SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

CVE-2026-54158

### Summary The attribute-view (database) cell renderer `genAVValueHTML` interpolates cell content raw in four of its b

历史摘要 · 未重新核验 · GitHub Advisory

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

CVE-2026-54072

## Summary The `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `r

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

CVE-2026-54067

### Summary A CSS snippet body containing `` breaks out of its surrounding `` tag when `renderSnippet()` interpolates i

历史摘要 · 未重新核验 · GitHub Advisory

DAFL: Directed Grey-box Fuzzing guided by Data Dependency.

本文提出了一种名为DAFL的定向灰盒模糊测试方法，旨在通过数据依赖关系引导模糊测试过程，提高对特定目标代码区域的覆盖率和漏洞发现效率。传统的灰盒模糊测试通常依靠覆盖率反馈来探索程序，但在定向场景下（如针对特定补丁或关键函数），随机探索效率低

历史摘要 · 未重新核验 · USENIX Security

Crafter: Facial Feature Crafting against Inversion-based Identity Theft on Deep Models.

本文针对深度模型上基于反转的身份盗窃攻击，提出了一种名为Crafter的特征制作机制。随着边缘设备（如移动设备）能力的提升和隐私要求的日益严格，将深度学习应用中的敏感原始数据在边缘端进行预处理，并将提取的特征传输到云端进一步处理已成为一种趋

历史摘要 · 未重新核验 · NDSS

CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access

CrowdStrike与Zscaler宣布合作，将持续身份安全融入零信任访问架构。该合作旨在通过整合CrowdStrike Falcon平台的端点检测与响应（EDR）能力与Zscaler的零信任交换（ZTX）解决方案，实现基于用户身份、设备

历史摘要 · 未重新核验 · CrowdStrike

CrowdStrike Announces Continuous Identity for AI Agents

CrowdStrike于2026年7月12日宣布推出针对AI代理的持续身份验证解决方案（Continuous Identity for AI Agents）。该产品旨在为AI工作负载和代理提供实时身份安全防护，确保AI代理在访问敏感数据和系

历史摘要 · 未重新核验 · CrowdStrike

Citrix NetScaler 内存泄漏(CVE-2025-5777)

CVE-2025-5777

Citrix NetScaler 内存泄漏(CVE-2025-5777)

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Chromium: CVE-2026-14428 Insufficient validation of untrusted input in Dawn

CVE-2026-14428

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-14382 Insufficient validation of untrusted input in ANGLE

CVE-2026-14382

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-14126 Incorrect security UI in UI

CVE-2026-14126

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-14114 Inappropriate implementation in WebAppInstalls

CVE-2026-14114

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-14096 Object lifecycle issue in Input

CVE-2026-14096

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-14005 Use after free in Omnibox

CVE-2026-14005

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-13997 Incorrect security UI in Extensions

CVE-2026-13997

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-13995 Insufficient validation of untrusted input in Autofill

CVE-2026-13995

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-13994 Inappropriate implementation in Credential Management

CVE-2026-13994

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-13969 Uninitialized Use in UI

CVE-2026-13969

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-13964 Insufficient policy enforcement in WebView

CVE-2026-13964

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC

Chromium: CVE-2026-13955 Insufficient validation of untrusted input in CustomTabs

CVE-2026-13955

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.

历史摘要 · 未重新核验 · Microsoft MSRC