Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size
CVE-2026-44247
### Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod
2026-05-09 归档
今日共收录 1190 条安全情报，包含 490 个 CVE，393 篇安全通告，以及 21 篇研究论文。
← 返回归档列表banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI
CVE-2026-44209
## Summary `banks /tmp/rce_banks_exec').read() }}") p.text() ``` ```bash ls -l /tmp/rce_banks_exec # -rw-rw-r-- 1 ak a
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
CVE-2026-44728
### Impact Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output
Phoenix: Long-poll NDJSON body splitting causes large memory allocation
CVE-2026-32689
### Summary An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client
Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
CVE-2026-44564
# Read-Only Users Can Modify Collaborative Documents via Socket.IO ## Affected Component Socket.IO collaborative docum
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
CVE-2026-44680
## Summary MikroORM's identifier-quoting helper (`Platform.quoteIdentifier` and the postgres/mssql overrides) and its J
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
CVE-2026-6322
### Impact `fast-uri` v3.1.1 and earlier decodes percent-encoded authority delimiters (`%40` as `@`, `%3A` as `:`) insi
Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
CVE-2026-44499
## Summary A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated re
Bunsink has an SSRF bypass in `validate_webhook_url`
CVE-2026-44502
## Summary Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be (partially) bypassed because of a mi
Electerm users can run dangrous code through link or command line
CVE-2026-43944
### Impact _Arbitrary local code execution via deep links, CLI `--opts`, or crafted shortcuts. Affected users: electerm
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
CVE-2026-43943
### Impact A code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The...
CVE-2026-6659
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches
该论文提出 Patch2Vuln，一个利用语言模型代理从 Linux 发行版二进制补丁中重建漏洞信息的研究框架。安全更新发布后，防御者和攻击者均有机会对比漏洞版本和修复版本的软件，但实际运维中往往只有二进制包可用，缺乏源码补丁或公告文本。P
京公网安备 11000002002063号
本文提供的标题为‘京公网安备 11000002002063号’，来源标注为360CERT安全报告，但实际链接指向公安备案信息页面，未包含任何威胁情报内容。元数据标签包含malware、360、apt、report，但无具体摘要、IOC、攻击
（总）网出证（京）字第281号
该输入未包含有效的威胁情报内容。标题和URL指向360.cn的ICP许可证页面，而非安全报告。摘要为空，无相关漏洞、攻击者或恶意软件信息。可能为数据错误或测试条目。
京网文〔2020〕6051-1195号
本报告来自360CERT，标题为“京网文〔2020〕6051-1195号”，但实际内容缺失，仅包含标签“malware, 360, apt, report”。由于缺乏具体描述、CVE、威胁行为者、恶意软件家族等信息，无法提供详细的技术摘要。
京ICP证080047号[京ICP备08010314号-6]
本次输入未提供有效的威胁情报正文，仅包含标题“京ICP证080047号[京ICP备08010314号-6]”和来源“360CERT 安全报告”，但URL指向工信部备案查询页面，而非实际安全报告。标签包含malware、360、apt、rep
The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthenticated guest booking flow in versions up to, and includ...
CVE-2026-7652
LatePoint WordPress插件至5.5.0版本存在账户接管漏洞。漏洞源于未认证的访客预订流程中，save_connected_wordpress_user()函数通过wp_update_user()将LatePoint客户的电子
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend...
CVE-2026-6665
Pgbouncer 1.25.2 之前版本的 SCRAM 认证代码中存在一个安全漏洞。在构建 SCRAM client-final-message 时，程序未正确检查 strlcat() 函数的返回值。如果后端服务器发送一个包含长 nonc