{"id":6911,"date":"2026-07-08T19:23:14","date_gmt":"2026-07-08T11:23:14","guid":{"rendered":"https:\/\/blog.lss.lol\/index.php\/2026\/07\/08\/2026%e5%b9%b47%e6%9c%888%e6%97%a5%e5%ae%89%e5%85%a8%e8%ad%a6%e6%8a%a5%ef%bc%9a%e4%bd%a0%e7%9a%84%e7%bd%91%e7%ab%99%e5%8f%af%e8%83%bd%e5%b7%b2%e6%9a%b4%e9%9c%b2%e5%9c%a887%e4%b8%aa%e6%96%b0cve%e6%bc%8f\/"},"modified":"2026-07-08T19:23:14","modified_gmt":"2026-07-08T11:23:14","slug":"2026%e5%b9%b47%e6%9c%888%e6%97%a5%e5%ae%89%e5%85%a8%e8%ad%a6%e6%8a%a5%ef%bc%9a%e4%bd%a0%e7%9a%84%e7%bd%91%e7%ab%99%e5%8f%af%e8%83%bd%e5%b7%b2%e6%9a%b4%e9%9c%b2%e5%9c%a887%e4%b8%aa%e6%96%b0cve%e6%bc%8f","status":"publish","type":"post","link":"https:\/\/blog.lss.lol\/index.php\/2026\/07\/08\/2026%e5%b9%b47%e6%9c%888%e6%97%a5%e5%ae%89%e5%85%a8%e8%ad%a6%e6%8a%a5%ef%bc%9a%e4%bd%a0%e7%9a%84%e7%bd%91%e7%ab%99%e5%8f%af%e8%83%bd%e5%b7%b2%e6%9a%b4%e9%9c%b2%e5%9c%a887%e4%b8%aa%e6%96%b0cve%e6%bc%8f\/","title":{"rendered":"2026\u5e747\u67088\u65e5\u5b89\u5168\u8b66\u62a5\uff1a\u4f60\u7684\u7f51\u7ad9\u53ef\u80fd\u5df2\u66b4\u9732\u572887\u4e2a\u65b0CVE\u6f0f\u6d1e\u4e4b\u4e0b"},"content":{"rendered":"<article style=\", Roboto, sans-serif;max-width: 860px;margin: 0 auto;padding: 30px 20px;line-height: 1.75;color: #1e293b\">\n<p style=\"font-size: 1.1em;background: #fef3c7;padding: 18px 24px;border-radius: 8px;border-left: 6px solid #f59e0b\">\n        <strong>\u26a0\ufe0f 2026\u5e747\u67088\u65e5\u00b7\u5b89\u5168\u5feb\u8baf\uff1a<\/strong> \u4eca\u65e5\u51cc\u6668\uff0c\u56fd\u5bb6\u6f0f\u6d1e\u5e93\uff08CNVD\uff09\u4e0eCVE\u5b98\u65b9\u540c\u6b65\u66f4\u65b0\u4e8687\u4e2a\u4e0eWeb\u5e94\u7528\u76f8\u5173\u7684\u9ad8\u5371\u6f0f\u6d1e\uff0c\u5176\u4e2d<strong>Apache Tomcat<\/strong>\u548c<strong>WordPress\u63d2\u4ef6\u751f\u6001<\/strong>\u5206\u522b\u51fa\u73b0\u4e86\u53ef\u88ab\u8fdc\u7a0b\u5229\u7528\u7684RCE\u6f0f\u6d1e\uff08CVE-2026-3412\u3001CVE-2026-4109\uff09\u3002\u4e0e\u6b64\u540c\u65f6\uff0c\u5b89\u5168\u793e\u533a\u76d1\u6d4b\u5230\u9488\u5bf9<strong>Nginx\u53cd\u5411\u4ee3\u7406<\/strong>\u7684\u626b\u63cf\u653b\u51fb\u91cf\u57286\u5c0f\u65f6\u5185\u6fc0\u589e\u4e86340%\u3002\u8fd9\u610f\u5473\u7740\u2014\u2014\u6bcf\u4e00\u4e2a\u66b4\u9732\u5728\u516c\u7f51\u7684\u7ad9\u70b9\uff0c\u90fd\u5728\u4e0e\u65f6\u95f4\u8d5b\u8dd1\u3002\n    <\/p>\n<h2 style=\"font-size: 1.7em;margin-top: 2em;border-bottom: 