CISA and Partners Urge Hardening Automatic Tank Gauge Systems
2026年6月2日，美国网络安全与基础设施安全局（CISA）联合联邦调查局（FBI）、国家安全局（NSA）、能源部（DOE）、环保署（EPA）、运输安全管理局（TSA）、交通部（DOT）及农业部（USDA）发布联合公告，指出近期观察到针对美
2026-06-03 归档
今日共收录 1204 条安全情报，包含 428 个 CVE，390 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read
Mandiant 发布了一份威胁情报报告，详细分析了针对 KnowledgeDeliver 产品的 ViewState 反序列化漏洞利用活动。ViewState 是 ASP.NET 中用于维护页面状态的机制，当应用程序未正确验证序列化数据时
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（原MobileIron）存在代码注入漏洞。该漏洞允许攻击者向受影响系统注入恶意代码，可能在无需用户交互的情况下实现远程代码执行。由于缺乏官方公告和详细技术细节，目前未知具体受影响
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
根据知道创宇/Seebug漏洞平台（SSVID-92331）的公告，天融信（TOPSEC）防火墙存在一个远程利用漏洞，代号为“ELIGIBLEBACHELOR”。该漏洞允许未经身份验证的远程攻击者利用防火墙的特定协议或功能缺陷，在未授权的情
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
知道创宇/Seebug 漏洞库于2026年6月3日收录了一个影响 Fortigate 防火墙的远程代码执行漏洞，代号 EGREGIOUSBLUNDER。该漏洞允许攻击者可能通过未公开的向量远程执行任意代码，从而完全控制受影响的设备。目前漏洞
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
CVE-2025-5777 是 Citrix NetScaler（一款应用交付控制器和负载均衡器）中的内存泄漏漏洞。该漏洞可能允许未经身份验证的攻击者通过发送特制请求导致设备内存资源耗尽，从而造成拒绝服务（DoS）或性能下降。由于缺乏官方详
Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
2026年6月，微软威胁情报团队披露一起大规模npm供应链攻击活动，代号Miasma。攻击者通过入侵Red Hat旗下的@redhat-cloud-services npm包，在超过90个版本中嵌入了恶意代码。该恶意代码在开发者安装或更新这
A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the...
CVE-2026-10703
A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRo
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity...
CVE-2026-7201
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2025-48595 · CVE-2022-0492
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active
A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c of th...
CVE-2026-10703
CVE-2026-10703 是影响 EIPStackGroup OpENer 至 2.3.0 版本的一个安全漏洞。该漏洞存在于 cipmessagerouter.c 文件的 CreateMessageRouterRequestStruct
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription...
CVE-2026-49120
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authen
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism...
CVE-2026-5076
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, a
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0'...
CVE-2026-5074
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_priv
Dräger Perseus A500 software versions 2.00 through 2.02 contains an improper input handling...
CVE-2019-25723
Dräger Perseus A500 software versions 2.00 through 2.02 contains an improper input handling vulnerability that allows ex
Dräger Atlan A350 software versions 1.00 through 1.01 contains an improper input handling...
CVE-2021-4479
Dräger Atlan A350 software versions 1.00 through 1.01 contains an improper input handling vulnerability that allows atta
OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter...
CVE-2026-47117
OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The pr
Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an...
CVE-2026-0611
Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code