Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
CVE-2026-50143
## Actor MCP path authority injection leaks Apify token ### Summary `@apify/actors-mcp-server` version `0.10.7` builds
2026-07-02 归档
今日共收录 1714 条安全情报，包含 914 个 CVE，384 篇安全通告，以及 113 篇研究论文。
← 返回归档列表@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key
CVE-2026-48819
### Summary `dist/clients/core/params.ts` in `@hey-api/openapi-ts` ships a runtime template that is copied verbatim int
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（EPMM）存在代码注入漏洞。该漏洞允许攻击者通过特制请求向受影响组件注入恶意代码，可能导致远程代码执行或未授权访问。由于缺乏官方公告和具体细节，漏洞成因和利用条件尚不明确。攻击者
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
CVE-2026-53943
### Impact When Ghost is behind a shared caching layer that results in cached content being shared between different vi
Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer
CVE-2026-44935
### Impact A vulnerability in Fleet for Rancher Manager affects multi-tenancy environments where different tenants share
Rancher vulnerable to command injection through unsanitized YAML parameter
CVE-2026-44939
### Impact A critical command injection vulnerability has been identified in the Rancher Manager cluster import endpoint
AI Agent 的信任边界：从中转 API 到 Agent Tool Call 的供应链劫持
本文探讨了AI Agent（智能体）在调用外部API和工具时面临的信任边界风险，重点分析了通过中转API和Agent Tool Call实现的供应链劫持攻击路径。AI Agent通常依赖第三方API或内部工具来完成复杂任务，例如通过中转AP
Linux 内核提权 CVE-2026-31431(copy-fail)
CVE-2026-31431
Linux 内核提权 CVE-2026-31431(copy-fail)
OpenClaw MCP SSE redirects could forward Authorization headers
### Summary MCP SSE redirects could forward Authorization headers. In affected versions, a lower-trust caller or config
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
2026年7月2日，CrowdStrike与Zscaler联合发布博客，宣布将持续身份认证融入零信任访问架构。双方合作旨在结合CrowdStrike的端点检测与响应（EDR）能力与Zscaler的零信任网络访问（ZTNA）解决方案，实现基于
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike于2026年7月2日宣布推出面向AI智能体的持续身份解决方案（Continuous Identity for AI Agents）。该产品旨在解决AI代理在自动化操作中面临的身份安全挑战，通过为每个AI代理分配唯一身份
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
[原创]探索CVE-2026-31431的热补丁修复方案
CVE-2026-31431
[原创]探索CVE-2026-31431的热补丁修复方案
Stable Channel Update for Desktop
CVE-2026-13774 · CVE-2026-14420 · CVE-2026-13791 · CVE-2026-13781 · CVE-2026-13780 · CVE-2026-13782 · CVE-2026-13788 · CVE-2026-13793 · CVE-2026-13779 · CVE-2026-14382 · CVE-2026-14417 · CVE-2026-13790 · CVE-2026-13783 · CVE-2026-13775 · CVE-2026-13784 · CVE-2026-13792 · CVE-2026-13794 · CVE-2026-14398 · CVE-2026-14392 · CVE-2026-13777 · CVE-2026-14419 · CVE-2026-13787 · CVE-2026-14385 · CVE-2026-13778 · CVE-2026-13776 · CVE-2026-14427 · CVE-2026-13785 · CVE-2026-13786
The Chrome team is delighted to announce the promotion of Chrome 150 to the stable channel for Windows, Mac and Linux. T
SoK: Towards Effective Automated Vulnerability Repair.
本文是一篇系统化知识综述（SoK），旨在全面梳理自动化漏洞修复（Automated Vulnerability Repair, AVR）领域的研究进展。作者通过系统性文献回顾，收集并分析了近年来发表的AVR相关论文，将现有方法划分为基于规则
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed ...
CVE-2026-58126
PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to
@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preser...
CVE-2026-14198
@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching m
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code...
CVE-2026-50521
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
CVE-2026-49997
In SurrealDB, records can be connected as a graph: a `RELATE` statement creates an edge record between two node records.
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS