TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation
## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication tok
2026-07-11 归档
今日共收录 1315 条安全情报，包含 488 个 CVE，410 篇安全通告，以及 120 篇研究论文。
← 返回归档列表9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and ...
CVE-2026-55500
9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export
MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimat...
CVE-2026-51597
MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authenticat
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
CVE-2026-54070
## Summary `renderPackageREADME` in `kernel/bazaar/readme.go` renders a Bazaar package README from Markdown to HTML wit
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
CVE-2026-54066
## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker...
CVE-2026-57476
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additio
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
多款Huawei路由器信息泄露漏洞
多款Huawei路由器信息泄露漏洞
No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions.
该论文提出了一种名为FUZZNG的新型内核模糊测试方法，旨在解决现有操作系统模糊测试工具（如Syzkaller）依赖手动编写的系统调用接口描述（语法规则）的扩展性问题。Syzkaller需要为每个内核接口提供精确且详细的语法描述，这限制了其
The charging station websocket endpoint accepts connections without proper authentication, which...
CVE-2026-20744
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privileg
OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy...
CVE-2026-14480
OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload wor
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured...
CVE-2026-61459
MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubect
Improper neutralization of special elements used in an SQL command ('SQL injection')...
CVE-2026-5801
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows...
CVE-2025-30008
HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users
SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
CVE-2026-50551
SiYuan v3.6.5 and earlier versions contain a stored cross-site scripting (XSS) vulnerability in the Attribute View (data
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CVE-2026-54159
### Impact A PHP Object Injection vulnerability affects the PrestaShop module `ps_facetedsearch`. The module rebuilds
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
CVE-2026-54088
## Overview The Hook Authentication feature in File Browser allows administrators to delegate login verification to an
SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist
CVE-2026-54069
## Summary SiYuan Note's kernel HTTP server unconditionally trusts all `chrome-extension://` origins, granting `RoleAdm
Firewall for AI
本文介绍了Akamai推出的AI防火墙（Firewall for AI），是一款专为保护AI应用和服务而设计的云安全产品。该产品旨在防御针对AI模型的分布式拒绝服务（DDoS）攻击、机器人程序（botnet）攻击以及其他网络威胁。Akama