Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover
CVE-2026-50545
### Summary A stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the `Environment.spec.runtime.podSpec` /
2026-07-01 归档
今日共收录 1573 条安全情报，包含 770 个 CVE，406 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（EPMM）是一款移动设备管理（MDM）解决方案，用于企业集中管理移动设备与移动应用。该漏洞被归类为代码注入漏洞，可能允许攻击者通过特制的输入注入恶意代码，进而导致任意代码执行或未
Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape
CVE-2026-50564
### Summary Fission's `Environment` CRD exposes `spec.runtime.podSpec` and `spec.builder.podSpec`, which are merged int
AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文探讨了AI Agent在调用外部API和工具时面临的供应链劫持风险。AI Agent通常通过中转API与外部服务交互，或直接调用工具（Tool Call）来执行任务。攻击者可能利用这些接口的信任边界缺陷，通过篡改第三方API响应、劫持工
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike与Zscaler宣布合作，将连续身份安全（Continuous Identity Security）集成到零信任访问架构中。该合作旨在结合CrowdStrike Falcon平台的端点检测与响应（EDR）能力与Zsca
CrowdStrike Announces Continuous Identity for AI Agents
2026年7月1日，CrowdStrike发布了一项名为“Continuous Identity for AI Agents”的新功能，旨在解决AI代理在运行过程中面临的身份和访问安全挑战。随着AI代理（如自动化脚本、机器人、智能体等）在企
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
该漏洞影响 Citrix NetScaler 应用程序交付控制器（ADC）设备。内存泄漏是一种常见的内存管理缺陷，当程序未能正确释放不再使用的内存时，会导致可用内存逐渐耗尽。攻击者可以通过发送精心构造的请求，触发 NetScaler 在处理
Stable Channel Update for Desktop
CVE-2026-13778 · CVE-2026-13774 · CVE-2026-13796 · CVE-2026-13791 · CVE-2026-13794 · CVE-2026-13790 · CVE-2026-13783 · CVE-2026-13784 · CVE-2026-13797 · CVE-2026-13799 · CVE-2026-13800 · CVE-2026-13792 · CVE-2026-13798 · CVE-2026-13785 · CVE-2026-13793 · CVE-2026-13776 · CVE-2026-13801 · CVE-2026-13789 · CVE-2026-13788 · CVE-2026-13787 · CVE-2026-13786 · CVE-2026-13782 · CVE-2026-13781 · CVE-2026-13795 · CVE-2026-13779 · CVE-2026-13777 · CVE-2026-13775 · CVE-2026-13780
The Chrome team is delighted to announce the promotion of Chrome 151 to the stable channel for Windows, Mac and Linux. T
CacheOut: Leaking Data on Intel CPUs via Cache Evictions.
本文提出一种名为 CacheOut 的新型微架构侧信道攻击，针对 Intel 处理器。该攻击利用缓存逐出操作（cache evictions）来泄露 CPU 内部缓冲区中的敏感数据，这些数据本应受到 MDS（微架构数据采样）缓解措施的保护。
A Containerization-Based Backfit Approach for Industrial Control System Resiliency.
本文提出了一种基于容器化的回溯（backfit）方法来增强工业控制系统（ICS）的弹性。传统ICS系统在面临网络攻击或物理故障时往往恢复困难，且难以在不中断运行的情况下进行安全更新。作者设计了一种容器化架构，将关键控制功能封装在轻量级容器中
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Dissertation Research Description: The Potential of SBOMs to Increase Software Supply Chain Security.
该研究论文探讨了软件物料清单（SBOM）在增强软件供应链安全方面的潜力。研究背景指出，软件供应链攻击日益频繁，如SolarWinds事件，凸显了透明度和可追溯性的缺失。核心问题是如何利用SBOM来识别和缓解供应链中的漏洞和风险。研究方法包括
The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all versions up to, ...
CVE-2026-7517
WordPress的Custom Payment Gateways for WooCommerce插件（版本2.1.0及以下）存在存储型跨站脚本（Stored XSS）漏洞，漏洞编号CVE-2026-7517。问题出在'alg_wc_cpg
UltraVNC through 1.8.2.2 uses a cryptographically weak pseudo-random number generator to produce VNC authentication challenge bytes. In rfb/vncauth.c:119-129, the vncRandomBytes...
CVE-2026-44040
该漏洞存在于UltraVNC 1.8.2.2及之前版本中。在文件rfb/vncauth.c的第119-129行，函数vncRandomBytes()使用了cryptographically weak的伪随机数生成器来生成VNC认证挑战字节。
Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl...
CVE-2026-56415
Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable
Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl...
CVE-2026-56413
Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe...
CVE-2026-56700
Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Sch
n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users...
CVE-2026-56350
n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforce
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ...
CVE-2026-56278
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the exp