Chromium: CVE-2026-12452 Use after free in Downloads
CVE-2026-12452
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
2026-06-20 归档
今日共收录 996 条安全情报，包含 203 个 CVE，413 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Chromium: CVE-2026-12443 Use after free in Web Authentication
CVE-2026-12443
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-12447 Heap buffer overflow in WebRTC
CVE-2026-12447
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-12441 Use after free in File Input
CVE-2026-12441
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-12451 Use after free in DigitalCredentials
CVE-2026-12451
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-12446 Insufficient data validation in Passwords
CVE-2026-12446
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-12445 Use after free in Extensions
CVE-2026-12445
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-12440 Use after free in DigitalCredentials
CVE-2026-12440
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-12439 Use after free in Digital Credentials
CVE-2026-12439
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
CVE-2026-48582
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected
CVE-2026-55866
### Impact Under concurrency, `CheckPermission` and `CheckBulkPermissions` can return `PERMISSIONSHIP_HAS_PERMISSION` f
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft...
CVE-2026-32208
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)
Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
CVE-2026-54762
## Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
CVE-2026-11769
We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Web Platform Threats: Automated Detection of Web Security Issues With WPT.
本文提出了一种自动化检测Web浏览器客户端安全机制缺陷的实用框架。该框架利用Web Platform Tests（WPT）这一跨浏览器测试套件，自动收集浏览器执行轨迹，并将其与Web不变式进行匹配。Web不变式是用一阶逻辑表示的Web机制预
Deciphering Textual Authenticity: A Generalized Strategy through the Lens of Large Language Semantics for Detecting Human vs. Machine-Generated Text.
本文针对检测机器生成文本（Machine-Generated Text, MGT）这一关键安全问题进行系统研究。随着大型语言模型（LLM）如GPT-4和Dolly的普及，MGT在学术论文、社交媒体等多个领域泛滥，现有检测方法面临两大局限：一
Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigm.
随着大型语言模型（LLM）的快速发展，其被恶意利用生成钓鱼内容的威胁日益严重。攻击者可以利用LLM生成无拼写错误且主题针对性强的钓鱼邮件，绕过传统基于语义的检测方法。现有检测方法要么因缺乏明确语言特征而失效，要么因计算成本高、依赖底层模型性
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4....
CVE-2026-48794
CVE-2026-48794 是 Authelia 开源身份认证和授权服务器中的一个安全漏洞，影响版本 4.36.0 至 4.39.19。该漏洞源于在特定边缘情况下对域名的规范化处理缺失，导致访问控制规则可能被跳过。具体利用条件极为苛刻，包