Acknowledgements
Acknowledgements
2026-06-09 归档
今日共收录 1126 条安全情报，包含 321 个 CVE，413 篇安全通告，以及 105 篇研究论文。
← 返回归档列表Diane: Identifying Fuzzing Triggers in Apps to Generate Under-constrained Inputs for IoT Devices.
本文针对物联网设备固件难以提取和仿真的问题，提出了一种利用配套移动应用生成有效且欠约束的模糊测试输入的方法。关键洞察是：在配套应用中存在一类称为“模糊触发函数”的代码位置，它们位于输入验证代码之后、数据变换函数（如网络序列化）之前。通过在这
SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by...
CVE-2026-24315
CVE-2026-24315 是 SAP Fiori Launchpad 中的一个安全漏洞。攻击者可以构造恶意的 URL，当用户点击该 URL 时，会触发 Fiori 域上的任意服务调用。此漏洞允许攻击者通过精心设计的链接窃取用户的凭证，从
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft...
CVE-2026-40128
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of...
CVE-2026-27671
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP
Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test...
CVE-2026-44746
Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an unauthenticate
SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially...
CVE-2026-44757
SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certai
Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker...
CVE-2026-11671
Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a
Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote...
CVE-2026-11672
Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compro
Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote...
CVE-2026-11647
Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had comprom
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to...
CVE-2026-11651
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code i
Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to...
CVE-2026-11638
Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a s
Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote...
CVE-2026-11634
Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially p
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught...
CVE-2026-9669
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError
nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
CVE-2026-47725
Every `/ui/*` POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. `SameSite
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
CVE-2026-47720
## Summary The TDengine DAQ storage connector's `escapeTdString` at `server/runtime/storage/tdengine/index.js:10` doubl
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
CVE-2026-47719
## Summary An unauthenticated attacker (Alice) connects to FUXA's Socket.IO endpoint and emits a `device-webapi-request
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
CVE-2026-47693
Description: ### Summary Poweradmin v4.4.0 is vulnerable to CSV Injection (Formula Injection) in its log export functi
Netty has Insufficient Bailiwick Validation for NS Records
CVE-2026-47691
### Summary Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoni
actual Allows Electron to Run As Node
CVE-2026-42890
## Summary A electron run as node vulnerability was identified in `actual` (macOS application, version `25.x (Electron