Protecting Microsoft at AI speed: How SFI proactively hardens our cloud

微软安全博客于2026年7月8日发布文章，介绍其安全未来倡议（SFI）如何以AI速度主动强化云服务。SFI整合了安全要求、威胁知识和运营框架，为定义良好防御的云服务提供指南。关键在于持续对在线服务进行实时评估，确保满足安全要求。文章强调将安

历史摘要 · 未重新核验 · Microsoft Threat Intelligence

CVE-2026-0283 PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) (Severity: MEDIUM)

CVE-2026-0283

该漏洞（CVE-2026-0283）影响 Palo Alto Networks 的 PAN-OS 操作系统中的 Large Scale VPN（LSVPN）组件。LSVPN 用于大规模 VPN 部署，通常为企业提供安全的远程访问。该漏洞为认

历史摘要 · 未重新核验 · Palo Alto Security Advisories

CVE-2026-0280 PAN-OS: IPv6 Firewall Policy Bypass (Severity: LOW)

CVE-2026-0280

CVE-2026-0280 是 Palo Alto Networks PAN-OS 防火墙操作系统中存在的一个 IPv6 防火墙策略绕过漏洞。PAN-OS 是 Palo Alto 防火墙的核心操作系统，负责安全策略执行。该漏洞源于对 IPv

历史摘要 · 未重新核验 · Palo Alto Security Advisories

CVE-2026-0284 PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) (Severity: MEDIUM)

CVE-2026-0284

CVE-2026-0284 是 Palo Alto Networks PAN-OS 操作系统在大规模 VPN（LSVPN）功能中存在的一个 XML 注入漏洞。该漏洞源于对用户提供的 XML 输入未进行充分净化，攻击者可以通过向 LSVPN

历史摘要 · 未重新核验 · Palo Alto Security Advisories

Exploiting Sequence Number Leakage: TCP Hijacking in NAT-Enabled Wi-Fi Networks.

本文揭示了一种利用NAT路由器中普遍存在的端口保持策略缺陷和反向路径验证不足的侧信道漏洞，使得处于同一Wi-Fi网络的攻击者能够推断并劫持受害者与外部服务器之间的TCP连接。具体而言，攻击者首先通过发送伪造的TCP包探测受害者是否建立了TC

历史摘要 · 未重新核验 · NDSS

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

CVE-2026-59897

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS

历史摘要 · 未重新核验 · OSV.dev

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

CVE-2026-55874

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in th

历史摘要 · 未重新核验 · OSV.dev

FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)

CVE-2026-54607

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer valid

历史摘要 · 未重新核验 · OSV.dev

Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

CVE-2026-45796

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13

历史摘要 · 未重新核验 · OSV.dev

ShapFuzz: Efficient Fuzzing via Shapley-Guided Byte Selection.

本文针对基于突变的模糊测试（fuzzing）中字节重要性量化不足的问题展开研究。现有方法通常关注输入字节与路径约束的关系，但忽略了并非所有与约束相关的字节都能发现新代码。作者通过Shapley值分析发现，不同字节位置对模糊测试性能的贡献存在

历史摘要 · 未重新核验 · NDSS

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

CVE-2026-49464

## Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper wit

历史摘要 · 未重新核验 · GitHub Advisory

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

CVE-2026-49463

## Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether th

历史摘要 · 未重新核验 · GitHub Advisory

Waku has an Open Redirect via `unstable_redirect` Helper

CVE-2026-49456

## Summary The `unstable_redirect()` helper exported from `waku/router/server` (`packages/waku/src/router/define-router

历史摘要 · 未重新核验 · GitHub Advisory

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

CVE-2026-49455

## Summary Waku's RSC request dispatcher invokes server actions without validating the request's `Origin` (or `Sec-Fetc

历史摘要 · 未重新核验 · GitHub Advisory

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

CVE-2026-52831

## Summary Nuclio controller builds a `curl` invocation string for each cron trigger and stores it as the `args` of a K

历史摘要 · 未重新核验 · GitHub Advisory

Ivanti Endpoint Manager Mobile代码注入漏洞

Ivanti Endpoint Manager Mobile代码注入漏洞

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

CVE-2026-53649

# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV

历史摘要 · 未重新核验 · GitHub Advisory

SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users

Elastic Security Labs 发现一个名为 REF6045 的银行欺诈攻击集群，针对墨西哥的银行、金融科技公司、支付处理商和加密货币交易所用户。攻击者利用 ClickFix 社会工程学技术，通过虚假的 CAPTCHA 验证页面

历史摘要 · 未重新核验 · The Hacker News

CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access

CrowdStrike和Zscaler宣布合作，将持续身份安全能力集成到零信任访问架构中。该合作旨在结合CrowdStrike的端点检测与响应（EDR）能力和Zscaler的零信任网络访问（ZTNA）解决方案，实现基于用户身份、设备健康状态

历史摘要 · 未重新核验 · CrowdStrike

CrowdStrike Announces Continuous Identity for AI Agents

CrowdStrike Announces Continuous Identity for AI Agents

历史摘要 · 未重新核验 · CrowdStrike