OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
CVE-2026-53859
### Summary Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, a request path that ac
2026-06-19 归档
今日共收录 997 条安全情报，包含 210 个 CVE，375 篇安全通告，以及 115 篇研究论文。
← 返回归档列表OpenClaw: Exec allowlist could miss side effects from transparent command wrappers
CVE-2026-53848
### Summary Exec allowlist could miss side effects from transparent command wrappers. In affected versions, a command r
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
CVE-2026-54683
## Summary A previous advisory (CVE-2026-49463 / GHSA-qpm9-h556-mwxm) reported that any logged-in user could download a
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text...
CVE-2026-12048
Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL
AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文由先知社区发布，探讨了AI Agent（人工智能代理）在信任边界方面的安全风险，重点分析从中转API到Agent Tool Call过程中可能发生的供应链劫持攻击。文章指出，AI Agent在调用外部工具时，由于信任边界的模糊性，攻击者
Processing Dangerous Paths - On Security and Privacy of the Portable Document Format.
PDF是当前文档交换的事实标准，用户经常需要打开来自不可信来源（如电子邮件附件或互联网下载）的PDF文件。然而，PDF标准的丰富特性也为攻击者提供了可乘之机。本论文作者并非关注常见的安全实现漏洞，而是系统性地分析了PDF文件结构本身固有的“
Fuzzy Message Detection.
本文提出了一种新型密码学原语——模糊消息检测（Fuzzy Message Detection，FMD），允许远程存储云帮助客户端以一定的假阳性率进行模糊检测，从而保护客户端隐私，不向不可信的云暴露确切匹配的消息。现有公钥方案需要多个公钥生成
Appenzeller to Brie: Efficient Zero-Knowledge Proofs for Mixed-Mode Arithmetic and Z2k.
零知识证明是许多安全系统中的关键密码学组件，但传统零知识证明通常基于固定有限域（如素数域）上的算术运算，这限制了它们在表达复杂程序时的灵活性，因为某些操作在特定域中更为高效。例如，现代计算机普遍采用32位或64位整数算术，而固定有限域难以直
Verifying Table-Based Elections.
该论文关注电子投票系统的可验证性问题。传统上，可验证性依赖于复杂的密码学协议，选民难以自行验证。作者提出了一种基于简单表格的可验证投票方案，选民只需进行基本的检查步骤（如匹配数字、核对表格）即可验证投票的正确性，几乎无需密码学知识。论文详细
Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)
### Summary The Docker API server applied its SSRF destination check (`validate_url_destination`) on the non-streaming
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)
## Summary Two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Image Prompt Reconstruction Attacks on Distributed MLLM Inference Frameworks
该论文研究了分布式多模态大语言模型（MLLM）推理框架中图像提示的隐私泄露风险。在分布式架构中，多个消费级设备协同完成推理，中间嵌入（intermediate embeddings）需要在参与者之间传输。已有工作表明文本嵌入可能泄露用户提示
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
### Summary The Docker API server accepted a request-supplied `browser_config.extra_args`, which flowed into Chromium's
Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE
### Summary When the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input
Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<d...
CVE-2026-12046
pgAdmin 4 的 SQL 编辑器蓝图中的两个端点（DELETE /sqleditor/close/<trans_id> 和 POST /sqleditor/initialize/sqleditor/update_connection/
PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger...
CVE-2026-56077
PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows