OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplie

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SQL Injection via `multipleStatements: true`

## Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote atta

历史摘要 · 未重新核验 · GitHub Advisory

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

CVE-2026-16796

### Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

CVE-2026-59224

## Summary The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user's identity to t

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

CVE-2026-55502

## Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

CVE-2026-55499

## Summary When an authenticated recipient of a **single-file** share opens the file event stream (`GET /api/v4/file/e

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

CVE-2026-55496

## Summary `GET /api/v4/user/search` is available to any logged-in user. The service calls `userClient.SearchActive`,

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

CVE-2026-55495

## Summary Cloudreve's WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It split

历史摘要 · 未重新核验 · GitHub Advisory

Ivanti Endpoint Manager Mobile代码注入漏洞

Ivanti Endpoint Manager Mobile代码注入漏洞

历史摘要 · 未重新核验 · 知道创宇 / Seebug

TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)

TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)

历史摘要 · 未重新核验 · 知道创宇 / Seebug

Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)

Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)

历史摘要 · 未重新核验 · 知道创宇 / Seebug

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

CVE-2026-62379

## Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (

历史摘要 · 未重新核验 · GitHub Advisory

Subverting Stateful Firewalls with Protocol States.

本文分析了多个 TCP/IP 网络协议栈实现中协议头字段的生成方式，发现通过远程观察和修改系统全局状态可泄露信息，从而建立隐蔽信道。与以往工作不同，本研究的攻击目标位于防火墙保护网络内（包括源地址验证 SAV），这在当前环境中非常普遍。攻击

历史摘要 · 未重新核验 · NDSS

Demystifying Local Business Search Poisoning for Illicit Drug Promotion.

本文首次系统研究了本地搜索服务上非法毒品商业列表的泛滥问题。研究背景是：不法分子利用上游本地数据代理商对数据质量控制不严的漏洞，在本地搜索服务（如谷歌知识面板、地图搜索、语音搜索）中发布非法毒品推广列表，从而污染下游搜索引擎的知识库，并通过

历史摘要 · 未重新核验 · NDSS

CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access

CrowdStrike与Zscaler宣布合作，将持续身份安全能力集成到零信任访问架构中。该合作旨在通过结合CrowdStrike Falcon平台的端点检测与响应（EDR）能力以及Zscaler的零信任网络访问（ZTNA）解决方案，实现对

历史摘要 · 未重新核验 · CrowdStrike

CrowdStrike Announces Continuous Identity for AI Agents

CrowdStrike 于2026年7月25日宣布推出针对AI代理的持续身份解决方案（Continuous Identity for AI Agents），旨在应对AI代理在自动化任务中面临的身份和访问管理挑战。该方案利用CrowdStri

历史摘要 · 未重新核验 · CrowdStrike

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

### Impact _What kind of vulnerability is it? Who is impacted?_ A network attacker who can reach an etcd TLS listener c

历史摘要 · 未重新核验 · GitHub Advisory

etcd: Watch API authorization bypass via open-ended range requests

### Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key c

历史摘要 · 未重新核验 · GitHub Advisory

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not

历史摘要 · 未重新核验 · GitHub Advisory

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated r

历史摘要 · 未重新核验 · GitHub Advisory