Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker...
CVE-2026-27690
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially craf
2026-07-14 归档
今日共收录 1138 条安全情报，包含 379 个 CVE，396 篇安全通告，以及 80 篇研究论文。
← 返回归档列表Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP
CVE-2026-52827
### Summary Two-factor authentication (TOTP) can be fully bypassed for the REST API. The `KIMAI_SESSION` cookie returned
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability...
CVE-2026-62327
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attack
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows...
CVE-2026-59801
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact
Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
CVE-2026-52823
### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API e
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchro...
CVE-2026-27690
SAP Approuter 存在 HTTP 请求走私漏洞（CVE-2026-27690），攻击者无需身份认证，通过发送特制的 HTTP 请求即可触发请求与响应之间的同步失效（Request-Response Desynchronizatio
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample...
CVE-2026-44761
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from samp
ROV-MI: Large-Scale, Accurate and Efficient Measurement of ROV Deployment.
该论文针对互联网域间路由系统中的前缀劫持问题，聚焦于 RPKI（资源公钥基础设施）中 ROV（路由来源验证）部署的测量。虽然 ROA（路由来源授权）的部署可以直接从 RPKI 仓库数据获取，但 ROV 的部署测量需要复杂的推理技术。现有工作
Poster: Circumventing the GFW with TLS Record Fragmentation.
该论文以海报形式发表于学术会议，聚焦于利用TLS协议特性绕过国家级的HTTPS审查。当前，许多国家（如中国）通过审查HTTPS流量来封锁特定网站，现有的规避方法多集中在TCP层（如修改分组大小、时序等），但TLS作为HTTPS的核心安全协议
CryptoBap: A Binary Analysis Platform for Cryptographic Protocols.
该论文提出 CryptoBap，一个用于验证加密协议二进制代码安全属性的平台。研究背景是：现实中的加密协议实现可能因编译器优化、平台差异或编程错误而引入安全漏洞，而传统的形式化验证方法通常针对高级语言或协议规范，难以直接分析编译后的机器码。
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike与Zscaler宣布合作，将连续身份安全融入零信任访问架构。该合作旨在通过整合CrowdStrike的端点检测与响应（EDR）能力与Zscaler的零信任网络访问（ZTNA）解决方案，实现对用户身份的持续验证和风险动态
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike于2026年7月14日宣布推出“Continuous Identity for AI Agents”解决方案。该方案旨在为AI代理（如自动化脚本、机器人等非人类身份）提供持续的身份验证与访问控制能力，防止AI代理被滥用
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming
本文针对生产环境中的大型语言模型（LLM）代理（如Claude Code和Codex）面临的安全挑战，提出了一种自动化红队测试方法AHA（Agent Hacks Agent）。这些代理通常处理不可信内容、文件、命令和工作空间状态，导致安全漏
Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`
CVE-2026-10666
parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the
Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)
CVE-2026-10664
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI p...
CVE-2026-62327
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attack
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending reques...
CVE-2026-59801
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact