MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0
MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0
2026-07-01 归档
今日共收录 1573 条安全情报，包含 770 个 CVE，406 篇安全通告，以及 100 篇研究论文。
← 返回归档列表【Cloud Mate】产品退市及停止服务公告
【Cloud Mate】产品退市及停止服务公告
iOS 26.5.2 and iPadOS 26.5.2
iOS 26.5.2 and iPadOS 26.5.2
Chrome for Android Update
Hi, everyone! We've just released Chrome 150 (150.0.7871.63) for Android. It'll become available on Google Play over th
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
随着开源AI基础设施（包括模型服务引擎、智能体平台、模型上下文协议（MCP）生态系统以及语言模型本身）的快速发展，其安全防护工具的发展已明显滞后。本文提出了一个名为AI-Infra-Guard的开源框架，旨在系统化组织AI红队测试。该框架基
Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
该论文针对“类Claw”人工智能代理（如OpenClaw）的安全问题进行了系统研究。类Claw代理是一种常驻进程，具有对凭证、文件、工具和外部服务的持久访问权限，承担系统级任务（如安装包、维护状态、调度子任务、管理I/O），其安全故障后果比
MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems
本论文针对多智能体系统（MAS）中智能体间通信渠道的安全防护问题展开研究。随着MAS被广泛应用于自动化复杂分布式工作流，其内部通信渠道引入了新的攻击面，但现有理解不足且难以防御。作者观察到，信道级别的攻击影响高度不均匀：单一受损边可能占据总
COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies
企业网络在遭受攻击后，安全分析师通常需要数周时间来制定并验证缓解措施，确保不破坏生产环境，同时确认能阻断特定攻击。这一过程依赖专家经验，且无法在生产网络上安全地测试。COHORT提出了首个端到端自动化框架，用于生成可部署的缓解措施。该框架采
Manufactured Confidence: How Memory Consolidation Turns Hearsay into Confident Facts
本文研究LLM agent在跨步骤和跨会话的记忆整合过程中，如何将含糊、试探性的言论转化为自信的、被视为已验证事实的断言。作者构建agent实验环境，发现记忆组件（如mem0、LangMem）会将对话重写为存储的“事实”，后续步骤无条件信任
UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/w...
CVE-2026-7840
CVE-2026-7840是UltraVNC repeater（一个用于VNC连接的中继服务）中的严重安全漏洞，影响版本1.8.2.2及更早。该漏洞存在于其嵌入式HTTP管理服务器中，具体位于repeater/webgui/webutils
UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent o...
CVE-2026-7839
UltraVNC repeater 至 1.8.2.2 版本中存在一个严重的硬编码默认密码漏洞。该软件的 HTTP 管理服务器在首次运行时，若 settings2.txt 文件不存在，会在 repeater/webgui/settings.
The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path va...
CVE-2026-6070
CVE-2026-6070 是 WordPress 的 WP-BusinessDirectory 插件（版本 ≤ 4.0.1）中的一个严重漏洞，允许未经认证的攻击者删除服务器上的任意文件。漏洞位于 JBusinessDirectoryCon
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense