CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-08-25 (9)

2026-08-25 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-08-25

9 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-71300 — 9.8 — Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmospher…
  • CVE-2026-78329 — 9.8 — Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its…
  • CVE-2026-32563 — 9.8 — Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
  • CVE-2026-78676 — 9.8 — GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files w…
  • CVE-2026-49845 — 9.8 — SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partit…
  • CVE-2026-63073 — 9.8 — Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERR_raise_data(). Impact summary: A malicious or intercepted CMP endpoint can cras…
  • CVE-2026-66906 — 9.1 — Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage…
  • CVE-2026-55976 — 9.1 — Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled …
  • CVE-2026-60004 — 0.0 — Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Git… [KEV]

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.