Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass
CVE-2026-44180
### Summary Jupyter Enterprise Gateway has a prohibited UID and GID feature that by default prevents launching kernels
2026-06-04 归档
今日共收录 1001 条安全情报，包含 200 个 CVE，398 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering
CVE-2026-44182
### Summary The environment variables used during the rendering of the Kubernetes manifest allow YAML injection, enabli
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution
CVE-2026-44181
### Summary The environment variables (`KERNEL_XXX`) used during the rendering of the Kubernetes manifest are vulnerabl
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
CVE-2026-42342
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
CVE-2026-42211
When using React Router v7 in [Framework Mode](https://reactrouter.com/start/modes#framework), there exists a combinatio
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
CVE-2026-40181
Certain URLs passed to the `redirect` function can trigger an open redirect to an external domain depending on the level
React Router has stored XSS via unescaped Location header in prerendered redirect HTML
CVE-2026-33244
When using React Router v7 [Framework Mode](https://reactrouter.com/start/modes#framework) with [Pre-rendering](https://
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix...
CVE-2026-46244
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read
Mandiant 发布报告称，有攻击者利用 ViewState 反序列化漏洞针对 KnowledgeDeliver 实施攻击。ViewState 反序列化漏洞通常出现在 ASP.NET 应用中，攻击者通过构造恶意的 ViewState 数据
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-45247
2026年6月3日，美国网络安全与基础设施安全局（CISA）将编号为 CVE-2026-45247 的漏洞添加至其已知被利用漏洞（KEV）目录。该漏洞存在于 Mirasvit Full Page Cache Warmer 组件中，属于反序列
Beyond Phish: Toward Detecting Fraudulent e-Commerce Websites at Scale.
该论文聚焦于欺诈性电子商务网站（FCWs）的检测问题，这类网站包括虚假购物网站、虚假慈善机构和加密货币诈骗网站等，但现有安全生态系统（如反钓鱼系统）对FCWs关注不足，且缺乏大规模缓解系统和公开数据集。作者首先提出了一种通过众包自动收集FC
Automata-Based Automated Detection of State Machine Bugs in Protocol Implementations.
该论文提出了一种基于自动机的黑盒技术，用于自动检测有状态网络协议实现中的状态机漏洞。有状态安全协议的实现需要维护一个状态机来跟踪协议进展，管理消息的类型和顺序以及加密材料，而状态机错误（即状态机bug）可能导致严重安全漏洞。该方法以协议的状
Towards a Rigorous Statistical Analysis of Empirical Password Datasets.
本文针对密码安全性中的一个核心挑战——刻画攻击者的猜测曲线（即攻击者在G次猜测内破解随机用户密码的概率）进行严谨的统计分析。由于攻击者的猜测策略和用户密码分布均未知，作者遵循Kerckhoffs原则，分析一个了解密码分布的最优攻击者的性能。
Evaluating the Usability of Differential Privacy Tools with Data Practitioners.
本文评估了四种Python开源差分隐私工具（DiffPrivLib、Tumult Analytics、PipelineDP和OpenDP）的可用性。研究背景是差分隐私（DP）已成为隐私保护数据分析的黄金标准，但在实际数据集和系统中实施仍具挑
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
Microsoft Threat Intelligence 披露了一起大规模 npm 供应链攻击活动，代号 Miasma。攻击者入侵了 Red Hat 的 npm 组织 @redhat-cloud-services，篡改了超过 90 个版本