安全日报 - 2026-07-09 - Cyber Security Daily Radar

安全公告2026-07-08 发布INFO

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

CVE-2026-49825

# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`) **Reporter:

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-79 #cwe-184 #severity:high

安全公告2026-07-07 发布INFO

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

CVE-2026-53553

> [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #cwe-200 #severity:high

安全公告2026-07-07 发布INFO

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

CVE-2026-53552

### Summary `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-639 #cwe-863 #severity:critical

安全公告2026-07-07 发布INFO

aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address

CVE-2026-53533

### Summary `aiosmtplib`'s `SMTP.mail()`, `SMTP.rcpt()`, `SMTP.vrfy()` and `SMTP.expn()` send the caller-supplied email

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-77 #cwe-93 #severity:medium

安全公告2026-07-07 发布INFO

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

CVE-2026-53530

### Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #cwe-248 #cwe-400 #cwe-1285 #severity:high

威胁情报2026-07-09 发布INFO

Firewall for AI

历史摘要 · 未重新核验 · Akamai Security Research

#botnet #ddos #akamai

威胁情报2026-07-08 发布INFO

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Elastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican

历史摘要 · 未重新核验 · Elastic Security Labs

#labs #detection #elastic

威胁情报2026-07-07 发布INFO

Chinese hackers develop LONGLEASH malware to expand ORB network

Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) ne

历史摘要 · 未重新核验 · BleepingComputer

#news #cybersecurity #ransomware

威胁情报2026-07-07 发布INFO

Hidden backdoor in Tenda router firmware grants admin access

A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an atta

历史摘要 · 未重新核验 · BleepingComputer

#news #cybersecurity #ransomware

威胁情报2026-07-08 发布INFO

China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors

Cisco says the threat actor behind the LapDogs campaign has expanded its SOHO router malware toolkit with LongLeash, Dog

历史摘要 · 未重新核验 · Apple Security Releases

#apple #ios #macos

2026-07-09 归档