Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（EPMM）存在代码注入漏洞。该漏洞允许攻击者通过特制的输入或请求向受影响的移动设备管理服务器注入恶意代码，可能导致服务器远程控制、数据泄露或系统被接管。由于缺少CVE编号和具体技
2026-06-29 归档
今日共收录 686 条安全情报，包含 46 个 CVE，323 篇安全通告，以及 67 篇研究论文。
← 返回归档列表AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文探讨了AI Agent（人工智能代理）在调用中间API和工具（Tool Call）时存在的信任边界问题，揭示了供应链劫持的风险。文章指出，AI Agent通常依赖外部API或工具来执行任务，如检索信息、执行操作等。攻击者可能通过篡改AP
Not All Edges are Equally Robust: Evaluating the Robustness of Ranking-Based Federated Learning.
本文研究了联邦排序学习（Federated Ranking Learning, FRL）的鲁棒性问题。FRL是一种先进的联邦学习框架，其特点是通信效率高且对投毒攻击具有韧性。与传统联邦学习不同，FRL采用离散排名而非梯度更新，从而大幅降低通
TypeSqueezer: When Static Recovery of Function Signatures for Binary Executables Meets Dynamic Analysis.
该论文针对二进制程序在控制流完整性（CFI）中前向边保护的难题，提出了一种结合静态与动态分析的方法TypeSqueezer，用于更精确地恢复函数签名。传统基于类型的间接调用目标匹配在二进制层面面临类型信息缺失的困境，静态分析只能采用宽松的a
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是 CrowdStrike 与 Zscaler 的合作公告，宣布将 CrowdStrike Falcon 平台的端点检测与响应（EDR）能力与 Zscaler Zero Trust Exchange 集成，实现零信任架构下的持续身份验证
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 6 月 29 日宣布推出针对 AI 代理的持续身份验证功能（Continuous Identity for AI Agents）。该功能旨在解决 AI 代理在自主执行任务时面临的身份与访问管理挑战，
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler（一款应用交付控制器和负载均衡器）存在一个内存泄漏漏洞，编号为 CVE-2025-5777。该漏洞是由于 NetScaler 在处理特定请求时未能正确释放内存，导致持续的内存消耗。攻击者可以通过发送特制的请求
VulHawk: Cross-architecture Vulnerability Detection with Entropy-based Binary Code Search.
代码复用是软件开发中的常见现象，但也带来漏洞的广泛传播，威胁软件安全。随着物联网（IoT）的普及，固件代码复用问题更加突出。二进制代码搜索是发现这些隐藏漏洞的有效途径。然而，IoT固件通常由不同编译器、不同优化级别、不同架构编译而成，现有方
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler...
CVE-2026-13509
A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remov
A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of...
CVE-2026-13508
A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
EPScan: Automated Detection of Excessive RBAC Permissions in Kubernetes Applications.
该论文针对 Kubernetes 生态中第三方应用因过度 RBAC 权限而面临的安全威胁展开研究。Kubernetes 采用 RBAC 机制管理资源访问权限，而第三方应用常被授予超出实际所需的最低权限，从而引入安全风险。已有攻击假设攻击者通
LOKI: State-Aware Fuzzing Framework for the Implementation of Blockchain Consensus Protocols.
区块链共识协议负责协调节点对交易结果达成一致，其实现中的漏洞（包括内存相关和共识逻辑漏洞）可能构成严重威胁。现有的模糊测试工具无法有效处理分布式节点的复杂共识状态，导致生成大量无效数据包，难以触及协议深层逻辑。为此，本文提出LOKI，一个针
A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects...
CVE-2026-13513
A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects the function SegmentId:
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue...
CVE-2026-13514
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown proc
A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown...
CVE-2026-13493
A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file ba
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The...
CVE-2026-13484
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unkn
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container...
CVE-2026-58053
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docke
Firewall for AI
Firewall for AI