Chromium: CVE-2026-12464 Use after free in Browser
CVE-2026-12464
此漏洞为 Chromium 浏览器中的 Use After Free（释放后使用）漏洞，CVE 编号 CVE-2026-12464。由于 Microsoft Edge（基于 Chromium）在渲染网页时使用了 Chromium 组件，因此
2026-06-20 归档
今日共收录 996 条安全情报，包含 203 个 CVE，413 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation.
该论文研究了SSH协议的通道完整性安全问题。SSH协议广泛用于安全远程登录和文件传输，其核心是经过身份验证的密钥交换和二进制包协议（BPP）来保证通道的机密性和完整性。然而，作者发现当前广泛使用的三种加密模式（如ChaCha20-Poly1
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate...
CVE-2026-48582
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
CVE-2026-55255
## Summary Insecure Direct Object Reference (IDOR) vulnerability in `/api/v1/responses` endpoint allows an authenticate
Open Redirect Bypass in miniflux-v2
CVE-2026-55185
### Summary The URL restrictions in `miniflux-v2` can be bypassed by attackers, leading to an open redirect vulnerabilit
Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read
CVE-2026-55846
## Summary The built-in HTTP server started by `allure serve` and `allure open` is vulnerable to path traversal. The se
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and...
CVE-2026-56081
Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all...
CVE-2026-11551
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and in
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
CVE-2026-55447
### Summary All components based on `BaseFileComponent` are vulnerable to the following vulnerability: 1. Docling (`Docl
AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文探讨了AI Agent在调用外部工具（Tool Call）时面临的供应链劫持风险。核心问题在于AI Agent的信任边界：当Agent通过中转API与外部服务交互时，攻击者可能劫持API请求或工具调用过程，从而控制Agent的行为或窃取
CISA warns Fortinet users to secure devices after FortiBleed leak
美国网络安全和基础设施安全局（CISA）发布警告，要求Fortinet用户立即采取措施保护其设备，此前名为“FortiBleed”的数据泄露事件曝光了近74,000个防火墙和VPN凭证。这些凭证可能被攻击者用于未经授权访问受影响的网络。CI
Hardening the Internet of Things: Toward Designing Access Control For Resource Constrained IoT Devices.
随着物联网设备的快速普及，安全与隐私威胁日益突出。由于资源受限，许多物联网设备难以实施有效的安全机制，导致攻击面扩大。本文提出了一种基于Linux安全模块（LSM）的访问控制方法，专门针对资源受限的物联网网关。研究者利用TOMOYO和Cai
NetRadar: Enabling Robust Carpet Bombing DDoS Detection.
地毯式轰炸攻击（Carpet Bombing Attack）是分布式拒绝服务（DDoS）的一种日益流行的变种，它同时向受害网络中的多个服务器发送流量，最小化每条流的恶意吞吐量以逃避检测。聚合后的恶意流量会淹没网络接入点（如网关），造成服务中
Anki's local HTTP server does not sufficiently validate requests
## Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. The server
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
## Arbitrary Cloudinary API Parameter Signing in @jhb.software/payload-cloudinary-plugin ### Summary `@jhb.software/pa
Anki: User scripts in iframes have access to the internal Anki API
## Summary Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implement
Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
## Summary `network-ai`'s `ApprovalInbox` (`lib/approval-inbox.ts`) is a shipped, exported, documented feature — *"a we
Craft Commerce: Partial Payment Amount Without Lower Bound Validation
### Summary The `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount.
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike 与 Zscaler 宣布合作，将持续身份安全引入零信任访问架构。该合作旨在整合 CrowdStrike Falcon 平台的端点检测与响应（EDR）能力与 Zscaler 的零信任网络访问（ZTNA）解决方案，以提供