Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows...
CVE-2026-58122
Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attacker
2026-07-10 归档
今日共收录 1398 条安全情报，包含 466 个 CVE，522 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Side-Channel-Assisted Reverse-Engineering of Encrypted DNN Hardware Accelerator IP and Attack Surface Exploration.
深度神经网络（DNN）在众多应用领域中展现出卓越性能，随着模型规模与复杂度的增长，硬件DNN加速器日益普及。基于FPGA的DNN加速器兼具接近专用集成电路（ASIC）的效率与出色的灵活性，成为快速演进的深度学习实现的主要硬件平台之一，尤其在
Symphony: Path Validation at Scale.
论文《Symphony: Path Validation at Scale》针对未来互联网架构中的路径验证问题展开研究。路径验证允许端主机为其流量指定转发路径，并验证流量是否遵循指定路径，从而增强灵活性、安全性和隐私性。当前方案要求路由器在
Efficient Zero-Knowledge Arguments For Paillier Cryptosystem.
本文提出了一种针对Paillier密码系统的高效零知识论证系统。Paillier加密是一种同态加密方案，广泛应用于隐私保护计算，如联邦学习和加密数据分析。然而，在实际应用中，需要证明密文满足某些性质（如范围证明、正确性证明等），而现有的零知
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike与Zscaler宣布合作，将连续身份安全（Continuous Identity Security）集成到零信任访问框架中。该合作旨在将CrowdStrike Falcon平台的身份威胁检测能力与Zscaler的零信任
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 在其官方博客中宣布推出针对 AI 代理的连续身份验证解决方案（Continuous Identity for AI Agents）。该方案旨在解决 AI 代理在动态工作负载中面临的身份与访问管理挑战。随着企业广泛采用
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents
本文针对持久化AI代理（Persistent AI Agents）这一新兴范式提出了运行时安全审计框架TokenWall。持久化AI代理将大语言模型从单轮对话扩展到长期存续的软件系统，与传统聊天助手不同，其不安全内容可通过持久状态、可复用技
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
CVE-2026-59221
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitiz
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
CVE-2026-59212
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _verify_
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)
CVE-2026-59213
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 before 0.10.0, get_all
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)
CVE-2026-59217
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload p
OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection
CVE-2026-35210
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0
ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
CVE-2026-44512
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0,
DorPatch: Distributed and Occlusion-Robust Adversarial Patch to Evade Certifiable Defenses.
本文提出了一种名为DorPatch的分布式且对遮挡鲁棒的对抗性补丁攻击，旨在逃避可证明的鲁棒防御和实证防御。与传统的单个补丁攻击不同，DorPatch通过将补丁分散到多个位置（使用group lasso正则化）并引入图像丢弃、密度正则化和结
AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection
CVE-2026-15193
A vulnerability was determined in AidanPark openclaw-android up to 0.4.0. The affected element is an unknown function of
GLPI 11 < 2.14.4 Tag Plugin Stored Cross-Site Scripting in Kanban Badge Rendering
CVE-2026-53987
The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban ba
MISP: Improper sharing group authorization check when adding attributes
CVE-2026-61474
An improper authorization check in MISP’s attribute creation endpoint allowed an authenticated user with permission to a
Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries
CVE-2026-59269
A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
CVE-2026-59723
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard