Acknowledgements
Acknowledgements
2026-06-10 归档
今日共收录 1730 条安全情报，包含 831 个 CVE，478 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CISA Adds Three Known Exploited Vulnerabilities to Catalog
CVE-2026-20245 · CVE-2026-7473 · CVE-2026-11645
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of acti
Chimera: Harnessing Multi-Agent LLMs for Automatic Insider Threat Simulation.
内部威胁是企业安全领域持续存在的重大风险，但由于恶意行为常隐藏于细微的用户活动中，在复杂企业环境下难以检测。现有基于机器学习的内部威胁检测（ITD）技术受限于高质量、真实训练数据的缺乏——公共数据集规模小，合成数据集缺乏泛化性、丰富语义和真
A Deployment-Oriented Framework for Explainable AI-Assisted eBPF/XDP Mitigation at the IoT Edge
本文提出了一种面向部署的可解释人工智能辅助 eBPF/XDP 缓解框架，专门针对物联网边缘网关设计。物联网环境由异构、资源受限的设备组成，这些设备安全配置薄弱、服务暴露、日志记录有限、补丁更新困难且生命周期长。传统的基于签名和阈值的控制方法
QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the...
CVE-2025-59382
QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication...
CVE-2026-41706
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser
OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image...
CVE-2026-25860
OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that al
OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated...
CVE-2026-34417
OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbit
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
CVE-2026-48030
### Summary An OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execu
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect...
CVE-2026-48303
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerabil
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side...
CVE-2026-47938
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)
ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting ...
CVE-2026-47933
ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that c
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation...
CVE-2026-47928
ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could re
OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated...
CVE-2026-34416
OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbit
UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151...
CVE-2026-11799
UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 1
Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting...
CVE-2026-25557
Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php
nebula-mesh's web UI lacks CSRF tokens on /ui/* mutating endpoints
CVE-2026-47725
Every `/ui/*` POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. `SameSite
FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString
CVE-2026-47720
## Summary The TDengine DAQ storage connector's `escapeTdString` at `server/runtime/storage/tdengine/index.js:10` doubl
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
CVE-2026-47719
## Summary An unauthenticated attacker (Alice) connects to FUXA's Socket.IO endpoint and emits a `device-webapi-request
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
CVE-2026-47693
Description: ### Summary Poweradmin v4.4.0 is vulnerable to CSV Injection (Formula Injection) in its log export functi