🌐 个人 CVE 展示站：https://sumo166.github.io/CVE-apply/
Step 1: Wait for the maintainer to confirm and create the security advisory After receiving the notification, the maintainer will confirm the authenticity of the vulnerability After confirmation, the maintainer will create a Draft Security Advisory and add me as a collaborator The draft advisory can include additional formal information such as CWE, CVSS, affected versions, and can also add my GitHub account "https://github.com/sumo166" as the discoverer of the vulnerability in the Credits section
Step 2: Apply for a CVE number On the advisory draft page, find the "Request CVE" button (in the "Publish advisory" drop-down menu) Click submit, and the GitHub CNA team will review it within 72 hours After the review is approved, a CVE-year-XXXX number will be assigned, with the status set as RESERVED (reserved), which is only visible internally and not publicly available
Step 3: Make it public after the fix is completed, and the CVE takes effect automatically The maintainer develops the fix patch and releases a new version After the version is released, click "Publish advisory" to publish the security advisory After the advisory is published, the CVE will automatically synchronize to the official MITRE library, and it can be retrieved on cve.org and NVD within a few hours
Reporter: sumo166 Email: svipqq5@gmail.com GitHub profile: https://github.com/sumo166
| CVE 编号 | 项目 | 项目热度 | 漏洞类型 | CVSS | 漏洞内容 |
|---|---|---|---|---|---|
| CVE-2026-76761 | cc-connect | ⭐ 15,114 | OS Command Injection | 7.3 High | Management API 未认证命令注入（空 token + cron exec）📄 复现 |
| CVE-2026-76760 | cc-connect | ⭐ 15,114 | Code Injection | 7.3 High | Webhook /hook 未认证 RCE（空 token + exec）📄 复现 |
| CVE-2026-76785 | Mini-Inventory-and-Sales-Management-System | ⭐ 561 | SQL Injection | 6.3 Medium | Transaction::getAll 的 orderBy/orderFormat SQL 注入 📄 复现 |
| CVE-2026-77151 | Ech0 | ⭐ 2,048 | Risky Cryptographic Algorithm | 3.7 Low | MD5Encrypt 使用不安全 MD5 算法 📄 复现 |
| CVE-2026-90510 | orion-visor | ⭐ 1,305 | Hard-coded Key | 7.5 High | 硬编码 AES 密钥 uQeacXV8b3isvKLK，可解密数据库中的 SSH 私钥/主机密码（CWE-321）📄 复现 |
| CVE-2026-90509 | orion-visor | ⭐ 1,305 | Hard-coded Credentials | 6.6 Medium | ExposeApi 硬编码默认 Token pmqeHOyZaumHm0Wt 导致内部 API 认证绕过（CWE-798）📄 复现 |
| CVE-2026-93559 | Jellyfish | ⭐ 6,442 | Incorrect Access Control | 7.1 High | FastAPI 全量 API 无认证/授权，可未授权读写/删除项目、覆盖 Provider API Key、上传任意文件（CWE-306）📄 复现 |
| CVE-2026-93533 | scotty | ⭐ 290 | OS Command Injection | 6.1 Medium | doctor 命令将 @servers 主机名未转义拼入 shell 命令导致本地 RCE（CWE-78）📄 复现 |
| CVE-2026-93534 | scotty | ⭐ 290 | Missing Integrity Check | 6.0 Medium | 自更新下载 phar 无签名/校验和验证，可被中间人替换为恶意二进制（CWE-494）📄 复现 |
| CVE-2026-93957 | PHP-FTS | ⭐ 141 | Incorrect Comparison | 3.9 Low | matchesSingleFilter 宽松比较导致过滤器绕过（CWE-697）📄 复现 |
| CVE-2026-93956 | PHP-FTS | ⭐ 141 | Cross-Site Scripting | 3.2 Low | buildHighlights 未转义字段导致存储型 XSS（CWE-79）📄 复现 |
| CVE-2026-93955 | grimmory | ⭐ 4,400 | Incorrect Access Control | 3.9 Low | Kobo 下载端点缺库级访问控制，可越权下载任意书籍（CWE-639）📄 复现 |
| CVE-2026-93954 | grimmory | ⭐ 4,400 | Incorrect Access Control | 3.9 Low | GET /api/v1/settings 缺管理员校验泄露密钥（CWE-863）📄 复现 |
