Siemens Siemens ROS#
CVE-2026-41551
CISA 发布了一份关于 Siemens ROS# 的安全公告 (ICSA-26-134-08)，指出该产品存在一个路径遍历漏洞 (CVE-2026-41551, CVSS 9.1 严重)。该漏洞存在于 ROS# 的 file_server
2026-05-15 归档
今日共收录 1277 条安全情报，包含 487 个 CVE，424 篇安全通告，以及 55 篇研究论文。
← 返回归档列表Siemens gWAP
CVE-2026-40175
2026年5月14日，CISA发布了一则关于西门子gPROMS Web Applications Publisher（gWAP）的安全公告。该产品存在一个远程代码执行漏洞（CVE-2026-40175），源于其使用的第三方Axios HTT
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
### Summary A critical identity spoofing vulnerability in MCPHub allows any unauthenticated user to impersonate any oth
Siemens Ruggedcom Rox
CVE-2025-40949
CISA 发布 ICS 安全公告（ICSA-26-134-12），披露 Siemens Ruggedcom ROX 系列工业交换机/路由器中存在一个操作系统命令注入漏洞（CVE-2025-40949，CVSS 3.1 评分 9.1，严重）。
Siemens Simcenter Femap
CVE-2025-12659
View CSAF Summary Simcenter Femap is affected by heap based buffer overflow vulnerability in Datakit library that could
Universal Robots Polyscope 5
CVE-2026-8153
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and
Siemens Ruggedcom Rox
CVE-2025-40947
View CSAF Summary Ruggedcom Rox contains an input validation vulnerability in the feature key installation process that
Siemens Solid Edge
CVE-2026-44412 · CVE-2026-44411
View CSAF Summary Solid Edge SE2026 before Update 5 is affected by two file parsing vulnerabilities that could be trigge
Siemens SENTRON 7KT PAC1261 Data Manager
CVE-2025-22871
View CSAF Summary The web server in SENTRON 7KT PAC1261 Data Manager Before V2.1.0 contains a request smuggling vulnerab
Siemens Ruggedcom Rox
CVE-2025-40948
View CSAF Summary Ruggedcom Rox contains an improper access control vulnerability that could allow an authenticated remo
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（原MobileIron Core）是一款企业级的移动设备管理（MDM）解决方案，用于集中管理移动设备、应用和安全策略。该漏洞为代码注入漏洞，攻击者可能通过特制的请求或输入，向受影
【云防火墙】腾讯云 VPC 边界防火墙（集群模式）超量管控生效通知
腾讯云于2026年5月15日发布公告，宣布将对VPC边界防火墙（集群模式）实施超量管控机制。该机制旨在提升云防火墙的性能稳定性，当集群内的会话数或带宽使用超过预设阈值时，系统将自动丢弃超出部分的流量。此举可能影响依赖该防火墙进行网络隔离和访
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to...
CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when
DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
CVE-2026-45311
### Summary The `run_tests` tool executes `cargo test` in the workspace with `ApprovalRequirement::Auto`, meaning it ru
Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
CVE-2026-45671
### Summary Any authenticated user can permanently delete files owned by other users via `DELETE /api/v1/files/{id}` wh
Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
CVE-2026-45401
# Server-Side Request Forgery (SSRF) Bypass via HTTP Redirect Following in Web-Fetch, Image-Load, and Chat-Completion En
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-20182
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active e
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows...
CVE-2026-8634
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a
Windows 11 and Microsoft Edge hacked at Pwn2Own Berlin 2026
On the first day of Pwn2Own Berlin 2026, security researchers collected $523,000 in cash awards after exploiting 24 uniq
RankGuess: Password Guessing Using Adversarial Ranking.
该论文提出了一种基于对抗性排序的密码猜测框架 RankGuess，将密码猜测问题建模为马尔可夫决策过程（MDP）。作者将密码创建过程视为序列决策轨迹，假设攻击者训练一个智能体，其当前状态为已生成的密码序列，动作为生成下一个字符，由排序器给出