DNSBomb: A New Practical-and-Powerful Pulsing DoS Attack Exploiting DNS Queries-and-Responses.
本文提出了一种名为DNSBomb的新型脉冲式拒绝服务（DoS）攻击。攻击者利用DNS协议中多个固有的良性机制（如超时、查询聚合、响应快速返回）将其转化为恶意攻击向量。具体而言，攻击者以低速率发送大量DNS查询，借助查询聚合和响应放大机制，使
2026-06-07 归档
今日共收录 735 条安全情报，包含 30 个 CVE，368 篇安全通告，以及 77 篇研究论文。
← 返回归档列表A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown...
CVE-2026-11406
A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpncl
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to...
CVE-2026-8438
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable...
CVE-2026-8608
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verifi
An input validation command execution vulnerability exists in the browser management pipeline of...
CVE-2026-25623
An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Mana
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface...
CVE-2026-25624
An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista E
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat...
CVE-2026-25622
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Ge
An encrypted password command injection vulnerability exists in the Captive Portal application...
CVE-2026-25620
An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge
A Reports application infrastructure vulnerability exists in Arista Edge Threat Management -...
CVE-2026-25621
A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Fire
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
CVE-2026-47761
### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted `data-mce-*`
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
CVE-2026-47762
### Impact Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and injec
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
CVE-2026-47759
### Impact Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style).
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass...
CVE-2026-10580
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrat
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
CVE-2026-47731
## 1. Summary The Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating pa
Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read
Mandiant 于2026年6月7日发布报告，披露了一起针对 KnowledgeDeliver 产品的 ViewState 反序列化漏洞的野外利用事件。攻击者利用该漏洞实现远程代码执行，进而控制目标系统。Mandiant 将此次攻击归因于
AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文探讨了AI Agent在调用外部工具（Tool Call）时面临的供应链劫持风险。核心问题是：当AI Agent通过中转API与第三方服务交互时，攻击者可能篡改API响应或工具调用链，从而劫持Agent的行为。例如，攻击者可以注册恶意工
TuDoor Attack: Systematically Exploring and Exploiting Logic Vulnerabilities in DNS Response Pre-processing with Malformed Packets.
本论文系统性地研究了DNS响应预处理过程中的逻辑漏洞，提出了一类名为TuDoor的新型攻击。作者通过深入分析DNS RFC标准和多种DNS软件实现，发现了三种此前未知的逻辑漏洞类型，并基于这些漏洞设计了三种攻击方式：DNS缓存投毒、拒绝服务
Fuzzy Message Detection.
本文提出了一种新型的密码学原语——模糊消息检测（Fuzzy Message Detection, FMD），其核心思想是在远程存储云上实现带有假阳性率的模糊检测，从而保护客户端隐私，不向不可信的云泄露确切的匹配消息。现有的基于公钥的方案需要
RandPiper - Reconfiguration-Friendly Random Beacons with Quadratic Communication.
随机信标（Random Beacon）是一种持续提供公开随机性的服务，广泛应用于公共彩票、零知识证明等密码学协议。现有随机信标协议在安全性、通信复杂度或可重配置性方面存在妥协：有的牺牲容错性，有的通信开销过高，有的难以动态调整参与节点集合。