Empirical Study of PLC Authentication Protocols in Industrial Control Systems.
该论文对工业控制系统中可编程逻辑控制器（PLC）的专有认证协议进行了实证研究。PLC被广泛用于核电站、电网、天然气管道等关键基础设施的物理过程控制，其控制逻辑是攻击者的主要目标。研究选取了来自Allen-Bradley、Schneider
2026-07-23 归档
今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
CVE-2026-65601
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider.
n8n before 1.123.64 Privilege Escalation via SSO Instance-Role
CVE-2026-65016
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（EPM Mobile）是用于管理移动设备的解决方案。根据知道创宇Seebug平台公开的漏洞信息（SSVID-99967），该产品存在一个代码注入漏洞。攻击者可能通过向受影响组件发
Huawei Secoway USG firewall weak password
华为Secoway USG系列防火墙存在弱密码漏洞。攻击者可能通过暴力破解或使用已知默认凭证（如admin/admin）登录设备管理界面，从而获取防火墙的完全控制权限。一旦成功登录，攻击者可以修改防火墙规则、拦截或篡改网络流量、建立VPN隧
Next.js: Server-Side Request Forgery in Server Actions on custom servers
CVE-2026-64649
## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
CVE-2026-59822
### Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
CVE-2026-59820
### Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives.
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
CVE-2026-65014
## Impact The `DELETE /${restEndpoint}/test-webhook/:id` route is registered before the authentication middleware is app
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
CVE-2026-65016
## Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider
n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
CVE-2026-59208
## Impact When an n8n instance is configured with more than one trusted token-exchange issuer, external identities are r
New InfraTrust report reveals infrastructure flaws admins should patch first
Eclypsium 公司近日推出了 InfraTrust，这是一个专注于基础设施安全的知识库，并同步发布了月度 InfraTrust Pulse 报告。该报告旨在帮助组织优先修复影响基础设施、固件、网络和边缘设备的漏洞。InfraTrust
Bitcoin-Compatible Virtual Channels.
本文提出了首个兼容比特币的虚拟通道协议。现有公开许可的加密货币如比特币面临交易速率低和确认时间慢的问题，支付通道是一种有效解决方案，但需要路径中所有中间节点参与，导致可靠性下降、费用增加和延迟。最近提出的虚拟通道概念（IEEE S&P'19
CERBERUS: Exploring Federated Prediction of Security Events.
该论文探讨了利用联邦学习（FL）进行安全事件预测的可行性。当前网络防御越来越依赖主动预测攻击者的下一步行动，但构建准确的预测模型需要多个组织的数据，这涉及敏感信息（如网络结构、安全策略）的泄露。为此，作者提出了 Cerberus 系统，允许
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike 与 Zscaler 宣布合作，将持续身份安全集成到零信任访问解决方案中。该合作旨在结合 CrowdStrike Falcon 平台的端点检测与响应（EDR）能力以及 Zscaler Zero Trust Exchan
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 7 月 23 日发布博客，宣布推出针对 AI 代理的持续身份验证功能（Continuous Identity for AI Agents）。该功能旨在解决 AI 代理在自动化流程中因身份管理缺失而带
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
## Impact In an n8n instance, when a validly-signed incoming token was matched to a local account by its email claim, t
n8n before 2.30.1 Privilege Escalation via Token Exchange
CVE-2026-65595
n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardle
libheif has an incomplete fix for CVE-2026-3949: integer overflow bypass in vvdec_push_data2
CVE-2026-47251
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) intro