OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
CVE-2026-48480
The codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final ch
2026-06-25 归档
今日共收录 1364 条安全情报，包含 629 个 CVE，391 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（EPMM）是一款移动设备管理解决方案，用于集中管理企业移动设备。该漏洞被标记为代码注入漏洞，可能允许攻击者在未授权的情况下向系统注入恶意代码。虽然具体成因和触发条件未公开，但代码
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote...
CVE-2026-13032
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially per
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote...
CVE-2026-13028
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially per
AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文标题为《AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持》，发表于先知社区。文章重点分析了AI Agent在与外部API和工具交互时的信任问题，指出供应链劫持可能发生在多个环节，包括中转AP
Malicious Edge extension abuses Native Messaging as bridge to malware
BleepingComputer 报道了一种名为 'Edgecution' 的恶意 Microsoft Edge 浏览器扩展，被用于勒索软件攻击中，通过滥用 Native Messaging 功能作为桥梁，从浏览器沙盒中逃逸并部署基于 Py
Keep Your Friends Close, but Your Routeservers Closer: Insights into RPKI Validation in the Internet.
本文对互联网中RPKI（资源公钥基础设施）部署的过滤效果进行了大规模测量研究。IP前缀劫持是一种严重的路由安全威胁，攻击者通过伪造BGP公告重定向流量。RPKI通过密码学验证路由来源，但只有网络运营商实际过滤无效路由才能发挥效果。作者改进了
The EMV Standard: Break, Fix, Verify.
该论文对EMV（Europay, Mastercard, Visa）支付协议标准进行了系统性的形式化安全分析。EMV是国际智能卡支付协议标准，全球超过90亿张卡片使用该标准。尽管标准宣称安全，但此前已发现多种由逻辑缺陷导致的安全问题，这些缺
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike和Zscaler宣布合作，将持续身份安全集成到零信任访问架构中。该合作旨在结合CrowdStrike的端点检测与响应（EDR）能力以及Zscaler的零信任网络访问（ZTNA）解决方案，实现基于用户身份、设备状态和行为
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6
CVE-2026-10086 · CVE-2026-12053 · CVE-2026-10712
On June 24, 2026, we released versions 19.1.1, 19.0.3, 18.11.6 for GitLab Community Edition (CE) and Enterprise Editi
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are seriali...
CVE-2026-55570
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four o...
CVE-2026-54158
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell render
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing </style> breaks out of its surrounding <style> tag when renderSnippet(...
CVE-2026-54067
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing breaks out o
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database)...
CVE-2026-50551
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scrip
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command ...
CVE-2026-12851
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command ...
CVE-2026-12850
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command ...
CVE-2026-12849
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBo...
CVE-2026-12847
GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-48