SecLens 情报中心

威胁情报

针对攻击活动、样本与IOC的持续情报更新。

Fastjson 1.2.83 远程代码执行漏洞

发布时间 2026-07-20 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

Fastjson 是阿里巴巴开源的 Java JSON 解析库，凭借其高性能和简洁的 API 在国内 Java 生态中占据主导地位，广泛应用于企业后端服务、微服务网关、数据接口层等核心场景。 2026 年 7 月，长亭安全应急响应中心监测到互联网披露了 Fastjson 远程代码执行漏洞。攻击者仅需控制 JSON 请求体，无需目标系统存在任何已知危险类，即可触发 RCE。目前已发现在野利用，建议受影响用户尽快升级到安全版本或实施缓解措施。
扩展字段
```
{
  "cnnvd_id": null,
  "cnvd_id": null,
  "cve_id": null,
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-07-20T20:39:20.226555+08:00",
  "references": [],
  "severity": "critical",
  "vuln_id": "75c81dff-8363-453e-bc7b-57bdf2d7f178"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
WordPress Core 远程代码执行漏洞

发布时间 2026-07-17 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

2026 年 7 月，长亭安全应急响应中心检测到互联网披露了 WordPress 中一条由两个漏洞串联构成的无认证远程代码执行利用链，命名为 wp2shell（CVE-2026-63030 + CVE-2026-60137）。攻击者仅需向 WordPress发送HTTP构造请求，无需任何账号或特殊配置即可在目标服务器上执行任意命令。目前 PoC 已公开，WordPress 官方已通过强制自动更新推送修复版本，建议仍在使用受影响版本的用户立即升级。
扩展字段
```
{
  "cnnvd_id": "CNNVD-2026-74165738",
  "cnvd_id": null,
  "cve_id": "CVE-2026-60137",
  "cvss3": {
    "A": "N",
    "AC": "H",
    "AV": "N",
    "C": "H",
    "I": "N",
    "MA": "N",
    "MAC": "H",
    "MAV": "N",
    "MC": "H",
    "MI": "N",
    "MPR": "N",
    "MS": "U",
    "MUI": "N",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-07-19T01:51:15.216256+08:00",
  "references": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf\nhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/",
  "severity": "critical",
  "vuln_id": "153a8ea1-fb0e-4ec3-9997-419a33f00604"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
用友YonBIP rest/formula/execute接口存在远程代码执行漏洞

发布时间 2026-07-17 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

用友YonBIP的rest/formula/execute接口存在spel表达式注入漏洞，漏洞源于execute接口接收前端传入的 JSON 表达式，解析后执行一个系统的spel表达式引擎，并返回执行结果。由于在spel表达式解析的过程中没有对前台参数进行有效的安全校验，导致攻击者可以通过精心构造的payload执行任意代码，获取目标服务器权限。
扩展字段
```
{
  "cnnvd_id": null,
  "cnvd_id": null,
  "cve_id": null,
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-07-17T17:45:31.098876+08:00",
  "references": [],
  "severity": "critical",
  "vuln_id": "57e4d450-8b2b-492b-85f0-ed1ff7caf566"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
Metabase 远程代码执行漏洞

发布时间 2026-07-15 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

Metabase 存在远程代码执行漏洞。具备添加或编辑数据库连接权限的攻击者，可通过配置恶意的 Snowflake 数据源，利用 JDBC 驱动缺陷在服务器上写入任意文件并替换合法驱动，从而在 Metabase 进程中执行任意代码，完全控制服务器。
扩展字段
```
{
  "cnnvd_id": "CNNVD-2026-48247365",
  "cnvd_id": null,
  "cve_id": "CVE-2026-50148",
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AV": "N",
    "C": "H",
    "I": "H",
    "MA": "H",
    "MAC": "L",
    "MAV": "N",
    "MC": "H",
    "MI": "H",
    "MPR": "N",
    "MS": "C",
    "MUI": "N",
    "PR": "N",
    "S": "C",
    "UI": "N"
  },
  "raw_updated_at": "2026-07-16T17:27:49.573598+08:00",
  "references": "https://github.com/metabase/metabase/security/advisories/GHSA-r6x2-rchx-q9g9",
  "severity": "critical",
  "vuln_id": "74d10fab-2409-46e3-808e-f23ef64fea41"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
DataEase 企业版 JWT 认证绕过致远程代码执行漏洞

发布时间 2026-07-15 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

DataEase 存在未授权命令执行漏洞。企业版用户受JWT伪造漏洞影响，TokenFilter仅解码JWT负载中的uid/oid且未验证签名，导致攻击者可伪造有效JWT绕过认证。结合Redshift JDBC驱动中危险的loggerFile与loggerLevel参数可实现任意文件写入，最终通过系统默认的定时任务执行恶意脚本，达成未授权远程命令执行。
扩展字段
```
{
  "cnnvd_id": "CNNVD-2026-26645662",
  "cnvd_id": null,
  "cve_id": "CVE-2026-46684",
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-07-16T17:26:52.287485+08:00",
  "references": "https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c3e2d\nhttps://github.com/dataease/dataease/releases/tag/v2.10.23\nhttps://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v",
  "severity": "high",
  "vuln_id": "beb7fc99-b005-4b56-99c4-fa1783f5c579"
}
```
长亭漏洞库 severity:high source:chaitin type:vuln china security-advisory vulnerability
Microsoft SharePoint 认证绕过漏洞

发布时间 2026-07-14 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

Microsoft SharePoint 存在身份验证绕过漏洞（CVE-2026-55040）。该漏洞源于 JWT 令牌验证流程中存在多个问题，导致远程未经身份验证的攻击者可通过构造恶意请求，绕过 SharePoint 的身份认证机制，并伪装成任意合法用户（如站点管理员）执行操作。该漏洞可与其他远程代码执行漏洞串联，构成无需认证即可实现远程代码执行的攻击链，从而窃取、篡改或删除系统中的敏感数据，甚至可能获取服务器控制权限。建议受影响的用户及时采取修复措施。
扩展字段
```
{
  "cnnvd_id": "CNNVD-2026-51022876",
  "cnvd_id": null,
  "cve_id": "CVE-2026-55040",
  "cvss3": {
    "A": "N",
    "AC": "L",
    "AV": "N",
    "C": "H",
    "I": "H",
    "MA": "N",
    "MAC": "L",
    "MAV": "N",
    "MC": "H",
    "MI": "H",
    "MPR": "N",
    "MS": "U",
    "MUI": "N",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-07-15T18:12:18.748626+08:00",
  "references": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040",
  "severity": "critical",
  "vuln_id": "434c66ea-febd-4e6c-b595-4137abfdf907"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
用友 U8 Cloud XChangeServlet sender 参数 SQL 注入漏洞

发布时间 2026-07-08 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

用友 U8 Cloud 的 XChangeServlet 接口存在SQL注入漏洞。该接口在处理XML格式的数据交换请求时，未对关键参数进行有效过滤，导致未经身份验证的远程攻击者可通过构造恶意请求，将任意SQL语句注入数据库查询，从而窃取、篡改或删除系统中的敏感数据，甚至可能利用数据库功能获取服务器控制权限。建议受影响的用户及时采取修复措施。
扩展字段
```
{
  "cnnvd_id": null,
  "cnvd_id": null,
  "cve_id": null,
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-07-14T18:05:44.865360+08:00",
  "references": "https://security.yonyou.com/#/noticeInfo?id=784",
  "severity": "high",
  "vuln_id": "5c7d4857-f59b-46cb-af18-b2dba841b545"
}
```
长亭漏洞库 severity:high source:chaitin type:vuln china security-advisory vulnerability
Gogs 组织名称路径遍历导致 Git hooks 远程代码执行漏洞

发布时间 2026-06-24 08:00 (UTC+08:00) 抓取时间 2026-07-21 20:45 (UTC+08:00)

Gogs 是一个开源的自托管 Git 服务，广泛用于团队内部代码托管和协作开发，通常部署在 Linux 服务器上，通过 Web 界面和 API 提供仓库管理、问题跟踪、代码审查等功能。该漏洞存在于 Gogs 0.14.3 之前版本的组织名称处理逻辑中。Gogs 在通过 API 创建组织时，未对组织名称（username）进行充分的路径遍历序列（如 ../）过滤，导致攻击者可以使用包含路径遍历字符的组织名称创建组织。随后，在该组织下创建仓库时，仓库的 Git 目录会被写入文件系统上由路径遍历指定的任意位置。攻击者可以通过巧妙嵌套 Git 仓库结构，覆盖其他仓库的 Git Hook 配置（如 hooks/update 脚本），从而实现远程代码执行（RCE）。成功利用此漏洞的攻击者可在 Gogs 服务器上以 Gogs…
扩展字段
```
{
  "cnnvd_id": "CNNVD-2026-14696434",
  "cnvd_id": null,
  "cve_id": "CVE-2026-52813",
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AV": "N",
    "C": "H",
    "I": "H",
    "MA": "H",
    "MAC": "L",
    "MAV": "N",
    "MC": "H",
    "MI": "H",
    "MPR": "N",
    "MS": "C",
    "MUI": "N",
    "PR": "N",
    "S": "C",
    "UI": "N"
  },
  "raw_updated_at": "2026-06-29T10:56:38.411916+08:00",
  "references": "https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7\nhttps://github.com/gogs/gogs/pull/8334\nhttps://github.com/gogs/gogs/releases/tag/v0.14.3\nhttps://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5",
  "severity": "critical",
  "vuln_id": "3cf9c568-e34d-413a-828e-a35bb049bdc3"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability

全部来源 Cloudflare 博客腾讯云安全公告 Adobe 安全公告阿里云 AVD Ubuntu 安全通告启明星辰安全通告 Amazon Linux AL2 公告 Amazon Linux AL2023 公告 AWS 安全公告 MSRC 更新指南 Oracle 安全警报 Apple 安全更新 Chrome 稳定版更新 Red Hat 安全公告 Atlassian 安全公告 NVIDIA 安全公告华为安全公告联想安全公告阿里云 Linux 安全公告阿里云 Linux CVE 通知阿里云安全公告 Amazon Linux 1 (EOL)安全公告 Amazon Linux 安全公告长亭漏洞库 Seebug 漏洞库 CISA KEV Catalog 微步银狐情报微步银狐 IOC Ransomware.live 近期受害者工信部 CNVDB CNNVD 通报 CNNVD 漏洞库 CNVD 漏洞库 TC260 标准征求意见 Seebug 技术 Paper GitHub Advisory HackerOne 博客 Exploit-DB 安天每日安全简讯 LinuxSecurity Hybrid VulDB 地方采购（CCGP）中央采购（CCGP） The Hacker News FreeBuf 社区 VIPRead 嘶吼安全资讯 Doonsec 微信聚合 arXiv cs.CR RSA Conference Podcast 新闻聚焦社区动态会议与培训融资快讯并购整合情报快报事件通报工具更新产品发布

威胁情报

订阅来源 RSS