漏洞与漏洞利用

漏洞利用目录

来自我们自身研究的零日漏洞，以及从入侵事件中还原的 n-day 漏洞。每篇分析记录都给出漏洞类别、影响、检测方法，以及公开概念验证的链接。

漏洞利用

21 个目标

已有 CVE

已分配编号

列入 CISA KEV

已知被利用

附完整报告

已关联剖析

djangorestframework 1

djangorestframework remote code execution (CVE-2026-114137) CVSS 7.4 HighEPSS 0.35% (p27) CVE-2026-114137 n-day Arbitrary code execution against the vulnerable build October 21, 2026

org.http4s:http4s-scala-xml_2.12 1

org.http4s:http4s-scala-xml_2.12 remote code execution (CVE-2026-61741) CVSS 9.3 CriticalEPSS 0.29% (p20) CVE-2026-61741 n-day Arbitrary code execution against the vulnerable build September 24, 2026

io.moquette:moquette-broker 1

io.moquette:moquette-broker remote code execution (CVE-2026-85724) CVSS 9.6 CriticalEPSS 0.27% (p17) CVE-2026-85724 n-day Arbitrary code execution against the vulnerable build September 23, 2026

lightrag-hku 1

lightrag-hku remote code execution (CVE-2026-85734) CVSS 9.1 CriticalEPSS 0.36% (p27) CVE-2026-85734 n-day Arbitrary code execution against the vulnerable build September 22, 2026

mcp-atlassian 1

mcp-atlassian remote code execution (CVE-2026-77244) CVSS 10.0 CriticalEPSS 0.50% (p42) CVE-2026-77244 n-day Arbitrary code execution against the vulnerable build September 22, 2026

lmdeploy 2

lmdeploy remote code execution (CVE-2025-66455) CVSS 9.8 CriticalEPSS 0.70% (p52) CVE-2025-66455 n-day Arbitrary code execution from loading untrusted input September 18, 2026
lmdeploy remote code execution (CVE-2026-33625) CVSS 8.8 HighEPSS 0.24% (p16) CVE-2026-33625 n-day Arbitrary code execution against the vulnerable build September 18, 2026

org.opencastproject:opencast-engage-paella-player-7 1

org.opencastproject:opencast-engage-paella-player-7 remote code execution (CVE-2026-77615) CVSS 8.7 HighEPSS 0.39% (p33) CVE-2026-77615 n-day Arbitrary code execution against the vulnerable build September 17, 2026

@vendure/core 1

@vendure/core remote code execution (CVE-2026-63472) CVSS 9.1 Critical CVE-2026-63472 n-day Arbitrary code execution against the vulnerable build September 17, 2026

djust 1

djust remote code execution (CVE-2026-61594) CVSS 9.1 CriticalEPSS 0.43% (p36) CVE-2026-61594 n-day Arbitrary code execution against the vulnerable build September 16, 2026

org.http4s:http4s-ember-core_2.12 1

org.http4s:http4s-ember-core_2.12 remote code execution (CVE-2026-69204) CVSS 9.2 CriticalEPSS 0.33% (p26) CVE-2026-69204 n-day Arbitrary code execution against the vulnerable build September 15, 2026

@zereight/mcp-gitlab 1

@zereight/mcp-gitlab remote code execution (CVE-2026-61568) CVSS 9.6 CriticalEPSS 0.32% (p25) CVE-2026-61568 n-day Arbitrary code execution against the vulnerable build September 15, 2026

yayson 1

yayson remote code execution (CVE-2026-61534) CVSS 9.1 Critical CVE-2026-61534 n-day Arbitrary code execution against the vulnerable build September 14, 2026

morgan 1

morgan remote code execution (CVE-2026-87859) CVSS 5.3 MediumEPSS 0.41% (p33) CVE-2026-87859 n-day Arbitrary code execution against the vulnerable build September 11, 2026

open-webui 1

open-webui remote code execution (CVE-2026-88006) CVSS 6.5 Medium CVE-2026-88006 n-day Arbitrary code execution against the vulnerable build September 10, 2026

httpx2 3

httpx2 remote code execution (CVE-2026-84378) CVSS 5.9 Medium CVE-2026-84378 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84380) CVSS 5.6 Medium CVE-2026-84380 n-day Arbitrary code execution against the vulnerable build September 2, 2026
httpx2 remote code execution (CVE-2026-84382) CVSS 7.5 High CVE-2026-84382 n-day Arbitrary code execution against the vulnerable build September 2, 2026

gitpython 1

gitpython remote code execution (CVE-2026-78676) CVSS 9.8 Critical CVE-2026-78676 n-day Arbitrary code execution against the vulnerable build August 25, 2026

nltk 2

nltk remote code execution (CVE-2026-78683) CVSS 9.6 Critical CVE-2026-78683 n-day Arbitrary code execution from loading untrusted input August 25, 2026
nltk remote code execution (CVE-2026-79657) CVSS 9.8 Critical CVE-2026-79657 n-day Arbitrary code execution from loading untrusted input August 25, 2026

vllm 4

vllm remote code execution (CVE-2026-71486) CVSS 4.3 Medium CVE-2026-71486 n-day Arbitrary code execution from loading untrusted input August 17, 2026
vllm remote code execution (CVE-2026-73560) CVSS 6.5 Medium CVE-2026-73560 n-day Arbitrary code execution against the vulnerable build August 17, 2026
vllm remote code execution (CVE-2026-73557) CVSS 6.3 Medium CVE-2026-73557 n-day Arbitrary code execution from loading untrusted input August 13, 2026
vllm remote code execution (CVE-2026-73558) CVSS 5.3 Medium CVE-2026-73558 n-day Arbitrary code execution against the vulnerable build August 13, 2026

@mockoon/commons-server 1

@mockoon/commons-server remote code execution (CVE-2026-59148) CVSS 8.8 High CVE-2026-59148 n-day Arbitrary code execution against the vulnerable build July 9, 2026

Linux kernel 1

getroot — AF_ALG page-cache LPE and container escape CVSS 8.8 High CVE-2026-31431 n-day Local privilege escalation to root, with escape from a container to the host June 15, 2026

PyYAML 1

PyYAML FullLoader deserialization RCE (CVE-2020-14343) CVSS 9.8 Critical CVE-2020-14343 n-day Arbitrary code execution from loading untrusted input February 9, 2021

概念验证与处置注意事项

若概念验证已公开，分析记录会直接链接到它。此处收录的所有内容都是真实的，其中部分是可用的漏洞利用代码，因此请在一次性 VM 中运行，且该 VM 不得连通您所使用的任何网络。对于没有公开链接的条目，请发邮件至 [email protected]，说明您的身份和用途。