Microsoft Enterprise Security Token Service (ESTS) Spoofing Vulnerability
CVE-2026-40379
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform
2026-05-08 归档
今日共收录 1100 条安全情报，包含 294 个 CVE，452 篇安全通告，以及 61 篇研究论文。
← 返回归档列表Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
CVE-2026-33109
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove
Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability
CVE-2026-41105
Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges ove
netbox-data-flows has stored XSS in ObjectAlias names rendered inside DataFlow tables
### Summary An authenticated user who can create or edit `ObjectAlias` objects can store arbitrary HTML/JavaScript in an
Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo
## Summary The `fetchPeerConnectInfo` function in `internal/service/connect/connect.go:214-239` uses `httpUtil.SendReque
Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access
CVE-2026-6973
Ivanti is warning that a new security flaw impacting Endpoint Manager Mobile (EPMM) has been explored in limited attacks
PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage
CVE-2026-0300
Palo Alto Networks has disclosed that threat actors may have attempted to unsuccessfully exploit a recently disclosed cr
ActiveFlowMark: Assessing Tor Anonymity under Active Bandwidth Watermarking
本文研究在低延迟匿名网络（如Tor）中，攻击者如何通过主动带宽扰动实施流量相关性分析，从而破坏用户的匿名性。现有的被动流量关联方法需要攻击者控制端点或修改Tor浏览器，而本文提出的NATA（非侵入式主动流量关联分析算法）无需上述条件，仅需攻
CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification
该论文提出了一个名为 CLAD 的框架，旨在解决物联网和工业物联网环境中入侵检测系统面临的两大挑战：设备行为高度异构和标签数据稀缺。CLAD 将聚类联邦学习（CFL）与一种新颖的双模微架构（DM²A）相结合。DM²A 包含一个共享编码器和两
Backdoor Mitigation in Object Detection via Adversarial Fine-Tuning
本文研究目标检测模型中的后门攻击防御问题。后门攻击会向深度模型中植入恶意行为，同时保持其在干净数据上的性能，对安全关键的视觉系统构成严重威胁。虽然图像分类领域的后门防御已有广泛研究，但目标检测的防御方法相对不成熟。对抗微调是分类任务中常用的
AoI-Guided Client Selection for Robust and Timely Federated Intrusion Detection in Cloud-Edge Security Analytics
该论文研究了在云-边缘安全分析中，联邦学习（FL）用于入侵检测时的客户端选择问题。在生产环境中，由于带宽异构、掉队者和掉线等问题，服务器可能依赖过时的客户端信息，影响检测的时效性和鲁棒性。作者将客户端选择建模为时效感知的系统问题，引入“信息
How Far Are VLMs from Privacy Awareness in the Physical World? An Empirical Study
随着视觉-语言模型（VLM）被越来越多地部署为具身助手的自主认知核心，评估其在物理环境中的隐私意识变得至关重要。与数字聊天机器人不同，这些智能体在家庭、医院等私密空间运行，能够观察并操作包含隐私敏感信息与物品的物理实体。然而，现有基准仍局限
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over...
CVE-2026-33111
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) all
Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulner...
CVE-2026-42047
Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orche
A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api_tools.g...
CVE-2026-8081
A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote co...
CVE-2026-6973
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authentic
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
CVE-2026-5786
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal pan...
CVE-2026-42285
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, a
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exist...
CVE-2026-41643
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in G...
CVE-2026-41642
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a