library. Prior to 6.21
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labels from a crafted PDF containing a flat page-label number tree with many ranges. The page_label…
高危
漏洞预警
CVSS 7.1
CVE-2026-119205：pypdf is a free and open-source pure-python PDF library. Prior to 6.21
pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination refe…