CustomProcessingUnit: Reverse Engineering and Customization of Intel Microcode.
本文提出了第一个针对 Intel 微码的静态和动态分析框架。微码是 x86 处理器内部用于将复杂指令分解为简单微操作的抽象层，但 Intel 对其细节保密，且微码补丁经过签名和加密以防止未授权修改。此前研究已恢复 Goldmont (Ato
2026-06-04 归档
今日共收录 1001 条安全情报，包含 200 个 CVE，398 篇安全通告，以及 115 篇研究论文。
← 返回归档列表A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitiv...
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gatew
React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets
CVE-2026-33245
When using React Router v7's unstable RSC APIs, there exists a potential client-side XSS issue in the RSC redirect handl
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups...
CVE-2026-36606
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of...
CVE-2026-36605
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low numb
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute...
CVE-2026-36607
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
AuthentiSense: A Scalable Behavioral Biometrics Authentication Scheme using Few-Shot Learning for Mobile Platforms.
该论文提出了一种名为 AuthentiSense 的可扩展行为生物特征身份验证方案，专门针对移动平台设计。传统的一次性身份验证技术（如密码、指纹、面部识别）存在被窃取或模仿的风险，且一旦设备解锁后无法持续保护用户隐私。为弥补这一缺陷，基于行
An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro...
CVE-2026-7764
An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versio
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
CVE-2026-49143
### Summary The HTTP handler `/_log` in `lib/server.js` (lines 491–515) of browserstack-runner passes unauthenticated u
browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
CVE-2026-49144
## Summary The HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. T
An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields...
CVE-2026-42840
An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and
Docling: Unsafe Playwright-based HTML Rendering
CVE-2026-44016
### Impact In versions `>= 2.82.0, < 2.91.0`, if the HTML backend was explicitly configured for rendering (rendering opt
malla: Stored XSS via Meshtastic node names in multiple frontend pages
CVE-2026-43980
Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link...
CVE-2026-46245
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD i
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree...
CVE-2026-46251
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of...
CVE-2026-46263
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder i
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound...
CVE-2026-46260
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node()
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an...
CVE-2026-20233
A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote at