SecLens 情报中心

威胁情报

针对攻击活动、样本与IOC的持续情报更新。

泛微 E-cology10 远程代码执行漏洞

发布时间 2026-03-16 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

Ecology10 系统存在远程代码执行漏洞，攻击者可无需认证，通过向特定接口发送恶意请求的方式触发漏洞，进而在目标服务器上执行任意代码。
扩展字段
```
{
  "cnnvd_id": null,
  "cnvd_id": null,
  "cve_id": null,
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-03-16T15:42:49.922627+08:00",
  "references": [],
  "severity": "critical",
  "vuln_id": "c0a3bbac-9af4-41f5-97d4-8c1c3b6cdb00"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
泛微 E-cology10 远程代码执行漏洞

发布时间 2026-03-16 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

Ecology10 系统存在远程代码执行漏洞，攻击者可无需认证，通过向特定接口发送恶意请求的方式触发漏洞，进而在目标服务器上执行任意代码。
扩展字段
```
{
  "cnnvd_id": null,
  "cnvd_id": null,
  "cve_id": null,
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-03-16T15:43:58.572157+08:00",
  "references": [],
  "severity": "critical",
  "vuln_id": "6d9990ee-0b20-4d21-8887-193346a40180"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
泛微 E-cology10 远程代码执行漏洞

发布时间 2026-03-16 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

Ecology10 系统存在远程代码执行漏洞，攻击者可无需认证，通过向特定接口发送恶意请求的方式触发漏洞，进而在目标服务器上执行任意代码。
扩展字段
```
{
  "cnnvd_id": null,
  "cnvd_id": null,
  "cve_id": null,
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-03-16T15:42:30.353609+08:00",
  "references": [],
  "severity": "critical",
  "vuln_id": "fc27c96b-4c78-46fb-8d04-4015b190c2d9"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
ComfyUI-Manager CRLF注入导致远程代码执行漏洞

发布时间 2026-01-10 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

ComfyUI 是一款流行的基于节点的 Stable Diffusion 图形用户界面，广泛应用于 AI 图像生成工作流的构建和执行。ComfyUI-Manager 是 ComfyUI 的扩展管理器插件，用于简化自定义节点、模型和依赖项的安装管理。 2026年1月，长亭安全应急响应中心监测到 ComfyUI-Manager 官方在修复CVE-2025-67303漏洞之后仍然存在一处CRLF注入漏洞导致的配置篡改，未经身份验证的攻击者可利用该漏洞注入不安全的配置项，配合 Git URL 安装功能实现远程代码执行，利用难度较低，建议受影响的用户尽快修复。
扩展字段
```
{
  "cnnvd_id": "CNNVD-202601-1731",
  "cnvd_id": null,
  "cve_id": "CVE-2026-22777",
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-04-20T19:04:25.465655+08:00",
  "references": "https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410",
  "severity": "critical",
  "vuln_id": "fbe72314-f25a-438d-988b-891556c6f0a2"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
n8n 前台远程代码执行漏洞

发布时间 2026-01-08 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

n8n 是一款开源的工作流自动化平台，广泛应用于企业和个人的自动化流程管理，提供节点式工作流编排、API 集成和数据处理等功能。 2026年1月，长亭安全应急响应中心监测到 n8n 存在远程代码执行漏洞（CVE-2026-21858）。经分析，未经身份验证的攻击者可通过公开访问的表单节点远程访问服务器上的敏感文件，结合后台漏洞可实现远程代码执行，利用难度较低，建议受影响的用户尽快修复。
扩展字段
```
{
  "cnnvd_id": "CNNVD-202601-1364",
  "cnvd_id": null,
  "cve_id": "CVE-2026-21858",
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-04-20T19:03:48.724663+08:00",
  "references": "https://github.com/n8n-io/n8n/security/advisories/GHSA-v4pr-fm98-w9pg\nhttps://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858",
  "severity": "critical",
  "vuln_id": "3d3c18a1-51c3-4a37-baa7-f2a4c04e847f"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability
ComfyUI-Manager 远程代码执行漏洞

发布时间 2026-01-05 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

ComfyUI 是一款流行的基于节点的 Stable Diffusion 图形用户界面，广泛应用于 AI 图像生成工作流的构建和执行。ComfyUI-Manager 是 ComfyUI 的扩展管理器插件，用于简化自定义节点、模型和依赖项的安装管理。 2025年1月，长亭安全应急响应中心监测到 ComfyUI-Manager 存在配置文件未授权访问漏洞（CVE-2025-67303）。经分析，未经身份验证的攻击者可利用该漏洞访问并篡改应用程序的配置，配合 Git URL 安装功能实现远程代码执行，利用难度较低，建议受影响的用户尽快修复。
扩展字段
```
{
  "cnnvd_id": "CNNVD-202601-865",
  "cnvd_id": null,
  "cve_id": "CVE-2025-67303",
  "cvss3": {
    "A": "N",
    "AC": "L",
    "AV": "N",
    "C": "N",
    "I": "H",
    "MA": "N",
    "MAC": "L",
    "MAV": "N",
    "MC": "N",
    "MI": "H",
    "MPR": "N",
    "MS": "U",
    "MUI": "N",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-01-22T16:15:50.375753+08:00",
  "references": "https://github.com/Comfy-Org/ComfyUI-Manager/blob/main/docs/en/v3.38-userdata-security-migration.md\nhttps://github.com/Comfy-Org/ComfyUI-Manager/pull/2338/commits/e44c5cef58fb4973670b86433b9d24d077b44a26",
  "severity": "high",
  "vuln_id": "530043e5-1934-42d9-9c25-7033c053093d"
}
```
长亭漏洞库 severity:high source:chaitin type:vuln china security-advisory vulnerability
MongoDB 未授权内存泄露漏洞

发布时间 2025-12-19 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

MongoDB 是一款基于 C++ 开发的开源 NoSQL 数据库系统，广泛应用于现代 Web 应用程序，提供高性能、高可用性和自动扩展等功能。 2025年12月，长亭安全应急响应中心监测到 MongoDB 存在未授权内存泄露漏洞（CVE-2025-14847）。经分析，未经身份验证的攻击者可利用该漏洞远程读取服务器内存中的敏感数据，无需任何认证即可发起攻击，利用难度较低，建议受影响的用户尽快修复。
扩展字段
```
{
  "cnnvd_id": "CNNVD-202512-3766",
  "cnvd_id": null,
  "cve_id": "CVE-2025-14847",
  "cvss3": {
    "A": "N",
    "AC": "L",
    "AV": "N",
    "C": "H",
    "I": "N",
    "MA": "N",
    "MAC": "L",
    "MAV": "N",
    "MC": "H",
    "MI": "N",
    "MPR": "N",
    "MS": "U",
    "MUI": "N",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2026-04-28T16:40:45.354198+08:00",
  "references": "http://www.openwall.com/lists/oss-security/2025/12/29/21\nhttps://jira.mongodb.org/browse/SERVER-115508\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14847\nhttps://www.smartkeyss.com/post/mongobleed-pre-auth-memory-disclosure-via-op_compressed-in-mongodb-cve-2025-14847\nhttps://www.vicarius.io/vsociety/posts/cve-2025-14847-detection-script-heap-memory-exposure-in-mongodb-server\nhttps://www.vicarius.io/vsociety/posts/cve-2025-14847-mitigation-script-heap-memory-exposure-in-mongodb-server",
  "severity": "high",
  "vuln_id": "b5c678e3-98fc-4cfe-a69a-736438e6ff0f"
}
```
长亭漏洞库 severity:high source:chaitin type:vuln china security-advisory vulnerability
FineReport 帆软报表前台远程代码执行漏洞

发布时间 2025-12-16 08:00 (UTC+08:00) 抓取时间 2026-06-04 09:45 (UTC+08:00)

帆软报表是一款专业的企业级报表工具，专注于数据可视化与分析。它支持多数据源连接，能快速制作各类复杂报表和动态仪表板。通过拖拽式操作和灵活定制，帮助企业实现高效的数据决策与业务洞察。 2025年12月，长亭安全应急响应中心监测到帆软报表和数据决策系统存在远程代码执行漏洞。经分析，攻击者可利用export/excel接口构造SQL注入语句写入Webshell，进而获取服务器权限。由于该漏洞可组合SessionID泄露漏洞实现前台无条件利用，导致利用难度较低，建议受影响的用户尽快修复。影响版本： FineReport 11.5.4及以下版本（2025.09.29及之前） FineBI 7.0.4及以下版本（2025.09.12及之前） FineBI 6.1.7.3及以下版本（2025.09.29及之前） FineB…
扩展字段
```
{
  "cnnvd_id": null,
  "cnvd_id": null,
  "cve_id": null,
  "cvss3": {
    "A": "H",
    "AC": "L",
    "AR": "X",
    "AV": "N",
    "C": "H",
    "CR": "X",
    "I": "H",
    "IR": "X",
    "MA": "X",
    "MAC": "X",
    "MAV": "X",
    "MC": "X",
    "MI": "X",
    "MPR": "X",
    "MS": "X",
    "MUI": "X",
    "PR": "N",
    "S": "U",
    "UI": "N"
  },
  "raw_updated_at": "2025-12-18T11:11:38.206426+08:00",
  "references": [],
  "severity": "critical",
  "vuln_id": "683fd155-bb28-4441-99ab-481c8ffcd1e8"
}
```
长亭漏洞库 severity:critical source:chaitin type:vuln china security-advisory vulnerability

全部来源 Cloudflare 博客腾讯云安全公告 Adobe 安全公告阿里云 AVD Ubuntu 安全通告启明星辰安全通告 Amazon Linux AL2 公告 Amazon Linux AL2023 公告 AWS 安全公告 MSRC 更新指南 Oracle 安全警报 Apple 安全更新 Chrome 稳定版更新 Red Hat 安全公告 Atlassian 安全公告 NVIDIA 安全公告华为安全公告联想安全公告阿里云 Linux 安全公告阿里云 Linux CVE 通知阿里云安全公告 Amazon Linux 1 (EOL)安全公告 Amazon Linux 安全公告长亭漏洞库 Seebug 漏洞库 CISA KEV Catalog 微步银狐情报微步银狐 IOC Ransomware.live 近期受害者工信部 CNVDB CNNVD 通报 CNNVD 漏洞库 CNVD 漏洞库 FreeBuf 社区 TC260 标准征求意见 Seebug 技术 Paper GitHub Advisory HackerOne 博客 Exploit-DB 安天每日安全简讯 LinuxSecurity Hybrid VulDB 地方采购（CCGP）中央采购（CCGP） The Hacker News 嘶吼安全资讯 Doonsec 微信聚合 arXiv cs.CR VIPRead 信息安全知识库 RSA Conference Podcast 会议与培训融资快讯并购整合情报快报事件通报工具更新产品发布

威胁情报

订阅来源 RSS