CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-07-24 (9)

2026-07-24 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-07-24

9 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2025-71389 — 10.0 — Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled i…
  • CVE-2026-56191 — 10.0 — Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
  • CVE-2026-56163 — 10.0 — Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
  • CVE-2026-44210 — 9.9 — Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows p…
  • CVE-2026-47752 — 9.9 — Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The title_template and …
  • CVE-2024-58354 — 9.9 — cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's defaul…
  • CVE-2026-63359 — 9.8 — The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials,…
  • CVE-2026-15981 — 9.8 — The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boo…
  • CVE-2026-12877 — 9.1 — The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injec…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.