@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
CVE-2026-53513
### Am I affected? Users are affected if all of the following are true: - Their application uses `@better-auth/sso` at
2026-07-08 归档
今日共收录 1050 条安全情报，包含 282 个 CVE，378 篇安全通告，以及 103 篇研究论文。
← 返回归档列表Timing-Based Browsing Privacy Vulnerabilities Via Site Isolation.
该论文研究了 Chromium 浏览器中站点隔离机制下的时序攻击问题。站点隔离是 Chromium 安全架构的核心，将不同站点渲染在不同进程中，防止跨站信息泄露。然而，作者发现站点隔离引入了一个新的时序侧信道：由于进程数量有限，当用户同时访
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows...
CVE-2026-59705
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated...
CVE-2026-58473
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite
@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive
CVE-2026-53518
### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth
Open WebUI allows limited stored XSS vila uploaded html file
CVE-2025-46571
### Summary Low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend en
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and...
CVE-2026-59706
mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request f
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
CVE-2026-53512
### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` and has
Cloudflare proudly joins the UK government's Cyber Resilience Pledge
Cloudflare宣布加入英国政府推出的“网络弹性承诺”（Cyber Resilience Pledge），这是一项自愿性框架，旨在鼓励组织在网络安全治理、董事会层面的安全责任以及供应链安全方面做出承诺。该框架要求参与组织建立基础的安全治
PANDORA: Lightweight Adversarial Defense for Edge IoT using Uncertainty-Aware Metric Learning.
随着物联网（IoT）设备数量激增，这些资源受限的设备显著扩大了攻击面，暴露了关键网络脆弱性。传统的基于静态签名模式的入侵检测系统（IDS）已无法应对现代攻击者采用的复杂、自动化且新颖的零日攻击。现有的基于机器学习的IDS模型在真实场景中面临
WIGHT: Wired Ghost Touch Attack on Capacitive Touchscreens.
本文提出了一种名为WIGHT的新型攻击方法，首次通过充电线缆在电容触摸屏上实现“幽灵触摸”攻击。电容触摸屏是智能手机、平板等设备的主要人机交互接口，其安全性至关重要。WIGHT攻击的原理是利用充电线缆注入精心设计的共模噪声信号，该信号能够绕
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike与Zscaler宣布合作，将持续身份安全集成到零信任访问架构中。该合作旨在通过结合CrowdStrike Falcon平台的端点检测与响应（EDR）能力与Zscaler的零信任网络访问（ZTNA）解决方案，实现对用户和
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 7 月 8 日宣布推出名为“Continuous Identity for AI Agents”的新功能，旨在为 AI 代理提供持续身份验证和访问控制。该功能集成在 CrowdStrike Falc
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by acce...
CVE-2026-59705
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers t
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registerin...
CVE-2026-58473
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboa...
CVE-2026-59800
9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-i