Story retracted
BleepingComputer initially published a story about a new data breach at Instructure. Shortly after publication, we deter
2026-05-02 归档
今日共收录 1052 条安全情报，包含 324 个 CVE，429 篇安全通告，以及 17 篇研究论文。
← 返回归档列表Criminal IP and Securonix ThreatQ Collaborate to Enhance Threat Intelligence Operations
Raw threat intel isn't enough without real-world context. Criminal IP has partnered with Securonix to integrate exposure
Microsoft fixes Remote Desktop warnings displaying incorrectly
Microsoft has fixed a known issue causing newly introduced Windows security warnings to display incorrectly when opening
Microsoft now lets admins choose pre-installed Store apps to uninstall
Microsoft has updated a Windows 11 in-box app removal policy introduced in October to include a dynamic list that lets I
Windows 11 KB5083631 update released with 34 changes and fixes
Microsoft has released the KB5083631 optional cumulative update for Windows 11, which includes 34 changes, such as a new
US ransomware negotiators get 4 years in prison over BlackCat attacks
Two former employees of cybersecurity incident response companies Sygnia and DigitalMint were sentenced to four years in
Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks
Cybersecurity researchers are warning of two cybercrime groups that are carrying out "rapid, high-impact attacks" operat
Two Cybersecurity Professionals Get 4-Year Sentences in BlackCat Ransomware Attacks
The U.S. Department of Justice (DoJ) on Thursday announced the sentencing of two cybersecurity professionals to four yea
Two US Security Experts Sentenced to Prison for Helping Ransomware Gang
Ryan Goldberg of Georgia and Kevin Martin of Texas were each sentenced to four years in prison. The post Two US Securit
Cisco Releases Open Source Tool for AI Model Provenance
The new kit aims to address risks related to poisoned models, regulatory issues, supply chain integrity, and incident re
Latent Adversarial Detection: Adaptive Probing of LLM Activations for Multi-Turn Attack Detection
本文针对多轮提示注入攻击的检测问题展开研究。现有基于文本级别的防御无法识别隐蔽的攻击，因为每个单独轮次的提示看似无害，但攻击者通过信任建立、横向移动、权限提升等阶段逐步实施攻击。作者发现，这种攻击路径会在模型的残差流中留下激活层面的特征：每
网络安全信息与动态周报-2026年第12期
2026年第12期《网络安全信息与动态周报》由国家互联网应急中心（CNCERT）发布，内容涵盖近期国内外网络安全态势、重要漏洞、恶意程序活动、网络安全事件及预警信息等。本期周报未披露具体攻击细节或技术指标，属于综合性安全态势通报。建议关注C
网络安全信息与动态周报-2026年第13期
本报告为CNCERT发布的第13期网络安全信息与动态周报（2026年）。周报通常涵盖本周网络安全态势综述，包括漏洞挖掘与披露情况、恶意程序传播、远程控制、僵尸网络活动、钓鱼网站、数据泄露事件等；重点漏洞安全预警，例如操作系统、办公软件、网络
网络安全信息与动态周报-2026年第15期
本报告为国家互联网应急中心（CNCERT）发布的第15期网络安全信息与动态周报，涵盖2026年4月中旬至5月初的网络安全态势。报告通常包含漏洞通报、恶意程序传播、网络攻击事件、安全动态及数据统计等信息。但由于本期摘要内容缺失，无法获取具体威
ps_checkout allows unauthorized method invocation through unvalidated parameter
### Impact Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities. ### P
ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction
### Impact Transactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Be
CVE-2026-22738-Spring AI SimpleVectorStore 中的 SpEL 注入导致远程代码执行漏洞分析
CVE-2026-22738
CVE-2026-22738-Spring AI SimpleVectorStore 中的 SpEL 注入导致远程代码执行漏洞分析
A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of the file .claude/skills/ui-styling/s...
CVE-2026-7595
该漏洞存在于 nextlevelbuilder 项目的 ui-ux-pro-max-skill 组件中，影响版本直至 2.5.0。受影响的函数是 `_format_plugins`，位于文件 `.claude/skills/ui-styli
Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections. 'Elixir.Bandi...
CVE-2026-39807
Bandit是一个Elixir HTTP服务器。在1.0.0至1.11.0之前版本中，存在一个安全决策依赖于不可信输入的漏洞。具体而言，函数`Elixir.Bandit.Pipeline.determine_scheme/2`在处理HTTP
Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion when WebSocket permess...
CVE-2026-39804
Bandit（Elixir HTTP服务器）的WebSocket压缩实现中存在资源分配无限制漏洞（CWE-770）。漏洞位于lib/bandit/websocket/per_message_deflate.ex文件的inflate/2函数，