Surveilling the Masses with Wi-Fi-Based Positioning Systems.
本文研究了苹果Wi-Fi定位系统（WPS）的隐私安全隐患。WPS是现代移动设备通过附近Wi-Fi接入点（AP）的BSSID来定位自身位置的服务。作者发现，苹果的WPS可被滥用，从而造成全球范围的隐私威胁。他们提出了一种攻击方法，攻击者无需特
2026-06-06 归档
今日共收录 1443 条安全情报，包含 665 个 CVE，387 篇安全通告，以及 120 篇研究论文。
← 返回归档列表The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to...
CVE-2026-8438
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable...
CVE-2026-8608
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verifi
An input validation command execution vulnerability exists in the browser management pipeline of...
CVE-2026-25623
An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Mana
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface...
CVE-2026-25624
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista E
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat...
CVE-2026-25622
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Ge
An encrypted password command injection vulnerability exists in the Captive Portal application...
CVE-2026-25620
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge
A Reports application infrastructure vulnerability exists in Arista Edge Threat Management -...
CVE-2026-25621
A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Fire
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
CVE-2026-47761
### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted `data-mce-*`
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
CVE-2026-47762
### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and injec
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
CVE-2026-47759
### Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style).
praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
CVE-2026-47419
## Summary **Type:** Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{wor
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass...
CVE-2026-10580
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrat
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
CVE-2026-47731
## 1. Summary The Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating pa
Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read
Mandiant发布报告指出，攻击者正在利用KnowledgeDeliver软件中的ViewState反序列化漏洞进行渗透。ViewState反序列化是.NET框架中常见的漏洞类型，攻击者可通过发送特制序列化数据触发远程代码执行，进而获取系
AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文探讨了AI Agent在调用外部API和内部工具时存在的信任边界问题，重点分析了从中转API到Agent Tool Call的供应链劫持攻击向量。文章指出，攻击者可能通过篡改中间API响应、劫持Tool Call流程或注入恶意工具调用来
CISA Adds One Known Exploited Vulnerability to Catalog
CVE-2026-28318
2026年6月5日，美国网络安全和基础设施安全局（CISA）将CVE-2026-28318添加到已知被利用漏洞目录（KEV）。该漏洞影响SolarWinds Serv-U产品，属于不受控制的资源消耗漏洞（Uncontrolled Resou
What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction.
对抗样本（AEs）对深度神经网络（DNN）在安全关键领域（如自动驾驶）的应用构成严重威胁。现有防御方案存在局限性：只能防御部分对抗样本，或导致合法输入准确率明显下降，且多数无法抵御自适应攻击（即攻击者知晓防御机制并针对性生成对抗样本）。本文
Chromium: CVE-2026-11092 Insufficient policy enforcement in DevTools
CVE-2026-11092
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium: CVE-2026-11039 Uninitialized Use in Skia
CVE-2026-11039
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P