Daily High-Risk Vuln Digest 2026-08-14 (8)

Daily High-Risk Vulnerability Digest · 2026-08-14

8 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

CVE-2026-72811 — 10.0 — SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-s…
CVE-2026-73649 — 9.8 — Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the #set assignment handler in …
CVE-2026-12949 — 9.8 — The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating …
CVE-2026-8715 — 9.6 — Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissi…
CVE-2026-73843 — 9.6 — OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener withou…
CVE-2026-56750 — 9.1 — Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-58508 — 9.1 — Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
CVE-2026-73842 — 9.0 — OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listen…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.