praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
CVE-2026-47413
## Summary **Type:** Privilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members
2026-06-02 归档
今日共收录 1188 条安全情报，包含 407 个 CVE，402 篇安全通告，以及 101 篇研究论文。
← 返回归档列表Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read
Mandiant于2026年6月2日发布威胁情报，披露针对KnowledgeDeliver应用的ViewState反序列化漏洞的野外利用。该漏洞允许攻击者通过构造恶意的ViewState数据在目标服务器上执行任意代码。KnowledgeDe
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of...
CVE-2026-10293
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/formF
praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
CVE-2026-47412
## Summary **Type:** Authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint
praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
CVE-2026-47415
## Summary **Type:** Insecure Direct Object Reference. The issue CRUD endpoints (`GET / PATCH / DELETE /workspaces/{wor
praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}
CVE-2026-47411
## Summary **Type:** Authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{wor
praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
CVE-2026-47417
## Summary **Type:** Insecure Direct Object Reference. The comment endpoints (`POST /workspaces/{workspace_id}/issues/{
praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
CVE-2026-47418
## Summary **Type:** Insecure Direct Object Reference. The project CRUD endpoints (`GET / PATCH / DELETE /workspaces/{w
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure....
CVE-2026-40965
Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vul
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
CVE-2026-47428
## Summary Vitest browser mode served `/__vitest_test__/` with the `otelCarrier` query parameter inserted directly into
When Vitest UI server is listening, arbitrary file can be read and executed
CVE-2026-47429
### Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the net
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2024-21182
2026年6月1日，美国网络安全与基础设施安全局（CISA）将CVE-2024-21182添加到已知被利用漏洞（KEV）目录中。该漏洞是Oracle WebLogic Server中的一个未指定漏洞，根据证据已被积极利用。CISA依据具有约
Smarter Contracts: Detecting Vulnerabilities in Smart Contracts with Deep Transfer Learning.
本文提出了一种名为ESCORT的深度学习框架，用于检测以太坊智能合约中的多种漏洞类型。传统检测方法通常只针对单一或少数漏洞类型，且扩展到新类型时需要大量重新设计。ESCORT采用通用特征提取器学习合约字节码的通用语义，并针对每种漏洞类型设置
Hardening Deep Neural Network Binaries against Reverse Engineering Attacks.
本文针对深度神经网络（DNN）二进制的逆向工程攻击提出了一种加固方案。DNN模型因其训练过程中涉及的专业知识、机密数据和高昂开发成本而成为专有资产。经过充分训练的DNN模型通常被编译成DNN二进制文件，以便在边缘设备、云基础设施等各种平台上
@agenticmail/mcp Missing Authentication for Critical Function
# AgenticMail MCP HTTP authorization bypass ## Summary `@agenticmail/mcp` exposes a Streamable HTTP transport when sta
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Dynamic Vulnerability Patching for Heterogeneous Embedded Systems Using Stack Frame Reconstruction.
该论文提出了一种名为 StackPatch 的动态漏洞修复框架，专门针对资源受限且要求持续运行的嵌入式设备（如医疗设备、软PLC等）。现有动态补丁技术不适用于嵌入式系统，因为这类设备计算能力和内存有限，且缺乏足够的空闲内存来支持传统补丁机制