CVE-2026-0261 PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIUM)
CVE-2026-0261
CVE-2026-0261 PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIUM)
2026-05-15 归档
今日共收录 1277 条安全情报，包含 487 个 CVE，424 篇安全通告，以及 55 篇研究论文。
← 返回归档列表CVE-2026-0256 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: MEDIUM)
CVE-2026-0256
CVE-2026-0256 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: MEDIUM)
CVE-2026-0264 PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution (Severity: HIGH)
CVE-2026-0264
CVE-2026-0264 PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Executio
CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities (Severity: MEDIUM)
CVE-2026-0257
CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities (Severity: MEDIUM)
Microsoft Authenticator Information Disclosure Vulnerability
CVE-2026-41615
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to
Auditing Frameworks Need Resource Isolation: A Systematic Study on the Super Producer Threat to System Auditing and Its Mitigation.
系统审计是检测高级持续性威胁（APT）攻击的关键技术，但攻击者可能尝试破坏审计框架本身以隐藏恶意活动。本文对审计框架中的“超级生产者威胁”进行了全面系统的研究。该威胁使攻击者能够通过产生大量审计数据来淹没审计框架，导致其崩溃或性能严重下降，
WHIP: Improving Static Vulnerability Detection in Web Application by Forcing tools to Collaborate.
由于输入中未提供完整的abstract内容，无法生成详细的摘要。论文标题暗示其提出了一种名为WHIP的方法，通过强制多种静态分析工具协作来提高Web应用漏洞检测的性能。但具体技术细节、实验设置和结果均不可知。
LiSA: Lifelong Safety Adaptation via Conservative Policy Induction
本文提出了 LiSA (Lifelong Safety Adaptation) 框架，旨在解决 AI Agent 部署后的安全护栏适应性问题。随着 AI Agent 从聊天界面扩展到读取私有数据、调用工具和执行多步骤工作流，护栏失效的后果不
MetaMoE: Diversity-Aware Proxy Selection for Privacy-Preserving Mixture-of-Experts Unification
该论文提出 MetaMoE，一个隐私保护的混合专家（MoE）模型统一框架。在现实场景中，训练数据通常分布在多个客户端且无法共享，导致无法直接训练统一的 MoE 模型。MetaMoE 利用公开的代理数据作为私有数据的替代，通过多样性感知的代理
On the (non-)resilience of encrypted controllers to covert attacks
本文研究网络控制系统（NCS）中加密控制器对隐密攻击（covert attacks）的抵抗能力。加密控制通常利用同态加密（HE）将控制器外包给第三方平台（如云服务）以保护数据机密性。近期研究试图通过修改HE方案来同时抵御完整性攻击，但本文证
DSTAN-Med: Dual-Channel Spatiotemporal Attention with Physiological Plausibility Filtering for False Data Injection Attack Detection in IoT-Based Medical Devices
该论文针对医疗物联网（IoMT）传感器数据流中的虚假数据注入（FDI）攻击，提出了一种双通道时空注意力框架DSTAN-Med。FDI攻击通过篡改传感器传输过程中的生命体征数据，威胁患者安全，而现有深度学习方法将传感器间空间相关性与时间依赖性
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound on...
CVE-2026-44428
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs. POST /api/graph/getGr...
CVE-2026-45371
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Con
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset, searchTag, searchWidget, and searchTemplate publish-mode...
CVE-2026-45148
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset,
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole a...
CVE-2026-45147
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with m
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names without any HTML escape, then a render temp...
CVE-2026-44670
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / da
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and pa...
CVE-2026-44588
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar st...
CVE-2026-44586
SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without...
CVE-2026-23998
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM managem
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler c...
CVE-2026-44520
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit sema