CKAN has Unauthenticated Authorization Bypass in `datastore_search_sql`
CVE-2026-42032
### Impact A vulnerability in `datastore_search_sql` allowed attackers to bypass authorization in order to gain access
2026-05-01 归档
今日共收录 1019 条安全情报，包含 232 个 CVE，445 篇安全通告，以及 40 篇研究论文。
← 返回归档列表Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
CVE-2026-41654
### Impact An authenticated user with `project.add` permission (default on hosted Weblate SaaS and for any user holding
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
CVE-2026-40171
### Impact A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authenticati
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
CVE-2026-42031
### Impact A vulnerability in `datastore_search_sql` allowed attackers to inject SQL in order to gain access to private
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
CVE-2026-41686
The `BetaLocalFilesystemMemoryTool` in the Anthropic TypeScript SDK created memory files and directories using the Node.
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
CVE-2026-42352
### Impact OGC API - Process execution requests can use the `subscriber` object to requests to internal HTTP services.
pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider
CVE-2026-42351
### Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requ
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
CVE-2026-41680
### Summary A critical Denial of Service (DoS) vulnerability exists in `marked@18.0.0`. By providing a specific 3-byte i
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
Understanding Adversarial Transferability in Vision-Language Models for Autonomous Driving: A Cross-Architecture Analysis
本文系统研究了视觉语言模型（VLM）在自动驾驶场景中的对抗性迁移性。随着VLM在自动驾驶中的应用日益广泛，其结合视觉感知与语言推理的能力提升了可解释性，但物理世界对抗攻击的迁移性风险尚未被充分探索。本文针对三种代表性VLM架构（Dolphi
京公网安备 11000002002063号
输入内容为公安备案信息（京公网安备号），并非威胁情报文章，无法生成安全摘要。可能为数据录入错误。
（总）网出证（京）字第281号
根据提供的标题和来源，该条目为360公司的网站备案许可信息（网出证（京）字第281号），并非威胁情报报告。正文内容为空，标签仅包含“malware”、“report”、“360”、“apt”，但缺乏实质性威胁描述。因此无法提取攻击活动、技术
京网文〔2020〕6051-1195号
该输入内容为版权声明页面（京网文〔2020〕6051-1195号），来源于360CERT安全报告，但实际指向的是360.cn的许可证页面，不包含任何威胁情报、攻击活动、漏洞或恶意软件信息。因此无法生成有效摘要。
京ICP证080047号[京ICP备08010314号-6]
该条目来源于360CERT安全报告，但实际内容为工信部网站备案信息（京ICP证080047号），标题和来源URL指向备案查询页面，未包含任何威胁情报细节。标签中提及malware、apt，但正文无任何攻击活动、战术、工具链或受害者信息。推测
A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the a...
CVE-2026-7548
CVE-2026-7548 影响 Totolink NR1800X 路由器固件版本 9.1.0u.6279_B20210910。漏洞位于 /cgi-bin/cstecgi.cgi 文件中的 sub_41A68C 函数，该函数在处理参数 se
A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the compo...
CVE-2026-7545
CVE-2026-7545 影响 SourceCodester Advanced School Management System 1.0，具体位于 checkEmail 端点的 commonController.php 文件中存在一个未知
A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function bsf_sess_add_by_ip_address of the file /nbsf-management/v1/pcfBindings of the comp...
CVE-2026-7536
Open5GS 是一款开源5G核心网软件。其BSF（绑定支持功能）组件的 `/nbsf-management/v1/pcfBindings` 接口中存在一个拒绝服务（DoS）漏洞。该漏洞源于 `bsf_sess_add_by_ip_addr
A vulnerability was found in Open5GS up to 2.7.7. This affects the function amf_namf_comm_handle_registration_status_update_request in the library /lib/app/ogs-init.c of the fil...
CVE-2026-7535
该漏洞存在于 Open5GS 2.7.7 及之前版本的 amf_namf_comm_handle_registration_status_update_request 函数中，位于 namf-comm/v1/ue-contexts/{ueC
A flaw has been found in Open5GS up to 2.7.7. This issue affects the function amf_namf_callback_handle_sdm_data_change_notify of the file /namf-callback/v1/{id}/sdmsubscription-...
CVE-2026-7518
Open5GS 至 2.7.7 版本存在一个拒绝服务（DoS）漏洞。该漏洞位于 AMF（接入和移动性管理功能）的 SBI（基于服务的接口）端点中，具体涉及函数 amf_namf_callback_handle_sdm_data_change
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-1703. The affected element is the function strcpy of the file /goform/formUser. Executing a manipulation can lead to buffer...
CVE-2026-7512
CVE-2026-7512 是影响 UTT HiPER 1200GW 路由器（固件版本 up to 2.5.3-1703）的一个缓冲区溢出漏洞。该漏洞位于设备 Web 管理接口的 /goform/formUser 文件中，由于使用了不安全的