9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats
--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version: /
2026-07-07 归档
今日共收录 976 条安全情报，包含 239 个 CVE，384 篇安全通告，以及 83 篇研究论文。
← 返回归档列表User-Space Dependency-Aware Rehosting for Linux-Based Firmware Binaries.
该论文提出了一种名为 FIRMWELL 的固件重宿主框架，旨在解决 Linux 固件二进制文件在用户空间依赖项模拟不足的问题。现有方法对用户空间知识利用不充分，导致初始化过程不完整，且将所有模拟失败视为同类，无法区分系统级问题与用户空间依赖
9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
CVE-2026-55501
## Summary The 9router dashboard login rate limiter derives the client identity from the attacker-controlled `X-Forward
9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover
CVE-2026-55500
## Summary The `/api/settings/database` endpoint allows full database export (containing all credentials, API keys, OAu
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
CVE-2026-55790
## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When
Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness
CVE-2026-54496
### Summary A soundness vulnerability in the variable-base scalar multiplication gadget of `halo2_gadgets` allowed a ma
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike 与 Zscaler 宣布了一项合作，旨在将持续身份验证能力融入零信任访问架构。该合作通过整合 CrowdStrike Falcon Identity Threat Detection 与 Zscaler Zero T
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 7 月 7 日宣布推出面向 AI 代理的持续身份验证功能（Continuous Identity for AI Agents）。该功能旨在解决 AI 代理在自主执行任务时的身份与访问管理挑战，确保每
5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management
该文章基于Frost & Sullivan发布的2025年云安全态势管理（CSPM）Frost Radar™报告，提炼了五项关键洞察。报告指出，CSPM正从传统的“时间点合规”工具向“持续风险管理”平台演进。核心变化包括：1）CSPM不再仅
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CURE: A Security Architecture with CUstomizable and Resilient Enclaves.
该论文提出了CURE，一种新型的安全架构，旨在解决现有可信执行环境（TEE）解决方案的三大设计缺陷：1）现有TEE采用“一刀切”的方式仅提供单一飞地类型，而不同服务需要灵活的飞地以适应其需求；2）现有TEE无法有效支持新兴应用（如机器学习即
Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy...
CVE-2026-56140
Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel
Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver ...
CVE-2026-48205
Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dn
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operati...
CVE-2026-48204
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability i...
CVE-2026-48203
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Valid
Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a compo...
CVE-2026-46456
Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound m