OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
CVE-2026-44720
### Overview A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access
2026-05-14 归档
今日共收录 1527 条安全情报，包含 720 个 CVE，444 篇安全通告，以及 62 篇研究论文。
← 返回归档列表Astro: Server island encrypted parameters vulnerable to cross-component replay
CVE-2026-45028
### Impact Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of serve
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload
CVE-2026-44697
## Summary A remote, unauthenticated denial-of-service vulnerability in `Batch.Decompress` (`data/batch/batch.go`) allo
Mapfish Print: Remote Code Injection (RCE) in Dynamic table
CVE-2026-44672
### Impact The attacker can execute arbitrary code without being authenticated ### Mitigation Upgrade to a patched ve
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
CVE-2026-44660
### Summary When `ujson.dump()` writes to a file-like object and the write operation raises an exception, the serialize
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
CVE-2026-44652
## Resolution SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we ex
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...
Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation
A threat actor with affiliations to China has been linked to a "multi-wave intrusion" targeting an unnamed Azerbaijani o
Microsoft, Palo Alto Networks Find Many Vulnerabilities by Using AI on Their Own Code
Microsoft’s MDASH discovered 16 of the Patch Tuesday vulnerabilities, and Palo Alto used Mythos to find dozens of flaws.
Fortinet, Ivanti Patch Critical Vulnerabilities
Successful exploitation of these flaws could lead to arbitrary code execution and information disclosure. The post Forti
Still Camouflage, Moving Illusion: View-Induced Trajectory Manipulation in Autonomous Driving
本文提出了一种针对基于视觉的自动驾驶系统的新型物理对抗攻击范式。现有物理攻击通常需要复杂的补丁或动态变化的图案，以在不同的视角下保持欺骗效果，而本文反其道而行之，将视角变化本身转化为攻击工具。攻击者只需在目标车辆上安装一个静态的、被动的对抗
Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents
该论文聚焦于永远在线的自主AI智能体（如OpenClaw、Hermes Agent）面临的新型提示注入威胁。这些智能体以单一持久进程运行，整合了消息、记忆、自写技能、调度和shell等模块，形成统一授权边界。作者提出了“休眠通道”（slee
Automatic Detection of Reference Counting Bugs in Linux Kernel Drivers
该论文提出了一种自动检测 Linux 内核驱动中引用计数错误（reference counting bugs）的工具 DrvHorn。引用计数是内核实中管理资源（如内存、文件描述符等）生命周期的关键机制，一旦出现错误（如少放、多放或未初始化
Code-Centric Detection of Vulnerability-Fixing Commits: A Unified Benchmark and Empirical Study
本研究针对漏洞修复提交（VFC）的自动化检测问题进行了系统性的实证评估。背景是：安全补丁部署的及时性至关重要，但官方漏洞建议库（advisory databases）平均比补丁发布延迟25天，且许多修复从未被收录为建议。当前该领域存在超过2
京公网安备 11000002002063号
输入内容仅包含公安备案号，未提供任何安全事件或威胁情报的摘要或正文。无法提取攻击活动、技术细节或影响范围。
（总）网出证（京）字第281号
该页面为网站备案信息页面（网出证（京）字第281号），来源于360CERT安全报告链接，但实际内容非威胁情报，无法提取任何攻击活动、技术细节或影响范围。标签中提及APT、360、恶意软件、报告，但摘要为空，无对应信息。
京网文〔2020〕6051-1195号
该输入标题为「京网文〔2020〕6051-1195号」，来源为360CERT安全报告，但实际内容为360.cn的版权资质声明页面，并非威胁情报文章。摘要和正文为空，无CVE、IoC或任何攻击活动信息。标签包含apt、360、malware、
京ICP证080047号[京ICP备08010314号-6]
该输入数据来源为360CERT安全报告，但标题和摘要内容仅包含网站备案信息（京ICP证080047号），来源URL指向工信部备案网站https://beian.miit.gov.cn/，且发布时间为未来日期2026年，疑似无效或错误数据。t
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up...
CVE-2026-5486
CVE-2026-5486 是 WordPress 的 Unlimited Elements for Elementor 插件（版本 ≤ 2.0.7）中的一个已认证 SQL 注入漏洞。漏洞存在于 `get_cat_addons` AJAX
Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.
CVE-2026-46419
该漏洞存在于 Yubico 的 java-webauthn-server (webauthn-server-core) 版本 2.8.0 至 2.8.1 中。在第二因子认证流程中，由于对某个函数返回值的检查逻辑存在缺陷，攻击者可能利用此漏洞