Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（EPMM）存在一个代码注入漏洞。该漏洞可能允许攻击者通过向受影响组件发送特制的请求，在目标系统上注入并执行任意代码。由于缺乏具体的漏洞细节和利用条件，无法确定攻击者是否需要身份验
2026-05-05 归档
今日共收录 918 条安全情报，包含 208 个 CVE，383 篇安全通告，以及 47 篇研究论文。
← 返回归档列表TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
根据知道创宇/Seebug漏洞库收录的信息，天融信（TOPSEC）防火墙存在远程利用漏洞（代号ELIGIBLEBACHELOR）。该漏洞可能允许未经授权的远程攻击者向防火墙设备发送特制请求，触发缓冲区溢出或其他内存破坏，进而实现远程代码执行
Axios: Header Injection via Prototype Pollution
CVE-2026-42035
### Summary A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacke
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection...
CVE-2026-41926
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cg
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow...
CVE-2026-41927
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firew
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection...
CVE-2026-41923
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cg
AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass
CVE-2026-42606
## Summary The `ApplyXForwarded` middleware unconditionally trusts the client-supplied `X-Forwarded-Host` HTTP header w
Practical Non-Interactive Searchable Encryption with Forward and Backward Privacy.
本文聚焦于动态对称可搜索加密（DSSE）中的隐私保护问题。在DSSE中，前向隐私确保过去的搜索查询无法与未来的更新关联，而向后隐私则保证后续的搜索查询无法与过去已删除的文档关联。现有方案在实现Type-II向后隐私时通常需要交互式协议或可信
Dubhe: Succinct Zero-Knowledge Proofs for Standard AES and related Applications.
该论文提出了一种名为 Dubhe 的零知识证明系统，专门针对标准 AES 加密算法实现了高效、简洁的证明。传统的零知识证明（如基于 R1CS 或 QAP 的方案）在处理 AES 这类复杂算术电路时往往面临巨大的证明尺寸和验证开销。Dubhe
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
OpenClaw's Gateway Control UI bootstrap config required Gateway auth
## Summary Gateway Control UI bootstrap config required Gateway auth. ## Affected Packages / Versions - Package: opencl
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledge...
CVE-2026-42368
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A spec
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
CVE-2026-42312
### Summary The `set_config_value()` API method (`@permission(Perms.SETTINGS)`) in `src/pyload/core/api/__init__.py` ga
net-imap vulnerable to command Injection via "raw" arguments to multiple commands
CVE-2026-42257
### Summary Several `Net::IMAP` commands accept a raw string argument that is sent to the server without validation or e
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
CVE-2026-42575
apko verifies the signature on `APKINDEX.tar.gz` but never compares individually downloaded `.apk` packages against the
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
CVE-2026-42576
`DiscoverKeys` in `pkg/apk/apk/implementation.go` unconditionally type-asserts JWKS keys as `*rsa.PublicKey` without che
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud