Chromium: CVE-2026-13851 Insufficient validation of untrusted input in WebAppInstalls
CVE-2026-13851
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
2026-07-12 归档
今日共收录 877 条安全情报，包含 71 个 CVE，468 篇安全通告，以及 78 篇研究论文。
← 返回归档列表Chromium: CVE-2026-13826 Inappropriate implementation in Autofill
CVE-2026-13826
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-13825 Uninitialized Use in Dawn
CVE-2026-13825
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-13822 Inappropriate implementation in Extensions
CVE-2026-13822
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-13816 Insufficient validation of untrusted input in File Input
CVE-2026-13816
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-13788 Use after free in Fullscreen
CVE-2026-13788
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Firewall for AI
Akamai 安全研究团队发布了名为 'Firewall for AI' 的产品页面，这是一款专门为人工智能应用场景设计的网络安全防火墙。该产品旨在利用 AI 技术增强对 DDoS 攻击和僵尸网络的防御能力，通过智能流量分析和自适应策略调整
PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension
CVE-2026-60090
PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowled
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation
## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication tok
Parse Server 9.0.0 Stored XSS via malformed Content-Type
CVE-2026-61448
Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and
PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, k...
CVE-2026-60090
PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowled
Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized...
CVE-2026-58281
Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ove
The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is...
CVE-2026-1832
The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cac
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress...
CVE-2026-13262
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generi
SiYuan: Stored XSS in Bazaar marketplace via package README event handlers
CVE-2026-54070
## Summary `renderPackageREADME` in `kernel/bazaar/readme.go` renders a Bazaar package README from Markdown to HTML wit
SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894
CVE-2026-54066
## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
多款Huawei路由器信息泄露漏洞
多款Huawei路由器信息泄露漏洞
Defending Language Models Against Image-Based Prompt Attacks via User-Provided Specifications.
本文聚焦于多模态大语言模型（MLLM）面临的基于图像的提示注入攻击防御问题。随着聊天机器人系统广泛支持图像与文本混合输入，攻击者可通过恶意构造的图像绕过文本层面的安全机制，而现有防御手段仅针对文本数据，对此类攻击几乎无效。为此，作者提出了一