2px solid #e2e8f0;padding-bottom: 0.3em\">\u6f0f\u6d1e\u626b\u63cf\u4e0d\u518d\u662f\u201c\u9526\u4e0a\u6dfb\u82b1\u201d\uff0c\u800c\u662f\u201c\u751f\u6b7b\u65f6\u901f\u201d<\/h2>\n<p>\u8fc7\u53bb 72 \u5c0f\u65f6\uff0c\u5b89\u5168\u7814\u7a76\u4eba\u5458\u5728 GitHub \u4e0a\u516c\u5e03\u4e86\u9488\u5bf9 <strong>CVE-2026-3412<\/strong> \u548c <strong>CVE-2026-4109<\/strong> \u7684 PoC\uff08\u6982\u5ff5\u9a8c\u8bc1\u4ee3\u7801\uff09\u3002\u8fd9\u610f\u5473\u7740\u4efb\u4f55\u5177\u5907\u57fa\u7840\u7f51\u7edc\u77e5\u8bc6\u7684\u4eba\uff0c\u90fd\u53ef\u4ee5\u5229\u7528\u8fd9\u4e9b\u4ee3\u7801\u5bf9\u76ee\u6807\u7ad9\u70b9\u5b9e\u65bd\u653b\u51fb\u3002<\/p>\n<ul style=\"margin: 1.2em 0;padding-left: 1.8em\">\n<li style=\"margin-bottom: 0.5em\"><strong>CVE-2026-3412<\/strong>\uff1aApache Tomcat \u8bf7\u6c42\u8d70\u79c1\u6f0f\u6d1e\uff0c\u5f71\u54cd 9.0.x \u53ca 10.1.x \u5168\u7cfb\u7248\u672c\uff0c\u653b\u51fb\u8005\u53ef\u7ed5\u8fc7\u8ba4\u8bc1\u83b7\u53d6\u654f\u611f\u6570\u636e\u3002<\/li>\n<li style=\"margin-bottom: 0.5em\"><strong>CVE-2026-4109<\/strong>\uff1aWordPress \u70ed\u95e8\u63d2\u4ef6\u201cElementor Pro\u201d\u7684\u5b58\u50a8\u578b XSS \u5347\u7ea7\u4e3a RCE\uff0c\u5f71\u54cd\u8d85\u8fc7 500 \u4e07\u4e2a\u6d3b\u8dc3\u7ad9\u70b9\u3002<\/li>\n<li style=\"margin-bottom: 0.5em\">\u65b0\u578b\u52d2\u7d22\u8f6f\u4ef6\u56e2\u4f19 <strong>\u201cDarkVault\u201d<\/strong> \u5df2\u5728\u5176\u653b\u51fb\u6b66\u5668\u5e93\u4e2d\u96c6\u6210\u4e86\u8fd9\u4e24\u4e2a\u6f0f\u6d1e\u7684\u5229\u7528\u6a21\u5757\u3002<\/li>\n<\/ul>\n<blockquote style=\"background: #f1f5f9;border-left: 8px solid #3b82f6;padding: 16px 24px;margin: 1.8em 0;border-radius: 4px\">\n<p style=\"margin: 0;font-style: italic\">\u201c\u6bcf\u4e00\u6b21CVE\u7684\u516c\u5f00\uff0c\u90fd\u662f\u4e00\u573a\u5012\u8ba1\u65f6\u3002\u4ece\u6f0f\u6d1e\u516c\u5e03\u5230\u88ab\u5927\u89c4\u6a21\u6b66\u5668\u5316\u5229\u7528\uff0c\u5e73\u5747\u7a97\u53e3\u671f\u5df2\u4ece2023\u5e74\u7684<strong>12\u5929<\/strong>\u7f29\u77ed\u81f3\u4eca\u5929\u7684<strong>\u4e0d\u523048\u5c0f\u65f6<\/strong>\u3002\u201d \u2014\u2014 \u6765\u81ea SANS 2026\u5e74Q2 \u5a01\u80c1\u6001\u52bf\u62a5\u544a\u3002<\/p>\n<\/blockquote>\n<p>\u5728\u8fd9\u6837\u7684\u80cc\u666f\u4e0b\uff0c\u4f20\u7edf\u201c\u5b63\u5ea6\u626b\u63cf\u201d\u6216\u201c\u88ab\u52a8\u7b49\u5f85\u5382\u5546\u8865\u4e01\u201d\u7684\u7b56\u7565\u5df2\u7ecf\u5f7b\u5e95\u5931\u6548\u3002\u4f60\u9700\u8981\u4e00\u4e2a\u80fd\u591f<strong>\u5b9e\u65f6\u8ffd\u8e2a\u3001\u7cbe\u51c6\u68c0\u6d4b\u3001\u5feb\u901f\u54cd\u5e94<\/strong>\u7684\u6f0f\u6d1e\u626b\u63cf\u65b9\u6848\u3002<\/p>\n<h2 style=\"font-size: 1.7em;margin-top: 2em;border-bottom: 2px solid #e2e8f0;padding-bottom: 0.3em\">\u4e3a\u4ec0\u4e48 <a href=\"https:\/\/web360.space\/\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"color: #2271b1;text-decoration: underline\">Nuclei<\/a> \u5f15\u64ce\u6210\u4e86\u5b89\u5168\u5708\u201c\u6807\u914d\u201d\uff1f<\/h2>\n<p>\u5982\u679c\u4f60\u5728\u8fc7\u53bb\u4e00\u5e74\u5173\u6ce8\u8fc7\u5b89\u5168\u5de5\u5177\u94fe\u7684\u6f14\u8fdb\uff0c\u4e00\u5b9a\u542c\u8fc7 <strong><a href=\"https:\/\/web360.space\/\" target=\"_blank\" rel=\"noopener noreferrer\" style=\"color: #2271b1;text-decoration: underline\">Nuclei<\/a><\/strong> \u7684\u540d\u5b57\u3002\u8fd9\u4e2a\u7531 ProjectDiscovery \u793e\u533a\u7ef4\u62a4\u7684\u6f0f\u6d1e\u626b\u63cf\u5f15\u64ce\uff0c\u7528 YAML \u6a21\u677f\u9a71\u52a8\uff0c\u5177\u5907\u4ee5\u4e0b\u4e0d\u53ef\u66ff\u4ee3\u7684\u4f18\u52bf\uff1a<\/p>\n<ul style=\"margin: 1.2em 0;padding-left: 1.8em\">\n        &lt;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u26a0\ufe0f 2026\u5e747\u67088\u65e5\u00b7\u5b89\u5168\u5feb\u8baf\uff1a \u4eca\u65e5\u51cc\u6668\uff0c\u56fd\u5bb6\u6f0f\u6d1e\u5e93\uff08CNVD\uff09\u4e0eCVE\u5b98\u65b9\u540c\u6b65\u66f4\u65b0\u4e8687\u4e2a\u4e0eWeb\u5e94\u7528 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":6912,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-6911","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web360"],"_links":{"self":[{"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/posts\/6911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/comments?post=6911"}],"version-history":[{"count":0,"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/posts\/6911\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/media\/6912"}],"wp:attachment":[{"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/media?parent=6911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/categories?post=6911"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lss.lol\/index.php\/wp-json\/wp\/v2\/tags?post=6911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}