CVE-2026-0250 GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (Severity: MEDIUM)

CVE-2026-0250

Palo Alto Networks 发布了关于 CVE-2026-0250 的安全公告，该漏洞影响 GlobalProtect 应用程序。GlobalProtect 是用于远程访问 VPN 的客户端软件，当用户尝试连接至 Portal 或

历史摘要 · 未重新核验 · Palo Alto Security Advisories

Threat IntelligenceExploitation of KnowledgeDeliver via ViewState Deserialization VulnerabilityBy Mandiant • 7-minute read

Mandiant 发布报告称，KnowledgeDeliver 产品中存在 ViewState 反序列化漏洞，并已被攻击者利用。ViewState 是 ASP.NET 用于保存页面状态的一种机制，如果应用程序对 ViewState 数据未进

历史摘要 · 未重新核验 · Mandiant

OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action...

CVE-2026-53827

OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-con

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local...

CVE-2026-53832

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to...

CVE-2026-53821

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest...

CVE-2026-53825

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows aut

历史摘要 · 未重新核验 · GitHub Advisory

Ivanti Endpoint Manager Mobile代码注入漏洞

Ivanti Endpoint Manager Mobile代码注入漏洞

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Huawei Secoway USG firewall weak password

Huawei Secoway USG firewall weak password

历史摘要 · 未重新核验 · 知道创宇 / Seebug

AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持

本文（发表于先知社区）聚焦于AI Agent（智能体）在调用第三方API及Tool（工具）过程中面临的供应链劫持风险。作者指出，AI Agent通常依赖中转API来访问外部服务，并可通过工具调用（Tool Call）执行自定义操作。攻击者可

历史摘要 · 未重新核验 · 先知社区

PFirewall: Semantics-Aware Customizable Data Flow Control for Smart Home Privacy Protection.

本文提出了一个名为PFirewall的智能家居隐私保护系统，旨在解决物联网平台中用户敏感设备数据过度暴露的问题。在现有智能家居平台上，设备一旦绑定，所有数据都会流向上层平台，而其中大部分数据并不触发自动化动作，导致不必要的隐私泄露。PFir

历史摘要 · 未重新核验 · NDSS

Multi-Stage Group Key Distribution and PAKEs: Securing Zoom Groups against Malicious Servers without New Security Elements.

本文研究视频会议应用（如Zoom）中的端到端加密安全性问题。尽管Zoom声称提供端到端加密，但其安全模型假设服务器是可信的，能够正确识别和认证所有与会者。然而，恶意服务器仍可能窃听或冒充与会者。作者提出一种改进方法，通过重新设计密码（pas

历史摘要 · 未重新核验 · IEEE S&P

CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access

CrowdStrike与Zscaler宣布合作，将持续的动态身份验证能力集成到零信任访问框架中。该合作旨在将CrowdStrike Falcon平台的身份威胁检测与Zscaler Zero Trust Exchange的访问控制相结合，实现

历史摘要 · 未重新核验 · CrowdStrike

Citrix NetScaler 内存泄漏(CVE-2025-5777)

CVE-2025-5777

Citrix NetScaler 内存泄漏(CVE-2025-5777)

历史摘要 · 未重新核验 · 知道创宇 / Seebug

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306...

CVE-2026-50086

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing ke

历史摘要 · 未重新核验 · NVD

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an es...

CVE-2026-50083

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-

历史摘要 · 未重新核验 · NVD

CISA Adds One Known Exploited Vulnerability to Catalog

CVE-2026-35273

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active e

历史摘要 · 未重新核验 · CISA Cybersecurity Advisories

PLANET VDR-300NU ADSL Router - 未授权修改DNS

PLANET VDR-300NU ADSL Router - 未授权修改DNS

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Acknowledgements

Acknowledgements

历史摘要 · 未重新核验 · Android Security Bulletin

WarpGuard: Protected-Site Control-Flow Integrity for CUDA SASS Binaries

本文提出 WarpGuard，据作者所知这是首个在已执行 SASS（Shader Assembly）层面为 CUDA 设备二进制实现受保护站点控制流完整性（CFI）的系统。近年来 CUDA 利用研究显示，GPU 内存漏洞可升级为设备端控制流

历史摘要 · 未重新核验 · arXiv cs.CR

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection...

CVE-2026-53838

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes

历史摘要 · 未重新核验 · GitHub Advisory