A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the...
CVE-2026-7296
A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_order of the fi
2026-04-29 归档
今日共收录 828 条安全情报，包含 0 个 CVE，482 篇安全通告，以及 32 篇研究论文。
← 返回归档列表A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the...
CVE-2026-7305
A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the fi
A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability...
CVE-2026-7297
A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function s
A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function...
CVE-2026-7303
A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xx
Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed...
CVE-2026-41446
Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints th
CoreDNS has TSIG authentication bypass on gRPC and QUIC transports
CVE-2026-35579
### Summary The gRPC, QUIC, DoH, and DoH3 transports in CoreDNS incorrectly handle TSIG authentication. For gRPC and Q
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
CVE-2026-35453
### Summary The HTML Writer in PhpSpreadsheet bypasses `htmlspecialchars()` output escaping when a cell uses a custom nu
CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC
CVE-2026-33190
### Summary CoreDNS' tsig plugin can be bypassed on non-plain-DNS transports because it trusts the transport writer's Ts
CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass)
CVE-2026-33489
### Summary CoreDNS' transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone
CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification
CVE-2026-32936
### Summary CoreDNS's DNS-over-HTTPS (DoH) GET path accepts oversized `dns=` query values and performs substantial requ
CoreDNS' DoQ worker pool does not bound stream backlog
CVE-2026-32934
### Summary CoreDNS' DNS-over-QUIC (DoQ) server can be driven into large goroutine and memory growth by a remote client
Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
CVE-2026-30246
### Summary Fiber cache middleware's default key generator uses only `c.Path()` and does not include the query string. A
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
Why Secure Data Movement Is the Zero Trust Bottleneck Nobody Talks About
Every security program is betting on the same assumption: once a system is connected, the problem is solved. Open a tick
Efficient Query-Based Attack against ML-Based Android Malware Detection under Zero Knowledge Setting.
本文针对基于机器学习的Android恶意软件检测（AMD）方法，提出了一种名为AdvDroidZero的高效查询式攻击框架。当前对该类方法的对抗样本攻击大多依赖较强假设，如攻击者知晓特征空间、模型参数或训练数据集等知识，这在现实攻击场景中往
When Free Tier Becomes Free to Enter: A Non-Intrusive Way to Identify Security Cameras with no Cloud Subscription.
该论文探讨了无线安全摄像头在未购买云订阅（即仅使用免费层）时的安全隐患。许多用户为节约成本只购买硬件而不订阅云服务，这导致摄像头在检测到运动时仅发送警报或提供实时流，但录像功能受限。研究者发现，摄像头在响应运动刺激时产生的无线流量模式会泄露
Prime-Field PINI: Machine-Checked Composition Theorems for Post-Quantum NTT Masking
本文（系列第6篇）聚焦后量子密码学中基于NTT（数论变换）硬件的算术掩码组合安全性。布尔掩码的组合理论（NI、SNI、PINI）已成熟，但素数域上的算术掩码（NTT后量子密码的基础）缺乏类似理论。作者提出并形式化证明了素数域上PINI（Pr
京公网安备 11000002002063号
本次输入内容为中华人民共和国公安备案信息页面（备案号：京公网安备 11000002002063号），并非威胁情报文章。页面未提供任何攻击活动、战术、工具链、受害者特征或防御建议等实质性威胁情报内容。标签中虽包含“360”、“report”、
（总）网出证（京）字第281号
输入内容为360CERT的安全报告，但标题为“（总）网出证（京）字第281号”，疑似是网站许可证页面，而非具体的威胁情报分析。摘要、CVE、标签等信息均为占位符或缺失，无法提取任何攻击活动、战术、工具链、受害者特征等有效数据。因此，本摘要无
京网文〔2020〕6051-1195号
该输入仅包含标题“京网文〔2020〕6051-1195号”和来源为360CERT安全报告，但提供的URL指向许可证页面，且正文为空。标签包括360、报告、恶意软件、APT，但缺乏具体技术细节或事件描述。无法从中提取出有效的威胁情报信息。