The Unpatchables: Why Municipalities Persist in Running Vulnerable Hosts.
该论文研究了市政机构（市、县等地方政府）网络中持续存在漏洞主机的现象。作者通过大规模互联网扫描数据，结合漏洞数据库和市政基础设施信息，识别并分析了大量未修补的脆弱主机。研究发现，市政机构面临独特的挑战，包括预算限制、人员技术能力不足、业务流
2026-07-23 归档
今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。
← 返回归档列表PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
【EdgeOne】CNAME 域名生成规则调整公告
【EdgeOne】CNAME 域名生成规则调整公告
Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
CVE-2026-65602
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRo
n8n before 1.123.64 Credential Exposure via JWT Header
CVE-2026-65599
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Goo
n8n before 1.123.64 Remote Code Execution via Git Clone
CVE-2026-65598
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows a
n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
CVE-2026-65592
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator
QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection
CVE-2026-16488
A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Po
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
CVE-2026-56819
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug
Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader
CVE-2026-65318
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows un
NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)
CVE-2026-47731
The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based
libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe
CVE-2026-47709
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_i
libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
CVE-2026-47247
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak p
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
CVE-2026-46556
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Req
Silent Drop of TLS 1.3 Encrypted Records in s2n-tls
CVE-2026-16317
Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-mi
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects
CVE-2026-46403
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithT
DHIS2 Reflected XSS in OpenAPI HTML scope parameter
CVE-2026-55081
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrativ...
CVE-2026-62144
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOK...
CVE-2026-47396
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent