A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads to incorrect authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem

Ivanti Endpoint Manager Mobile是一款用于管理移动设备的解决方案。根据知道创宇/Seebug漏洞库的信息，该产品存在一个代码注入漏洞。攻击者可能通过向受影响组件发送特制的请求，利用输入验证缺陷注入恶意代码，进而实现未授权操作或敏感信息泄露。目前漏洞细节未完全公开，且尚无官方补丁信息。建议相关用户持续关注Ivanti官方安全公告。

知道创宇 Seebug 漏洞平台收录了一个针对 TOPSEC 防火墙的远程漏洞（代号 ELIGIBLEBACHELOR）。该漏洞允许攻击者远程利用，可能无需认证即可执行任意代码或导致设备完全控制。目前漏洞细节尚未公开，但根据漏洞名称推测属于高危远程利用类型。受影响的 TOPSEC 防火墙版本未知，官方可能尚未发布补丁。建议用户密切关注 TOPSEC 官方安全公告，及时升级固件。

根据知道创宇/Seebug提供的漏洞信息，Fortigate防火墙存在一个名为EGREGIOUSBLUNDER的远程代码执行（RCE）漏洞。由于输入中未提供详细的技术描述，无法获知具体的利用方式和受影响版本。此类漏洞通常允许未经授权的攻击者在目标设备上执行任意代码，可能导致设备完全被控制、数据泄露或网络被渗透。建议相关用户密切关注Fortinet官方安全公告，及时获取补丁或缓解措施。

该论文通过定性研究方法（半结构化访谈）对开源软件供应链中的安全挑战进行了深入分析。研究招募了来自不同背景的参与者，包括开源维护者、贡献者和安全专家，探讨了他们在开源供应链安全方面遇到的困难、当前实践以及改进需求。核心发现包括：开源项目普遍缺乏安全资源（如代码审查、安全测试），维护者面临倦怠和有限时间之间的矛盾；供应链攻击（如依赖混淆、恶意包植入）日益增加但检测手段不足；社区协作中存在信任与安全之间的平衡问题。论文提出了若干改进建议，如加强自动化安全工具、建立安全基线、改进依赖管理实践等。该研究强调了“回馈”机制的重要性，即企业用户应积极向所依赖的开源项目贡献安全补丁和资源，以缓解供应链风险。实验部分主要基于对多个参与者访谈数据的编码和主题分析，得出了一系列具有代表性的主题。该工作为安全社区理解开源供应链安全挑战提供了实证基础，并为政策制定者和从业者指明了改进方向。

该论文提出一种名为 Gethlighting 的实用分区攻击，旨在隔离以太坊全节点，使其与网络其他部分断连数小时，而无需占用（或日食）目标节点的所有对等连接。在 Gethlighting 中，攻击者仅控制目标节点约一半（例如总共 50 个中的 25 个）的对等连接，通过廉价虚拟机即可实现强大的分区效果。攻击的核心是一种低速率拒绝服务（DoS）策略，该策略能有效阻止本地区块链增长数小时，同时不干扰其他以太坊节点操作。论文分析了低速率 DoS 造成的微妙且微不足道的延迟如何演变为强大的区块链分区攻击。Gethlighting 的实际影响包括可扩展性、低成本（同时攻击所有以太坊全节点 24 小时仅需约 5714 美元）以及极易发起。作者在以太坊主网和测试网中，通过受控和真实世界实验验证了攻击的可行性。他们识别了以太坊中若干使攻击成为可能的基础系统特性，并提出需要协议和客户端实现增强的应对措施。以太坊基金会已于 2022 年 9 月承认此漏洞，其中一项应对措施已被接受为 Geth 1.11.0 的热修复。

CrowdStrike与Zscaler宣布合作，将CrowdStrike Falcon Identity Threat Detection（身份威胁检测）能力集成到Zscaler Zero Trust Exchange平台中，实现持续的身份安全验证。该集成旨在解决传统VPN和静态访问控制无法应对的身份盗用、横向移动等威胁。通过结合CrowdStrike的端点遥测和身份分析，与Zscaler的零信任网络访问，企业可以在每次访问请求时实时评估用户风险，并根据风险动态调整访问权限，从而在零信任架构中融入持续身份验证。合作还支持自动化响应，例如检测到可疑身份行为后立即撤销访问令牌或隔离端点。此次合作为安全团队提供了更强的身份威胁可视性和控制能力，减少攻击者可乘之机。

2026年7月6日，CrowdStrike宣布推出面向AI代理的Continuous Identity（持续身份）功能。该功能是CrowdStrike Falcon平台的身份安全扩展，专门针对AI代理（如自动化工具、智能助手、机器人流程自动化等）设计，解决传统静态凭据管理的不足。AI代理通常以非人身份运行，访问敏感数据和系统，但缺乏动态身份验证和授权机制，容易成为攻击目标。CrowdStrike的Continuous Identity通过持续监控代理行为、自动撤销异常访问、基于风险实施条件访问策略，实现零信任身份管理。该功能与CrowdStrike的端点检测响应（EDR）和威胁情报能力集成，能够检测代理相关的异常活动并关联已知威胁。公告中提到，尽管该产品并非直接针对特定勒索软件（如Conti家族），但可以增强对恶意代理活动的防御。CrowdStrike表示，该功能目前可供现有客户使用，并已集成到Falcon平台。此次发布体现了CrowdStrike对新兴AI安全需求的响应，有助于企业保护其AI工作负载。

Citrix NetScaler 内存泄漏(CVE-2025-5777)

PLANET VDR-300NU ADSL Router - 未授权修改DNS

Acknowledgements

本文提出 DiveFuzz，一种通过多样性指令构造来增强 CPU fuzzing 的方法。在 CPU fuzzing 中，全面探索架构状态类似于生成多样化的测试用例，这需要合理的操作码分布以及指令执行结果（通常通过写回数据衡量）的多样性。然而，作者对现有最先进 CPU fuzzer（如 DifuzzRTL、Cascade）的分析发现，它们在 fuzzing 过程中存在写回数据高度重复和操作码分布不平衡的问题。DiveFuzz 通过运行时精细控制指令的操作数并结合上下文语义关联，生成具有多样化写回数据和语义关联的指令流。此外，DiveFuzz 引入了一种新颖的变异器，能够监控 fuzzing 过程以动态调整操作码分布，并准确消除误报。实验使用五种常见的覆盖率指标评估，在达到相同覆盖率时，DiveFuzz 的速度比 DifuzzRTL 快 204 倍，比 Cascade 快 114 倍。在四个开源 RISC-V CPU（香山、CVA6、Rocket、NutShell）上测试，共发现 26 个新 bug，其中 15 个已分配 CVE 编号。该工作主要贡献在于：1) 揭示现有 CPU fuzzer 在指令多样性方面的不足；2) 提出通过操作数控制提升写回数据多样性的方法；3) 设计自适应变异器优化操作码分布；4) 在真实硬件上发现大量新漏洞。本文适合硬件安全测试工程师、CPU 设计验证人员以及 fuzzing 技术研究者阅读。

A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesson.php. Such manipulation of the argument user_id leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the affected product appears to have a typo in it.

A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The explo

A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token. The root cause is a lack of valida

Akamai 发布了名为 'Firewall for AI' 的新产品，旨在保护 AI 基础设施免受分布式拒绝服务（DDoS）攻击和其他网络威胁。该产品利用 Akamai 的全球网络和智能边缘平台，提供针对 AI 工作负载的专用防护。标签包括 DDoS、Akamai 和 Botnet，暗示该产品可能专注于检测和缓解涉及僵尸网络的攻击。目前尚无具体攻击事件或漏洞与之关联，文章未提供技术细节或案例研究。

Firefox browsers

Sign in to Cloud

Sign Up for Free Cloud Tier

iOS 26.4.2 and iPadOS 26.4.2

iOS 18.7.8 and iPadOS 18.7.8

iOS 18.7.7 and iPadOS 18.7.7

iOS 26.4 and iPadOS 26.4

Background Security Improvements for iOS, iPadOS, and macOS

iOS 16.7.15 and iPadOS 16.7.15

iOS 15.8.7 and iPadOS 15.8.7

iOS 26.3 and iPadOS 26.3

iOS 18.7.5 and iPadOS 18.7.5

iOS 26.2 and iPadOS 26.2

iOS 18.7.3 and iPadOS 18.7.3

Compressor 4.11.1

iOS 18.7.2 and iPadOS 18.7.2

iOS 26.1 and iPadOS 26.1

iOS 26.0.1 and iPadOS 26.0.1

iOS 18.7.1 and iPadOS 18.7.1

Android Code Search

Android Devices

Secure an Android device

Android 16 QPR2

Mobile network security

iOS 26.5 and iPadOS 26.5

iOS 18.7.9 and iPadOS 18.7.9

iOS 16.7.16 and iPadOS 16.7.16

iOS 15.8.8 and iPadOS 15.8.8

MFSA 2026-49Security Vulnerabilities fixed in Firefox for iOS 151.0

MFSA 2026-52Security Vulnerabilities fixed in Firefox for iOS 151.1

MFSA 2026-53Security Vulnerabilities fixed in Firefox for iOS 151.2

MFSA 2026-55Security Vulnerabilities fixed in Focus for iOS / Klar 151.3.1

MFSA 2026-56Security Vulnerabilities fixed in Firefox for iOS 152.0

【Cloud Mate】产品退市及停止服务公告

iOS 26.5.2 and iPadOS 26.5.2

本文提出了一种针对大型语言模型（LLM）及智能体系统中防护栏（guardrail）的黑盒侦察方法。在现实应用中，LLM常配备防护栏系统以检测并阻止恶意指令。然而，在进行黑盒对抗模拟时，研究人员难以区分防护栏拦截与LLM自身拒绝响应（LLM rejection），这两种情况需要不同的绕过策略，从而影响攻击技术的选择与优化。作者首次提出了一套黑盒防护栏侦察方法论，仅通过HTTP、词汇及时间信号的监控行为来推断目标AI系统中是否存在防护栏，无需任何先验知识。实验表明，该方法能以100%的准确率检测防护栏存在，且在良性交互与恶意交互之间实现统计显著的行为分离（q < 0.001）。此外，该方法还能识别防护栏设计阻止的内容类别，并在未见提示上以平均F1分数98%区分防护栏拦截与LLM拒绝。该研究为AI安全评估提供了重要工具，帮助安全从业者在黑盒场景下更准确地理解系统安全机制。

该论文提出 EvoVuln，一个自动生成智能合约漏洞检测程序化知识的框架。现有基于大语言模型（LLM）的方法存在局限：基于提示的方法依赖人工设计的检测规则，而微调则需要大量标注样本，这在智能合约领域难以获取。EvoVuln 将漏洞检测重新定义为程序化知识进化问题，仅需极少量标注样本即可合成并精炼检测逻辑。其核心机制包括两个部分：一是运行时反转控制（IoC）架构，将检测规则编译为可执行策略，严格解耦确定性控制流与 LLM 语义推理，确保忠实遵循逻辑并产生密集的诊断遥测用于精确定位错误；二是两阶段进化流水线，通过溯因语义调试在没有参数更新的情况下精炼规则：冷启动阶段利用自动生成的边缘案例初始化并压力测试初始规则，少样本进化阶段仅使用每种漏洞类型 5 个漏洞样本和 5 个安全样本将策略锚定到真实世界语义。在五种真实漏洞类型上的评估显示，EvoVuln 达到 71% 的宏平均 F1 分数，优于所有基线。进化得到的程序化知识可跨模型迁移：使轻量低成本模型超过更大的零样本模型 19 个百分点，且无需重新训练即可迁移到其他 LLM，单次进化成本低于 50 美元。该研究适合安全研究员、智能合约开发者及 LLM 应用开发者阅读。

Cloud & Application Security

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

Next-Gen Identity Security

CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security

CrowdStrike Expands Identity Leadership with OpenID and IDPro

cloud architecture assessment

ransomware and multifaceted extortion defense

Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand

The Identity Problem Hiding in AI Agent Deployments

94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey

Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud

该论文提出了一种利用电磁干扰（EMI）信号注入来瘫痪无人机的新型反无人机技术。无人机的姿态控制依赖于惯性测量单元（IMU）提供的传感器数据，若数据被篡改，无人机将无法维持姿态并坠毁。以往的反无人机研究多采用声波共振干扰IMU内部传感器的机械结构，但该方法受限于传感器类型、型号和制造商，且易被其他未受影响的传感器或廉价塑料屏蔽层防御。本文的核心创新在于：通过EMI信号注入，直接干扰IMU与控制单元之间的通信通道，而非传感器本身。实验发现，对于特定控制单元板，无论使用何种传感器，都存在一个独特的敏感频率，在该频率下EMI信号能极大扭曲传感器数据。与通用电磁脉冲（EMP）攻击相比，该方法功率需求更低，且能减少对附近设备电路的永久性损坏。在真实无人机上的实验验证了该攻击的可行性，能瞬间瘫痪无人机。最后讨论了防御该攻击的实际挑战，例如需要识别并屏蔽敏感频率、加强通信通道的抗干扰能力等。论文的主要贡献包括：提出一种不依赖传感器具体型号的通用攻击方法，发现控制单元板上的敏感频率，并通过实验证明了攻击的有效性。该研究适合无人机安全研究人员、嵌入式系统安全工程师以及反无人机系统开发者阅读。

本文针对基于结构光深度相机的3D人脸活体检测系统，发现了一种新的攻击面——DepthFake攻击。攻击者仅凭目标受害者的一张2D照片即可欺骗3D人脸认证系统。该方法首先从2D照片估计人脸3D深度信息，然后利用该深度信息生成精心设计的散斑图案，将其投影到2D照片上，从而使2D照片具备3D认证特性。研究克服了多项实际挑战，包括2D照片深度估计误差、基于结构光的深度图像伪造、RGB图像与深度图像的人脸对齐等问题。在实验室环境中，对腾讯云、百度云、3DiVi三款商业人脸认证系统以及一款商业门禁设备进行了测试。基于50名用户的实验结果显示，DepthFake在真实世界中实现了79.4%的深度攻击成功率和59.4%的RGB-D攻击成功率。该工作揭示了当前3D活体检测技术的安全漏洞，对依赖人脸认证的门禁、支付等系统构成威胁。

本文针对认证数据结构（Authenticated Data Structures）的开发与实现正确性难题，提出了一种基于新关系分离逻辑的形式化证明方法。认证数据结构允许不可信的第三方执行操作并生成可验证的输出证明，但此类系统容易因实现错误导致安全漏洞。作者首先设计了一种关系分离逻辑，用于推理使用抗碰撞哈希函数的程序，该逻辑为类型系统构建了两个语义模型，从而阐释了如何通过类型抽象来强制实现安全性与正确性。基于这些模型，论文进一步证明了库中多项优化的正确性，并展示了如何将优化的、手工编写的认证数据结构实现与自动生成的代码安全链接。所有结果均在 Coq 证明助手中使用 Iris 框架完成机械化验证。该工作为认证数据结构库的可靠实现提供了坚实的理论基础，有助于减少此类系统中的安全缺陷。适合形式化验证、编程语言理论与安全协议交叉领域的研究者阅读。

该论文首次系统性地探讨了基于深度学习的异常检测在安全应用中面临的常态漂移（normality shift）问题。传统异常检测模型通常假设训练与部署数据分布一致（闭世界假设），但真实环境中正常行为分布会随时间变化（如网络流量模式、系统调用序列等），导致模型性能下降。现有研究多关注异常行为或监督学习的概念漂移，而忽略了无正样本（zero-positive）异常检测中常态漂移的挑战。论文提出了 OWAD（Open World Anomaly Detection）框架，该框架通过无监督方式检测常态漂移，无需人工标注；解释漂移原因，帮助运维人员理解变化；并自适应调整模型以恢复检测性能。OWAD 在分布级别（而非实例级别）处理漂移，降低了标注开销。作者在三个安全相关异常检测应用（如 SCADA 系统入侵检测）上使用长期真实数据进行实验，结果表明 OWAD 在适应常态漂移方面优于现有方法，且所需标注更少。论文还提供了案例研究和实际部署建议，并已在 SCADA 安全系统中初步部署。该工作为安全运维中应对数据分布变化提供了实用框架。

该论文针对现代卫星固件的安全性进行了系统性实验分析。研究首先构建了针对卫星固件的威胁分类法，覆盖了从供应链攻击到在轨漏洞利用的多个层面。随后，作者获取了三个真实在轨卫星的固件映像，并基于实际攻击者模型（如无特权攻击者、具有物理访问能力的攻击者等）进行了逆向工程与漏洞挖掘。实验发现了多个安全关键漏洞，包括缺乏身份验证的调试接口、硬编码凭证、缓冲区溢出以及未受保护的敏感数据存储。此外，作者对19名专业卫星开发者进行了问卷调查，从行业视角印证了卫星安全实践的不足。论文揭示了卫星软件安全现状的严峻性，并呼吁业界摒弃“通过隐匿实现安全”的过时假设，加强固件安全设计与审计。

本文提出了一种名为InfoMasker的新型抗窃听系统，旨在防止智能设备麦克风被秘密录音。传统超声波抗窃听方案依靠能量掩蔽，需要高能量才能干扰人声，但超声波在有限能量下只能覆盖短距离且易被对手去除，实用性差。本文转而探索信息掩蔽（informational masking）的思路，深入研究了超声波干扰的传输和覆盖限制，并实现了高效抗窃听系统InfoMasker。核心创新是设计了一种基于音素的噪声（phoneme-based noise），该噪声对去噪方法具有鲁棒性，能有效阻止人类和机器理解被干扰的语音信号。同时优化了超声波传输方法，实现了更高的传输能量和更低的信号失真。实验结果表明，即使在低能量（信噪比SNR=0）下，InfoMasker也能将多种主流语音识别系统的准确率降至50%以下，性能远超现有噪声设计。该研究为隐私保护领域提供了新的抗窃听思路，适合语音安全、隐私增强技术方向的研究人员和工程师阅读。

本文提出 MyTEE，一种在嵌入式设备上构建可信执行环境（TEE）的方案，目标设备缺乏 ARM TrustZone 扩展等关键硬件安全原语（如 TZASC、TZMA、TZPC 和 IOMMU）。MyTEE 仅依赖 CPU 的安全状态，通过精心管理页表来实现内存隔离：利用二级页表（stage-2 page table）将 TEE 与非可信操作系统隔离，并将部分 MyTEE 实现为一个微小的虚拟机监视器。为防止攻击者获得 hypervisor 权限后破坏隔离，确保 hypervisor 的页表不映射 TEE 区域且不可修改。针对恶意 DMA 攻击，MyTEE 实现了一个 DMA 过滤器，用于捕获、验证和模拟对 DMA 控制器的内存映射 I/O（MMIO）操作。在安全 I/O 方面，MyTEE 采用委托方式：非可信操作系统负责向外设发送请求（如 TPM 命令），而 TEE 中不移植设备驱动；仅保护用于外设输出的缓冲区和外设控制器的 MMIO 区域（通过二级页表），并将设备驱动的部分代码块赋予 hypervisor 权限，以访问受保护对象并记录事务日志，供后续可信应用（TA）验证。MyTEE 在 Raspberry Pi 3（Broadcom BCM2837 SoC，不支持 TrustZone 扩展）上实现了概念验证，并演示了三个安全 I/O 示例（硬件 TPM、帧缓冲、USB 键盘），证明了方案的可行性。实验表明，MyTEE 能在缺乏硬件安全原语的嵌入式设备上有效构建 TEE，同时避免在 TEE 中托管完整设备驱动以降低攻击面。

恶意软件分类是网络安全中的重要任务，但实际数据集中常因标注人员缺乏专业知识而包含大量错误标签。以往研究表明，错误标签会严重影响机器学习模型的准确性。尽管在图像识别和文本挖掘领域，已有多种噪声学习方法被提出并取得显著效果，但它们在恶意软件分类场景下的有效性尚未被系统验证。本文首先将代表性及最新的噪声学习方法应用于真实世界的恶意软件分类任务，发现这些方法均无法有效减轻错误标签的影响。通过精心设计的实验，作者揭示出主要原因在于恶意软件数据集存在极端的数据不平衡以及极高的错误标签比例。为此，作者提出了一种名为MORSE的新型噪声学习方法。MORSE对最先进的半监督学习技术进行了定制和扩展，将可能的错误标签样本视为未标注数据，从而避免其负面作用。同时，MORSE集成了样本重加权方法，平衡训练数据中各类样本的使用，以应对数据不平衡挑战。文中在合成数据集和真实数据集上进行了评估，结果显示MORSE显著优于现有噪声学习方法，能最大限度地减少错误标签的影响。本文适合从事恶意软件检测、对抗性机器学习及数据质量研究的安全工程师和研究人员阅读。

该论文是针对反人脸识别（AFR）技术的首篇系统化知识综述（SoK）。近年来，人脸识别（FR）技术在政府和商业领域的快速普及引发了公众对公民自由和隐私的担忧。为此，学术界和工业界提出了多种所谓的“反人脸识别”工具，旨在帮助用户避免非授权的人脸识别。然而，这些工具种类繁多、演进迅速，缺乏统一的分类和分析框架。本文基于FR系统的操作阶段（如采集、特征提取、匹配等）构建了一个系统化的分析框架，用于评估不同AFR方法的优缺点和权衡。研究涵盖了从图像扰动、对抗性伪装到匿名化等多种技术路线，并探讨了社会和技术层面的挑战，如易用性、对抗鲁棒性以及和现有隐私法规的兼容性。主要贡献包括：首次全面梳理AFR研究全景；提出一个可扩展的分类体系；识别出长期存在的开放问题（例如针对自适应攻击的防御、跨场景泛化能力）。该工作适合对人脸识别隐私保护感兴趣的研究人员、政策制定者以及安全从业者阅读。

该论文针对机器学习模型面临的清洁标签后门攻击防御难题，提出了一种名为 PoisonSpot 的新型检测系统。清洁标签后门攻击通过污染训练数据嵌入隐藏行为，且无需修改标签，使得现有防御手段难以有效检测。PoisonSpot 的核心创新在于借鉴动态污点追踪思想，实现了细粒度的训练来源追踪：它能够监控单个训练样本在整个训练过程中对模型参数更新的影响，并基于影响谱线为每个可疑样本分配毒性分数，从而精确识别并剔除携带后门触发器的样本。在多个基准数据集和攻击场景（包括自适应攻击策略）下的实验评估表明，PoisonSpot 相比现有最先进的清洁标签后门防御方法具有显著优势：始终实现高真阳性率、低假阳性率，并有效减轻后门攻击。此外，该系统在重训练和微调等多种训练设置下均能高效运行，展现出良好的鲁棒性和可扩展性。论文详细描述了追踪机制、毒性评分算法以及防御流程，为机器学习安全领域提供了一种精准、可操作的防御方案。

该论文提出了一种名为 BOLT 的新型不经意映射（Oblivious Map, OMAP）加速器，旨在解决可信执行环境（TEE）中因访问模式泄漏而触发的侧信道攻击问题。传统的 OMAP 通过随机重映射和最坏情况填充来隐藏访问模式，但导致性能开销过高。论文指出，这些开销并非本质性的，现代加速器中的高带宽存储器（HBM）提供了新的机会：HBM 的内存通道与处理器核心封装在同一物理封装内，使得窃听 HBM 变得困难（即使对于物理攻击者）。通过适当的隔离，HBM 可以转变为不可观察区域，其中数据和内存痕迹均被隐藏。基于此，BOLT 重新设计了 OMAP，利用 HBM 作为不可观察缓存，首次实现了 O(1)+O(log_2(log_2(N))) 的带宽开销。BOLT 包含三大关键创新：(i) 一种新的 OMAP 算法，利用隔离的 HBM 作为不可观察缓存来加速对大型主机内存的不经意访问；(ii) 一种自托管架构，将执行和内存控制从主机卸载到加速器上，以减轻 CPU 侧的泄漏；(iii) 定制的算法-架构协同设计，以最大化资源效率。作者在 Xilinx U55C FPGA 上实现了 BOLT 原型。评估表明，与最先进的 OMAP（包括 Facebook 的工业实现）相比，BOLT 在初始化和查询时间上分别实现了高达 279 倍和 480 倍的加速。该工作适合对安全硬件加速、可信执行环境、侧信道防御和内存安全感兴趣的研究人员和工程师阅读。

该论文提出了一种快速摊销自举（amortized bootstrapping）方法，用于同态加密（FHE）方案，旨在实现小密钥尺寸和多项式噪声开销。传统的FHE方案通常利用SIMD（单指令多数据）技术并行处理多个消息，但其安全性依赖于超多项式近似因子的格问题的难度，这是一种较强的假设。另一方面，一些轻量级FHE方案具有更快的自举速度，但不支持SIMD，且其安全性仅基于低阶多项式近似因子的格问题，这是一种更弱的假设。为了兼顾两者的优点，Micciancio和Sorrell（ICALP'18）提出了一种摊销自举方法，可以同时处理多个消息，使得每个消息的复杂度达到亚线性，并允许基于多项式近似因子的格问题构建FHE。本文在此基础上进一步优化，实现了更小的密钥和多项式噪声开销，从而在保持安全性的同时提升了效率。实验表明，该方法在密钥尺寸和噪声管理方面具有优势，适用于需要高效同态加密的场景。该研究对于密码学理论特别是同态加密的实际应用具有重要意义。

该论文研究了在启用单播反向路径转发（uRPF）过滤的网络环境下，边界网关协议（BGP）劫持攻击的隐蔽性。uRPF是一种防御机制，旨在通过验证数据包源IP地址的合法性来防止IP欺骗。然而，论文指出，攻击者可以利用uRPF过滤策略的配置差异和局限性，发起更难以检测的隐蔽BGP劫持。作者通过分析和实验，展示了攻击者如何通过控制合法的IP前缀或利用多宿主网络中的过滤漏洞，绕过传统检测方法。主要贡献包括：1) 揭示了uRPF在BGP劫持场景下的安全缺口；2) 提出了新的攻击模型和评估方法；3) 通过模拟实验验证了攻击的可行性和隐蔽性。该研究适合网络运营商、安全研究员及BGP相关技术人员阅读，以理解现有防御的不足并改进网络路由安全。

本文提出了一种名为 GlitchGlück 的引导式硬件故障注入方法，旨在通过物理手段（如电压毛刺、时钟毛刺）在软件执行过程中引入可控的硬件错误，从而使得原本难以利用的软件漏洞（如缓冲区溢出、条件检查绕过）变得可利用。传统上，软件漏洞的利用依赖于软缺陷（如内存损坏、逻辑错误），但现代操作系统和编译器引入了多种缓解机制（如 ASLR、栈保护、CFI），使得纯软件利用变得困难。GlitchGlück 通过精确的时间定位和故障掩码技术，在特定指令执行时注入单比特翻转或瞬态故障，以破坏安全机制或改变控制流。该方法结合了静态分析和动态故障注入，自动识别故障注入的最佳时机和目标寄存器。实验在多个嵌入式平台（如 ARM Cortex-M）和真实漏洞（如心脏出血漏洞的变体）上验证，结果表明 GlitchGlück 能够成功绕过栈金丝雀、ASLR 等保护，并触发未授权的代码执行。论文还讨论了防护对策，如冗余执行和故障检测电路。核心贡献在于提出了一种系统化的硬件辅助利用方法，将物理攻击与软件漏洞结合，提示防御者需关注硬件层面的攻击面。

本文是一篇系统化知识总结（SoK）论文，专注于自动化内核漏洞发现与利用生成领域。研究背景在于内核漏洞对系统安全构成严重威胁，而传统手动发现和利用生成效率低下。该论文系统梳理了现有自动化方法，包括模糊测试、符号执行、静态分析等技术在内核漏洞发现中的应用，以及如何自动生成可利用的漏洞验证程序或利用代码。核心贡献在于提出了一种分类法，将现有工作按技术类型、适用阶段、自动化程度等维度进行归类，并比较了不同方法的优缺点。实验部分基于对大量已发表论文的元分析，评估了各方法在发现真实漏洞和生成可靠利用方面的有效性。主要发现是当前方法在覆盖率、效率和可扩展性上仍有局限，尤其缺乏针对复杂内核机制的通用解决方案。论文还指出了未来研究方向，如结合机器学习与符号推理、提升对硬件漏洞的自动化能力等。适合内核安全研究人员和系统安全工程师阅读，以了解该领域现状与挑战。

本文回顾了针对树莓派RP2350微控制器的黑客挑战活动，该活动旨在测试其安全特性并鼓励社区参与安全研究。虽然具体技术细节需查阅原文，但论文强调了通过透明化设计（如公开安全架构、提供硬件调试接口）来提升系统整体安全性的理念。作者们分享了挑战中发现的若干安全薄弱环节及其对嵌入式系统安全设计的启示。

由于原始输入未提供论文摘要，以下内容基于标题推断：本文提出一种名为 BOOTKITTY 的隐蔽启动套件（bootkit）与 rootkit 组合攻击技术，针对现代操作系统（如 Windows、Linux）设计。核心研究目标是在系统启动过程中植入恶意代码，实现持久化并绕过 UEFI 安全启动、内核完整性检查等防御机制。作者可能提出了一种新型的启动阶段恶意软件，利用固件或引导加载程序漏洞实现高隐蔽性。该方法可能涉及修改系统引导组件或利用硬件级虚拟化特性。实验部分可能通过搭建实际环境测试逃避检测的能力，并与现有 bootkit（如 Trickboot、BootHole）进行对比。主要贡献在于揭示了现代操作系统启动链中的潜在攻击面，并提出了更难以检测的恶意代码植入技术。适合操作系统安全、恶意软件分析和防御研究者阅读。

无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150

MongoDB内存泄漏 CVE-2025-14847(MongoBleed)

1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)

ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)

llamaindex SQL 注入漏洞(CVE-2025-1750)

Screen 本地权限提升漏洞(CVE-2025-23395)

Zabbix认证后SQL注入漏洞(CVE-2024-42327)

ProjectSend认证绕过漏洞(CVE-2024-11680)

PyTorch库RPC框架反序列化RCE漏洞(CVE-2024-48063)

Grafana认证后DuckDB-SQL注入漏洞(CVE-2024-9264)

SPIP BigUp Unauthenticated RCE(CVE-2024-8517)

Rejetto HFS 远程命令执行漏洞(CVE-2024-39943)

Apache HugeGraph-Server Command Execution In Gremlin（CVE-2024-27348）

Zabbix 后台延时注入(CVE-2024-22120)

CrushFTP 认证绕过漏洞（CVE-2024-4040）

Alert for CVE-2026-21992

Alert for CVE-2025-61884

Alert for CVE-2025-61882

Alert for CVE-2024-21287

Alert for CVE-2022-21500

Alert for CVE-2021-44228

Linux 内核提权 CVE-2026-31431(copy-fail)

Alert for CVE-2026-35273

【安全通告】Gitea act_runner 容器逃逸漏洞风险通告（CVE-2026-58053）

本文是一篇系统化知识综述（SoK），旨在解决网络安全事件响应领域缺乏统一框架来系统组织累积知识的问题。事件响应涉及技术、人机交互、组织理论和人为因素等多个领域，需要一个综合性的视角。作者通过对417篇学术文献和40篇非科学出版物的系统回顾，推导出“网络安全事件响应影响因素分类法”（CIR-IF Taxonomy）。该分类法将现有的实证研究结果纳入其中，提供了从1999年到2024年中期的全面知识概览。作者还将该分类法与七种既有的科学框架以及NIST SP 800-61r3事件响应概况中引用的NIST网络安全框架要素进行了系统比较。比较结果显示，CIR-IF分类法在事件响应驱动和塑造因素方面提供了更丰富、更严谨、更系统化的视图。该研究适合事件响应研究人员、安全从业人员以及希望提升组织事件响应准备度的管理者阅读。主要贡献在于建立了一个统一、可扩展的分类体系，有助于识别未充分探索的研究方向，并指导未来的实证和理论研究。

本文提出了一种针对代理系统（Agentic Systems）上下文状态中毒攻击的防御协议——ElephantAgent。近年来，随着大语言模型（LLM）驱动的代理系统广泛调用外部工具并维护持久化记忆，攻击面也随之扩大。工具和记忆中毒攻击（Tool & Memory Poisoning）表明，恶意构造的工具描述或染毒记忆可以隐蔽地扭曲代理的行为，例如诱导其执行非预期操作或泄露敏感信息。这些威胁的根源在于：代理的规划和执行缺乏可验证的状态连续性（Contextual State Continuity），即无法确保其决策所依赖的上下文状态未被篡改。受早期状态连续性机制（如Nimble）启发，ElephantAgent将保护扩展至代理系统不断演化的上下文状态。作者将上下文状态定义为代理整个上下文中受限的、安全关键的子集（例如工具状态和记忆）。在处理每个用户查询之前，ElephantAgent会重新计算本地上下文状态的摘要（digest），并与最新授权的摘要进行比对。通过利用复制的可信硬件（如TEE），ElephantAgent维护了一个线性化的授权上下文状态变迁账本，从而能够检测到带外状态篡改。此外，为应对带内语义滥用（如通过合法操作逐步毒化状态），ElephantAgent还提供了历史追溯能力（Historical Traceability），支持条件性的事后审计和恢复到已知良好的先前状态。实验（基于常见代理框架实现）表明，该协议能以合理性能开销有效检测状态中毒攻击。本文的核心贡献在于首次将状态连续性概念系统化应用于代理系统安全，并提供了可落地的防御方案。适合代理系统安全研究人员、LLM应用开发者和安全架构师阅读。

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted is the function MethodRouter.Handle of the file internal/gateway/router.go of the component WebSocket RPC Handler. Such manipulation leads to incorrect authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem

Android安全公告发布了关于Compatibility Test Suite (CTS)的更新。CTS是Google提供的用于确保Android设备兼容性的测试套件，主要用于验证设备是否符合Android兼容性定义文档（CDD）的要求。本次更新可能涉及对测试用例的调整或新增，以适配最新的Android版本特性或修复之前的测试逻辑。由于该公告并非针对安全漏洞，因此没有提及任何CVE编号或具体的安全问题。对于Android设备制造商和应用开发者而言，保持CTS版本更新有助于确保设备通过兼容性认证，并减少因兼容性问题导致的用户体验下降。

Android兼容性定义文档（CDD）是Android平台官方发布的兼容性标准，用于定义Android设备必须满足的硬件和软件要求，以确保应用兼容性和系统一致性。该文档涵盖摄像头、传感器、网络、多媒体、安全性等多个方面，是设备制造商通过Android兼容性测试套件（CTS）认证的基准。虽然本次公告本身不涉及具体安全漏洞，但CDD中包含的安全要求（如加密、权限模型、安全启动等）对防御者理解Android生态的安全基线有参考价值。

该页面是 Android 安全公告中的“工具、构建和相关参考”部分，主要提供 Android 构建系统、工具链和参考文档的链接。页面本身不包含任何安全漏洞描述或修复信息。它可能用于开发者了解构建流程，但并非针对具体安全问题的公告。

该公告是Android安全公告中发布的最新兼容性定义文档（CDD），版本号为最新。CDD定义了Android设备必须满足的硬件和软件兼容性要求，以确保应用生态的一致性。本次更新可能涉及新增或修改的API、安全要求、权限模型、性能标准等，对OEM厂商和开发者有直接影响。文档本身不针对具体漏洞，而是作为参考基线。

Android 安全公告是 Google 官方发布的月度安全更新汇总，涵盖 Android 操作系统及其组件（如内核、HAL、媒体框架、系统服务等）的安全补丁。本公告（2026年7月）未提供具体的 CVE 列表或漏洞细节，但通常包括对远程代码执行、权限提升、信息泄露等严重漏洞的修复。由于公告内容为空，无法知晓本次修复的具体漏洞及其影响。

Apple于2026年7月6日发布了针对Mac的安全更新公告，标题为"update the software on your Mac"。该公告敦促用户将Mac系统更新至最新版本，以修复可能存在的安全漏洞。由于公告未提供具体的CVE编号或漏洞细节，无法确认受影响的具体组件和漏洞成因。通常，此类安全更新旨在修复可能被攻击者利用的缺陷，涉及内核、系统框架或基础库等。用户应尽快安装更新，以降低潜在风险。

苹果发布了针对iPhone和iPad的软件安全更新公告（2026年7月6日），建议所有用户将设备升级至最新的iOS或iPadOS版本。公告指出，更新修复了可能影响设备安全性的问题，但未提供具体的CVE列表或漏洞细节。用户应尽快通过“设置”中的“软件更新”功能安装最新补丁，以保护设备免受潜在威胁。

此安全公告为 Apple 安全发布页面（https://support.apple.com/en-us/102549），标题为 'submit your research'，内容可能是关于向 Apple 提交安全研究的指引，而非具体的漏洞公告。页面中未提供任何漏洞详情、CVE 编号或受影响产品列表，因此无法提取技术细节或风险影响。

Apple 发布了安全公告 'Get help with security issues'，该公告旨在指导用户如何获取 Apple 产品的安全支持与漏洞报告途径。公告中未提及任何具体漏洞、CVE 编号或受影响产品版本，也未提供严重性评级。因此，该公告属于通用安全支持指引，而非针对某个已知安全问题的修复通告。用户应定期关注 Apple 官方安全发布页面，以获取最新的安全更新和修复信息。

Apple 发布了名为“Background Security Improvements”的安全公告，该公告涉及操作系统或软件中的背景安全增强措施。由于公告未提供具体技术细节、CVE 编号或受影响产品列表，这很可能是一次常规的安全更新，旨在修复未公开的潜在安全问题或提升整体安全防护能力。此类更新通常包括内存保护强化、权限管理改进、代码签名验证增强等底层安全机制优化，以抵御未知威胁。尽管没有直接披露漏洞，但保持系统更新仍是防范攻击的最佳实践。建议用户安装最新安全更新。

输入内容并非有效的安全公告。标题“浙公网安备 33010602009975号”为公安备案号，来源URL指向公安备案系统，发布时间是2026年，且无漏洞描述、CVE、严重性等信息。因此无法生成漏洞摘要。

Pocsuite 是由知道创宇安全研究团队开发并维护的一款开源远程漏洞测试框架，作为团队安全研究能力的基石，长期支撑 Web 安全研究。该框架提供一系列工具和接口，用于自动化漏洞检测与验证，帮助安全研究人员快速评估目标系统的安全性。目前该框架持续更新，但本公告仅介绍其基本功能和定位，不涉及具体漏洞信息或安全风险。

Seebug 是由知道创宇运营的国内权威漏洞参考、分享与学习社区平台，也是国内知名的漏洞库。该平台收录了大量漏洞信息及相应的 PoC（概念验证代码），为安全研究人员、白帽子和企业安全团队提供了重要的漏洞情报来源。截至当前，Seebug 已收录 52206 个漏洞和 44236 个 PoC。平台致力于安全社区建设，促进漏洞信息的共享与学习。然而，本次输入内容仅为平台介绍，不涉及任何具体漏洞或安全事件，因此无法提供针对特定漏洞的详细分析。

该内容是知道创宇（Seebug）对其网站安全防护服务的宣传材料，并非具体漏洞或安全公告。材料概述了其十年Web安全防护经验，包括多层防护体系、云端大数据和安全CDN加速，声称能够高效识别和拦截DDoS攻击、DNS攻击、CC攻击等。但未提供任何具体的技术细节、漏洞信息或安全事件。作为防御者，应知晓这是厂商推广，而非 actionable 的威胁情报或漏洞修复指引。

该公告为京公网安备备案信息（编号11000002002063），由360CERT于2026年7月6日发布，内容为公安机关互联网站备案登记，不涉及具体安全漏洞或威胁。该备案是网站合法运营的必要程序，公告本身不包含技术细节、漏洞利用或攻击事件。

该公告为360CERT发布的许可证信息，标题为“（总）网出证（京）字第281号”，属于网站运营资质证明，不涉及任何安全漏洞、威胁或防护建议。

输入内容为京网文〔2020〕6051-1195号网络文化经营许可证信息，并非安全漏洞公告。无任何漏洞描述、CVE或影响。

输入内容为网站备案信息，不包含任何漏洞或安全公告，无法生成情报摘要。

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for att

A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be used. This patch is called bd1d94e70e3bef364c07c5a1d94eca5c9f56e160. A patch should be applied to reme

A vulnerability was detected in radareorg radare2 up to 6.1.6. Affected by this issue is some unknown functionality of the file libr/bin/format/mdmp/mdmp.c of the component Memory64ListStream Parser. Performing a manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. The patch is named 175d4addb68981331c85b10681c2161c38

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small deeply nested JSON document can consume excessive memory. This path is the default when Cpanel::JSON::XS is not installed or `MOJO_NO_JSON_XS=1` i

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. Affected by this vulnerability is the function r_core_bin_load of the file libr/core/cfile.c. Such manipulation leads to use after free. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 635ab1eeb30340c26076722a90cb91fb2272130b. Applying a patch is

A vulnerability was identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown function of the file backend/pkg/docker/client.go of the component Docker API. The manipulation leads to sandbox issue. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

A weakness has been identified in radareorg radare2 up to 6.1.6. Affected is the function cmd_print in the library libr/core/cmd_print.inc of the component pb Print Command Handler. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: 2b6265476c75567006b0fcbb749f4ae7b189c5df.

A security flaw has been discovered in radareorg radare2 up to 6.1.6. This impacts the function r_str_word_get0set of the file libr/util/str.c. The manipulation results in integer overflow. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as 11ac224c0eb8d57830fccc99e1c1cd8e5d958813. It is best pract

A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advi

Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a through 3.0.16.

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /payment.php. The manipulation of the argument patientid results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly an

A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /paymentdischarge.php. This manipulation of the argument patientid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer: from n/a through 1.0.6.

A weakness has been identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /announcements.php. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The name of the affected product appea

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The impacted element is an unknown function of the file /edit_course1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /upload_files.php of the component Filename Extension. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for at

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0/1.php. The affected element is an unknown function of the file /edit_exam1.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.9.

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_room.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

A weakness has been identified in code-projects Real State Services 1.0. This vulnerability affects unknown code of the file /builderHome.php. This manipulation of the argument loc causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/search-result.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affects some unknown processing of the file /pay.php. Such manipulation of the argument Bankname leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoice_no results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

A security vulnerability has been detected in radareorg radare2 up to 6.1.6. The affected element is the function r_str_ndup/r_str_append of the file libr/util/str.c. The manipulation leads to integer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is a20a56917ae85d732e683f8d9078bdcfee92446c. Applying a patch is

A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function r_core_seek_arch_bits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This patch is called 8b25c773785d85cb0103410a0905089

AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14c618fce4d1df02358717c48ea903706abecdf2, the PDF.get_filepath() function constructed a file path by joining the configured PDF storage directory with a path derived from a PDF object identifier, without verifying that the resolved path remained within the intended PDF_FOLDER directory. An authentica

A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. This affects an unknown function of the file /admin/tour_reserves.php of the component Tour Reservations Page. This manipulation of the argument tour causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

A security flaw has been discovered in radareorg radare2 up to 6.1.6. This issue affects the function r_bin_java_inner_classes_attr_calc_size of the file shlr/java/class.c of the component RBinJava Line Number Table Parser. Performing a manipulation results in heap-based buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be used for attacks.

A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the file /admin/rooms.php of the component Room Management Page. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. This impacts an unknown function of the file /admin/add_event.php of the component Event Management Page. Such manipulation of the argument fdetails leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignment_item_id results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used. Continious

A vulnerability was detected in code-projects Real State Services 1.0. Affected by this vulnerability is an unknown functionality of the file /addprojectsale.php. The manipulation of the argument amen results in sql injection. The attack can be launched remotely.

A flaw has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab. Affected by this issue is some unknown functionality of the file mcp-wiki/src/mcp_wiki/server.py of the component mcp-wiki/wiki-summary. This manipulation of the argument url causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. T

A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour.php of the component Tour Management Page. The manipulation of the argument delete_image results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

A security flaw has been discovered in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The affected element is the function Notes_controller::accessing_dictionary_authorization of the file application/PHP/objects/notes/accessing_dictionary_authorization.php. The manipulation of the argument Password results in sql injection. The attack may be performed from remote. The exploit

A security vulnerability has been detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_definition of the file application/PHP/objects/notes/add_into_dictionary.php. Such manipulation of the argument reference leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/reservations.php of the component Reservations Management Page. The manipulation of the argument delete leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was determined in radareorg radare2 up to 6.1.6. This affects the function core_anal_bytes of the file libr/core/cmd_anal.inc. This manipulation causes integer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue.

A weakness has been identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The impacted element is the function Notes_controller::search_scratch_data of the file application/PHP/objects/notes/search_scratch_data.php. This manipulation of the argument field_name causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to th

Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. This issue affects Pardus Pen: from <=4.1.5 before 4.2.1.

A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of the file application/pages/imba_calculator/calculate.php. The manipulation of the argument mathematical_sentence leads to code injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a r

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects Pardus Update: from <=0.6.3 before 0.6.6.

A vulnerability was identified in radareorg radare2 up to 6.1.6. This vulnerability affects the function cmd_anal_opcode of the file libr/core/cmd_anal.inc.c of the component hexpairs Parser. Such manipulation leads to integer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The name of the patch is 84e773986e7e5bb30453a9384f498ec0ccc9d0a9. A

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation. This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affected is an unknown function of the file /admin/add_room.php. Executing a manipulation of the argument delete_image/edit/description/number/price/rooms/type can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling

A security flaw has been discovered in code-projects Real State Services 1.0. This affects an unknown function of the file /normalHomeRent.php. Performing a manipulation of the argument loc results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

A weakness has been identified in code-projects Real State Services 1.0. This impacts an unknown function of the file /single-list_rent.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability was identified in code-projects Real State Services 1.0. The impacted element is an unknown function of the file /normalHomeSale.php. Such manipulation of the argument loc leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

A security vulnerability has been detected in code-projects Real State Services 1.0. Affected is an unknown function of the file /addprojectrent.php. The manipulation of the argument amen leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was identified in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the component Task Result Cache. This manipulation of the argument default_cache_key causes use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability i

A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Smart Parking System 1.0. The affected element is an unknown function of the file /parkings/parkings.php. Such manipulation of the argument street/city/status leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_product.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patientreport.php. Executing a manipulation of the argument editid can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_coursea.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientprofile.php. Performing a manipulation of the argument patientname results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_exam.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulation leads to session expiration. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of the file ad_miner/scripts/analyse_cache.py of the component Cache Handler. This manipulation of the argument sys.argv[1] causes deserialization. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.

A vulnerability was detected in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /patientlogin.php. Performing a manipulation of the argument loginid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function of the file register.php of the component Registration Endpoint. Executing a manipulation of the argument role can lead to improper privilege management. The attack can be executed remotely. The exploit has been published and may be used. The name of the affected

A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file /goform/ConfigWirelessBase_5g of the component Web Endpoint. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmp_token causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading

A security flaw has been discovered in SourceCodester Pizzafy E-Commerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report.

A vulnerability was determined in code-projects Online Examination 1.0. Affected by this issue is some unknown functionality of the file head.php. Executing a manipulation of the argument uname/password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was identified in code-projects Online Examination 1.0. This affects an unknown part of the file /update.php?q=addquiz of the component Quiz Creation Feature. The manipulation of the argument name/total/right/wrong/time/tag/desc leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted to local execution. A high degree of complexity is needed for the attack. The exploitability is said to

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /patientorder.php. Such manipulation of the argument editid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits acceptance.

A security vulnerability has been detected in code-projects Internship Management System 1.0. The impacted element is an unknown function of the file employer/login.php of the component Employer Login Endpoint. The manipulation of the argument email/password leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the file upload_files.php. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change_password.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. The affected element is an unknown function of the file /admin/login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce and the private key are drawn from makerandom. Because the high bit is always set, the result is not un

A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the component InsightEngine search-result Deduplication. Executing a manipulation can lead to partial string comparison. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issu

A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerability is the function cancel_order of the file classes/Master.php. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used.

A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info of the file classes/SystemSettings.php of the component Setting Handler. Such manipulation of the argument content[] leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was found in HdrHistogram up to 2.2.2. This issue affects the function org.HdrHistogram.DoubleHistogram.recordValue of the file src/main/java/org/HdrHistogram/DoubleHistogram.java of the component Range Check. Performing a manipulation results in incorrect comparison. The attack is only possible with local access. The exploit has been made public and could be used. The project was

A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this issue is the function cancel_order of the file classes/Master.php of the component POST Parameter Handler. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. Affected is the function save_shop_type of the file classes/Master.php of the component POST Parameter Handler. Performing a manipulation results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

A vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_client of the file classes/Users.php of the component Registration Handler. The manipulation of the argument Name results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_users of the file classes/Users.php. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.