Towards Secure Runtime Auditing of Remote Embedded System Software.
该论文针对远程部署的低成本微控制器单元（MCU）的安全审计问题展开研究。MCU因其低功耗和高能效，越来越多地被用于关键任务场景，但其固有的安全漏洞使其易受攻击。控制流证明（CFA）是一种远程检测攻击的技术，通过记录任务执行期间的所有控制流转
2026-05-07 归档
今日共收录 722 条安全情报，包含 0 个 CVE，380 篇安全通告，以及 58 篇研究论文。
← 返回归档列表Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command
#### Product Name: container Github Link: https://github.com/apple/container Version: `**: exactly one rule is writte
Stable Channel Update for Desktop
CVE-2026-7909 · CVE-2026-7901 · CVE-2026-7918 · CVE-2026-7921 · CVE-2026-7897 · CVE-2026-7908 · CVE-2026-7903 · CVE-2026-7896 · CVE-2026-7898 · CVE-2026-7912 · CVE-2026-7920 · CVE-2026-7916 · CVE-2026-7910 · CVE-2026-7911 · CVE-2026-7906 · CVE-2026-7914 · CVE-2026-7919 · CVE-2026-7913 · CVE-2026-7904 · CVE-2026-7915 · CVE-2026-7907 · CVE-2026-7922 · CVE-2026-7902 · CVE-2026-7923 · CVE-2026-7917 · CVE-2026-7899 · CVE-2026-7905 · CVE-2026-7900
The Chrome team is delighted to announce the promotion of Chrome 148 to the stable channel for Windows, Mac and Linux. T
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-
PrivateDrop: Practical Privacy-Preserving Authentication for Apple AirDrop.
AirDrop 是 Apple 设备间离线文件共享的默认协议，集成在超过 15 亿台终端设备中。本论文首次揭示了该协议的两个设计缺陷：攻击者能够通过公开的哈希值（SH）和证书交换过程，利用穷举或彩虹表攻击逆向出用户的手机号码和电子邮件地址。
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI
CVE-2026-42083
### Summary PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handle
Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest
CVE-2026-42081
### Summary The AMF in Free5GC v4.2.1 does not verify the UE Security Capabilities received in NGAP PathSwitchRequest me
Gotenberg has an unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine
CVE-2026-42594
## Summary The webhook middleware spawns a goroutine that holds a reference to the request's `echo.Context` after the s
Netty Redis Codec Encoder has a CRLF Injection Issue
CVE-2026-42586
# Security Vulnerability Report: CRLF Injection in Netty Redis Codec Encoder ## 1. Vulnerability Summary | Field | Val
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
CVE-2026-42581
# NETTY HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization | Field | Value | |-----------|-------| | Librar
Weblate Vulnerable to Private Translation Enumeration via Screenshot API
CVE-2026-44263
### Impact The screenshots, tasks, and component link API allowed for the enumeration of translations in a project inac
FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities.
该论文提出了FUZZILLI，第一个专门针对JavaScript JIT编译器漏洞的模糊测试工具。现代JavaScript引擎依赖JIT编译器实现高性能，但JIT编译器的复杂性带来了安全漏洞风险。现有的模糊测试工具主要生成常规JavaScr
Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-to-Image Generation Models.
本文提出 JailFuzzer，一种基于大语言模型（LLM）代理的自动化模糊测试框架，用于黑盒环境下对文本到图像（T2I）生成模型进行越狱攻击。现有越狱方法存在访问需求不切实际、提示语不自然易被检测、搜索空间受限以及查询开销高等问题。Jai
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud
Sign Up for Free Cloud Tier
Sign Up for Free Cloud Tier
iOS 26.4.2 and iPadOS 26.4.2
iOS 26.4.2 and iPadOS 26.4.2