Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized...
CVE-2026-42826
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose i
2026-05-08 归档
今日共收录 1100 条安全情报，包含 294 个 CVE，452 篇安全通告，以及 61 篇研究论文。
← 返回归档列表An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an...
CVE-2026-6736
An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attack
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information...
CVE-2026-33823
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.
Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized...
CVE-2026-33844
Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code o
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized...
CVE-2026-33109
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code ove
Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery
CVE-2026-44523
#### Summary No minimum length or entropy is enforced on the `JWT_SECRET` configuration value. The application accepts
Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
CVE-2026-44497
# CVE-2026-44497: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer ## Summary The fi
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
CVE-2026-44589
## Summary The `isBlockedUrl()` denylist introduced in `nuxt-og-image@6.2.5` to remediate **GHSA-pqhr-mp3f-hrpp** (Dmit
FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images
CVE-2026-42879
# CVE-2026-42879 - FacturaScripts - Authenticated Unrestricted File Upload via MIME Type Bypass ## Summary An authen
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint
CVE-2026-42878
### Summary An unauthenticated information disclosure vulnerability in the Installer controller allows any remote attack
FacturaScripts vulnerable to stored XSS via product reference in sales/purchases
CVE-2026-42877
## Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales and purchases
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation
CVE-2026-27964
### Summary A Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application
Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware...
CVE-2026-7414
Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials ar
The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections...
CVE-2026-7415
The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with no topic-level read
BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context
CVE-2026-40610
### Summary BentoML's `bentoml build` packaging workflow follows attacker-controlled symlinks inside the build context a
Firewall for AI
Firewall for AI
Ivanti warns of new EPMM flaw exploited in zero-day attacks
Ivanti warned customers today to patch a high-severity remote code execution vulnerability in Endpoint Manager Mobile (E
ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days, Patch-or-Die Alerts and 25+ New Stories
Bad week. Turns out the easiest way to get hacked in 2026 is still the same old garbage: shady packages, fake apps, forg
LeakDojo: Decoding the Leakage Threats of RAG Systems
本文针对检索增强生成（RAG）系统中的数据泄漏风险展开系统研究。RAG技术通过让大语言模型（LLM）利用外部知识库来提升回答质量，但同时也将宝贵的RAG数据库暴露于泄漏攻击之下。随着RAG系统日益复杂，LLM的指令遵循能力不断增强，现有研究
LCC-LLM: Leveraging Code-Centric Large Language Models for Malware Attribution
本论文提出 LCC-LLM，一个面向恶意软件归因与多任务静态分析的代码中心基准数据集与证据驱动框架。研究背景是当前基于 LLM 的恶意软件归因受限于不支持的指标以及缺乏代码级别的证据支持，难以准确识别恶意和脆弱代码片段。为解决这些问题，作者