Chromium: CVE-2026-11654 Use after free in CameraCapture
CVE-2026-11655 · CVE-2026-11654
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
2026-06-16 归档
今日共收录 1237 条安全情报，包含 420 个 CVE，450 篇安全通告，以及 98 篇研究论文。
← 返回归档列表Chromium: CVE-2026-11653 Insufficient validation of untrusted input in Extensions
CVE-2026-11654 · CVE-2026-11653
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-11652 Use after free in Extensions
CVE-2026-11652 · CVE-2026-11653
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-11651 Use after free in Network
CVE-2026-11652 · CVE-2026-11651
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw
CVE-2026-0257
Palo Alto Networks has revealed that it has observed "active exploitation" of a recently disclosed PAN-OS vulnerability
HERA: Hotpatching of Embedded Real-time Applications.
该论文提出了一种名为HERA（Hotpatching of Embedded Real-time Applications）的新型热补丁方案，专门针对资源受限的嵌入式实时系统，例如医疗设备、工业控制器等物联网（IoT）设备。传统的内存损坏攻
A Systematic Look at Ciphertext Side Channels on AMD SEV-SNP.
该论文系统性地研究了AMD SEV-SNP（安全加密虚拟化-安全嵌套页表）中的密文侧信道问题。先前工作（CipherLeaks，USENIX Security 2021）仅关注VMSA（虚拟机保存区域）页面的密文变化，通过监控上下文切换时V
Nest: Middleware Bypass on Fastify via Trailing Slash
CVE-2026-54281
### Impact An authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`,
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2026-20262 · CVE-2026-54420
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types.
本文提出 Nyx，一个用于灰盒虚拟机监控器（hypervisor）模糊测试的框架，旨在高效发现 KVM、bhyve 和 Xen 等主流 hypervisor 的漏洞。核心挑战在于 hypervisor 测试需要快速的状态重置和准确的物理内存
PATA: Fuzzing with Path Aware Taint Analysis.
本文提出了一种名为PATA的模糊测试工具，其核心创新在于实现了路径感知的污点分析技术。传统污点分析在处理真实程序中的循环结构时，难以区分同一变量在循环中多次出现的约束条件。PATA通过以下步骤解决该问题：首先，识别约束中使用的变量，并构建代
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
CVE-2026-52693
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
CVE-2026-49769
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
CVE-2026-49781
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.
CVE-2026-49766
Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.
Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.
CVE-2026-49770
Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7,...
CVE-2026-9691
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja For
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
CVE-2026-49768
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.