Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CVE-2026-45321
## Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` pack
2026-05-12 归档
今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。
← 返回归档列表Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
CVE-2026-27478
**Context:** A critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2026-42891
此漏洞影响基于Chromium的Microsoft Edge浏览器Android版本。由于用户界面（UI）对关键信息的错误表示，未经授权的攻击者能够通过网络执行欺骗攻击。攻击者可能利用此漏洞伪造地址栏或安全指示，诱使用户访问恶意网站或泄露敏
Chromium: CVE-2026-7941 Insufficient validation of untrusted input in Mobile
CVE-2026-7941
CVE-2026-7941 是 Chromium 项目（一个开源浏览器引擎）中一个影响移动版（Mobile）的漏洞。该漏洞源于对不可信输入的验证不足（Insufficient validation of untrusted input），攻
Chromium: CVE-2026-7931 Insufficient validation of untrusted input in iOS
CVE-2026-7931
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2026-35429
User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attac
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2026-40416
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized
Chromium: CVE-2026-7897 Use after free in Mobile
CVE-2026-7897
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
【云防火墙】腾讯云 VPC 边界防火墙（集群模式）超量管控生效通知
【云防火墙】腾讯云 VPC 边界防火墙（集群模式）超量管控生效通知
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user...
CVE-2026-34263
Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious co
WebdriverIO BrowserStack Service has a Command Injection issue
CVE-2026-25244
### Summary A command injection vulnerability exists in `@wdio/browserstack-service` that allows remote code execution (
Build Application Firewalls Aim to Stop the Next Supply Chain Attack
本文介绍了“构建应用防火墙”（Build Application Firewalls）的概念，这是一种旨在防御软件供应链攻击的新兴安全方法。与传统的静态代码扫描不同，构建应用防火墙通过监控软件构建管道中的运行时行为来检测和阻止恶意活动。文章
PFirewall: Semantics-Aware Customizable Data Flow Control for Smart Home Privacy Protection.
本论文提出 PFIREWALL，一个面向智能家居平台的语义感知可定制数据流控制系统，旨在解决物联网平台上的隐私泄露问题。当前，智能家居设备将大量敏感数据上传至云平台，但这些数据中大部分并未触发自动化操作，用户却无法控制数据流出。PFIREW
Innocent Until Proven Guilty (IUPG): Building Deep Learning Models with Embedded Robustness to Out-Of-Distribution Content.
本文提出了一种名为“Innocent Until Proven Guilty (IUPG)”的新型深度学习训练框架，旨在解决传统分类器（使用分类交叉熵损失）在真实世界环境中面临的三个关键问题：对分布外输入给出过度自信的后验概率、对对抗性噪声
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-42838
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Ch
Chromium: CVE-2026-7912 Integer overflow in GPU
CVE-2026-7912
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-7913 Insufficient policy enforcement in DevTools
CVE-2026-7913
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.