Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
CVE-2025-5777
根据The Hacker News报道，与Anubis勒索软件操作相关的威胁演员被观察到利用Citrix Bleed 2漏洞（CVE-2025-5777）获取初始访问权限。该漏洞存在于Citrix产品中，允许未经身份验证的远程攻击者绕过认证
2026-07-04 归档
今日共收录 996 条安全情报，包含 192 个 CVE，454 篇安全通告，以及 95 篇研究论文。
← 返回归档列表LaunchServer FileServerHandler has an unauthenticated path traversal issue
CVE-2026-54617
### Summary An unauthenticated path traversal in the LaunchServer HTTP file server (`FileServerHandler`) lets any remote
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected...
CVE-2026-14617
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function Gatewa
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a...
CVE-2026-58523
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over
Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose...
CVE-2026-58522
Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose...
CVE-2026-58300
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an...
CVE-2026-58299
Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execu
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android...
CVE-2026-58296
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android...
CVE-2026-58297
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based)...
CVE-2026-58289
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB
CVE-2026-49360
### Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulner
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
CVE-2026-49353
## Summary The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only a
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
CVE-2026-49352
### Summary 9router uses a publicly known hardcoded string `"9router-default-secret-change-me"` as the fallback of JWT s
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Understanding Security Issues in the NFT Ecosystem.
该论文首次系统性地研究了非同质化代币（NFT）生态系统的市场动态与安全威胁。NFT 作为数字艺术收藏品和投资工具，在过去一年经历了交易量激增和高价值资产销售的爆发式增长，但其市场基础设施和智能合约的安全性尚未得到充分关注。现有的学术工作主要
Label Inference Attacks Against Vertical Federated Learning.
本文针对纵向联邦学习（VFL）中的标签推断攻击提出了一种名为KD-k（知识蒸馏结合k-匿名）的防御框架。在VFL中，多个参与方持有垂直划分的数据，共同训练机器学习模型，其中标签仅由聚合服务器（标签所有者）持有，旨在保护标签隐私。然而，已有研
Back-Propagating System Dependency Impact for Attack Investigation.
该论文聚焦于系统审计数据上的因果分析在攻击调查中的应用。给定一个感兴趣事件（POI，如可疑文件创建触发的告警），传统的因果分析会构建一个包含大量节点和边的依赖图，通常超过10万条边，导致安全分析师难以审查。论文通过观察多种攻击的依赖图，发现
NetRadar: Enabling Robust Carpet Bombing DDoS Detection.
地毯式轰炸攻击（Carpet Bombing Attack）是分布式拒绝服务（DDoS）的一种新兴变种，它同时向受害网络内的多个服务器发送流量，使每流的恶意吞吐量极小以规避检测。聚合后的恶意流量会淹没网络接入点（如网关），造成服务中断。此外
Wolverine: Fast, Scalable, and Communication-Efficient Zero-Knowledge Proofs for Boolean and Arithmetic Circuits.
本文提出了一种名为Wolverine的新型零知识证明（ZK）协议，旨在同时满足布尔电路和算术电路的高效、可扩展和低通信开销。现有的ZK协议要么证明者开销大（内存使用高），要么通信复杂度较高（每门至少κ比特，κ为计算安全参数）。Wolveri
Cross-Domain Access Control Encryption: Arbitrary-policy, Constant-size, Efficient.
该论文提出了一种跨域访问控制加密（ACE）方案，解决了现有ACE方案中无法同时实现任意策略、常量大小密文和高效清洗的问题。现有方案要么依赖指数级密文大小的混淆或格基假设，要么仅支持简单策略，且需要私有的清洗密钥持续在线。作者首次提出了无需清