Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2026-57990
Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker t
2026-07-25 归档
今日共收录 771 条安全情报，包含 0 个 CVE，408 篇安全通告，以及 82 篇研究论文。
← 返回归档列表Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-57978
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
### Summary When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, P
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
CVE-2026-16584
## Summary The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to in
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
CVE-2026-59221
AI assistance was used to help inspect the code and prepare this report. ## Summary The fix for GHSA-r2wg-2mcr-66rv is
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
CVE-2026-59212
## Summary Current `main` and `v0.9.6` still allow an authenticated user to turn read-only access to another user's fil
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments
该论文首次系统研究了新兴支付协议x402的安全性问题。x402扩展了HTTP 402，为Web API和自主AI代理提供支付能力，其核心设计是将支付证明验证和链上结算委托给第三方促进者（facilitators），以实现跨商家的共享支付基础
In-Progress: Augmenting Explainable AI with LLMs to Enhance User Trust in Intelligent Transportation Systems.
该论文针对车联网通信网络中机器学习模型用于误行为检测时存在的“黑箱”问题，提出了一种将可解释人工智能（XAI）与大语言模型（LLM）相结合的新型框架，旨在提供透明、用户友好的解释，从而增强非专业用户（如网络运营商、监管人员）对系统预测结果的
Firewall for AI
Akamai 发布了名为 "Firewall for AI" 的新产品，旨在为人工智能工作负载提供专用防火墙保护。该产品基于 Akamai 的安全研究，重点防御针对 AI 基础设施的 DDoS 攻击和僵尸网络活动。随着 AI 模型和服务的普
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side...
CVE-2026-61884
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credential
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in...
CVE-2025-71408
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations m
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information...
CVE-2026-62835
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown...
CVE-2026-57530
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milk
Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored
CVE-2026-62323
## Summary Cloudreve WOPI access tokens are generated as `.`, but the WOPI middleware validates only the session id pre
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
CVE-2026-62280
### Description The OAuth2/OIDC consent page rendered for `display=wap` authorize requests reflected several request-der
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
CVE-2026-62263
### Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant t
Open WebUI: Arena task endpoints can bypass underlying model access controls
CVE-2026-59225
## Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying