ABB Terra AC
CVE-2025-5517
CISA发布了一份关于ABB Terra AC电动汽车充电桩漏洞的公告（ICSA-26-146-01）。该漏洞被编号为CVE-2025-5517，属于堆缓冲区溢出（CWE-122），CVSS评分为6.8（中等）。攻击者可以利用不安全的HTT
2026-05-27 归档
今日共收录 1142 条安全情报，包含 375 个 CVE，381 篇安全通告，以及 103 篇研究论文。
← 返回归档列表Ghost in the Binder: Binder Transaction Redirection Attacks in Android System Services.
本文研究了Android系统服务中的Binder通信机制存在的安全漏洞。Binder是Android应用访问系统服务的主要机制，采用客户-服务器角色模型，通常系统服务作为服务器，应用作为客户端。然而，越来越多的场景需要系统服务充当Binde
Eppendorf BioFlo 320
CVE-2026-7251
CISA发布了一份针对Eppendorf BioFlo 320生物反应器的ICS医疗咨询（ICSMA-26-146-01），披露了一个关键漏洞CVE-2026-7251，CVSS评分9.8。该漏洞源于VNC服务器使用了硬编码密码（CWE-2
ABB AC500 V2
CVE-2025-7745
CISA发布了一份关于ABB AC500 V2可编程逻辑控制器（PLC）中缓冲区超读漏洞（CVE-2025-7745）的咨询通告。该漏洞影响AC500 V2固件版本2.5.2及更早版本（版本2.5.3于2016年发布并修复了该漏洞）。漏洞由
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile 存在代码注入漏洞。该漏洞允许攻击者在受影响的移动设备管理平台上注入恶意代码，可能导致远程代码执行、敏感信息泄露或系统控制权被夺取。由于缺乏具体版本信息，影响范围尚不明确。建议用户
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
知道创宇 Seebug 漏洞平台收录了 TOPSEC 天融信防火墙的一个远程漏洞（编号 SSVID-92331，代号 ELIGIBLEBACHELOR）。目前官方尚未发布详细技术细节，但漏洞被归类为远程利用（Remote Exploit），
A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is...
CVE-2026-9568
A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDo
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS...
CVE-2026-9560
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute
Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
CVE-2026-44632
### Summary A Server-Side Code Injection vulnerability exists in the Yamcs algorithm evaluation engine (`org.yamcs.algor
Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read
Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute r
KnowledgeDeliver flaw exploited as a zero-day to install web shells
Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system
General-Purpose f-DP Estimation and Auditing in a Black-Box Setting.
本文研究差分隐私（DP）的精细变体——f-差分隐私（f-DP）的统计评估与审计方法。f-DP通过一个函数f描述隐私损失，相较于标准ε-DP具有更紧的组合性质，但实际验证机制的隐私保证仍具挑战，尤其在黑盒场景下。现有f-DP审计方法通常需要预
Leaking Arbitrarily Many Secrets: Any-out-of-Many Proofs and Applications to RingCT Protocols.
本文针对现有RingCT（环机密交易）协议在处理多输入交易时效率低、匿名性弱的问题，提出了一种新型的任意多证明（any-out-of-many proof）方案。该方案是一种对数大小的零知识证明，用于证明公开列表中存在任意数量的秘密，且不泄
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
KnowledgeDeliver LMS Flaw Exploited to Deploy Godzilla and Cobalt Strike
CVE-2026-5426
A now-patched high-severity security flaw affecting Digital Knowledge KnowledgeDeliver, a Learning Management System (LM
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret...
CVE-2026-5260
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key excha
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
CVE-2026-44645
## Summary The `renderLimit` option — documented in `docs/source/tutorials/dos.md` as the mechanism that "mitigates thi
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts
CVE-2026-44176
### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access page