Yarbo Android/iOS Mobile Application and Cloud Infrastructure

CVE-2026-10557 · CVE-2026-7368

2026年6月11日，CISA发布了一份关于Yarbo Android/iOS移动应用及其云基础设施的工业控制系统（ICS）公告。该公告披露了两个高危漏洞：CVE-2026-10557（硬编码凭据，CVSS 9.8）和CVE-2026-73

历史摘要 · 未重新核验 · CISA Cybersecurity Advisories

Brickcom Cameras

CVE-2026-50005 · CVE-2026-50245

美国网络安全和基础设施安全局（CISA）发布ICS公告，披露Brickcom摄像头产品中存在两个高危漏洞。CVE-2026-50245涉及/ONVIF端点缺少关键功能认证，允许远程未授权攻击者访问实时快照图像；CVE-2026-50005则

历史摘要 · 未重新核验 · CISA Cybersecurity Advisories

CISA Adds One Known Exploited Vulnerability to Catalog

CVE-2026-10520

2026年6月11日，美国网络安全和基础设施安全局（CISA）将CVE-2026-10520（Ivanti Sentry操作系统命令注入漏洞）添加到其已知被利用漏洞（KEV）目录中，原因是存在主动利用的证据。该漏洞影响Ivanti Sent

历史摘要 · 未重新核验 · CISA Cybersecurity Advisories

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1...

CVE-2026-45173

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validatio

历史摘要 · 未重新核验 · GitHub Advisory

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its...

CVE-2026-45177

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication

历史摘要 · 未重新核验 · GitHub Advisory

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

CVE-2026-48050

### Summary Arc registers Go's `net/http/pprof` handlers at `/debug/pprof/*` via `app.Use(pprof.New())` in `internal/ap

历史摘要 · 未重新核验 · GitHub Advisory

A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4,...

CVE-2026-6338

A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13

历史摘要 · 未重新核验 · GitHub Advisory

python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood

CVE-2026-48045

### Impact `AsyncListener.handle_query_or_defer` retained every truncated (TC-bit) incoming query in `self._deferred[ad

历史摘要 · 未重新核验 · GitHub Advisory

netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

CVE-2026-48040

The netty-incubator-codec-ohttp library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. W

历史摘要 · 未重新核验 · GitHub Advisory

Ivanti Endpoint Manager Mobile代码注入漏洞

Ivanti Endpoint Manager Mobile代码注入漏洞

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows...

CVE-2026-49060

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This iss

历史摘要 · 未重新核验 · GitHub Advisory

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as...

CVE-2026-41005

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML s

历史摘要 · 未重新核验 · GitHub Advisory

Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read

Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute r

历史摘要 · 未重新核验 · Mandiant

AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持

AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持

历史摘要 · 未重新核验 · 先知社区

TranSPArent: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction.

该论文提出了一种名为 TRANSPARENT 的自动化漏洞检测工具，专门用于检测通用单页应用（SPA）中的污点类型漏洞。SPA 框架（如 Vue、React、Angular）将不安全的 DOM API 以新格式重新引入（例如组件参数作为污点

历史摘要 · 未重新核验 · NDSS

CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access

CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access

历史摘要 · 未重新核验 · CrowdStrike

Citrix NetScaler 内存泄漏(CVE-2025-5777)

CVE-2025-5777

Citrix NetScaler 内存泄漏(CVE-2025-5777)

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input

CVE-2026-48108

### Summary `russh` did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the

历史摘要 · 未重新核验 · GitHub Advisory

OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning

CVE-2026-48096

### Description In OpenFGA, when iterator caching is enabled, two distinct check requests can produce the same cache key

历史摘要 · 未重新核验 · GitHub Advisory

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

CVE-2026-48020

## Summary There is a high severity vulnerability in Traefik's `StripPrefix` middleware that allows an unauthenticated

历史摘要 · 未重新核验 · GitHub Advisory