A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this...
CVE-2026-17432
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functio
2026-07-26 归档
今日共收录 1024 条安全情报，包含 289 个 CVE，422 篇安全通告，以及 50 篇研究论文。
← 返回归档列表AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
CVE-2026-16796
### Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile 是 Ivanti 公司提供的企业移动设备管理解决方案，用于集中管理移动设备、应用和安全策略。该漏洞被标识为代码注入漏洞，意味着攻击者可能通过向受影响组件注入恶意代码，从而在服务器
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
根据知道创宇/Seebug漏洞库（SSVID-92331）的公告，天融信（TOPSEC）防火墙存在一个远程利用漏洞，代号ELIGIBLEBACHELOR。目前该漏洞的详细技术细节、受影响的固件版本、攻击向量及具体影响均未公开披露。由于缺乏C
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Silence False Alarms: Identifying Anti-Reentrancy Patterns on Ethereum to Refine Smart Contract Reentrancy Detection.
以太坊智能合约的重入漏洞曾导致巨大的经济损失，为此社区开发了多种自动化重入检测器。然而，这些检测器因检测规则过于粗糙而频繁产生大量误报，常将已采用防重入模式（如互斥锁、检查-生效-交互模式等）保护的合约误判为存在漏洞。现有代码分析技术在识别
Not All Edges are Equally Robust: Evaluating the Robustness of Ranking-Based Federated Learning.
本文研究联邦排名学习（Federated Ranking Learning, FRL）的鲁棒性。FRL 是一种新兴的联邦学习范式，与传统联邦学习有两个关键区别：1）客户端传递离散排名而非梯度更新，大幅降低通信成本并限制恶意更新空间；2）服务
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike与Zscaler宣布建立战略合作，将CrowdStrike Falcon平台的身份威胁检测能力与Zscaler Zero Trust Exchange的零信任网络访问集成，实现持续身份验证。该合作旨在解决传统VPN和静
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike宣布推出“Continuous Identity for AI Agents”解决方案，旨在将身份安全能力扩展到人工智能代理（AI Agent）等非人类实体。该方案提供持续的身份验证、权限管理和行为监控，确保AI代理在
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
### Impact _What kind of vulnerability is it? Who is impacted?_ A network attacker who can reach an etcd TLS listener c
etcd: Watch API authorization bypass via open-ended range requests
### Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key c
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Chromium: CVE-2026-16807 Out of bounds write in Codecs
CVE-2026-16807
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-16806 Use after free in WebMCP
CVE-2026-16806
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-16805 Use after free in Blink
CVE-2026-16805
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-16804 Use after free in Input
CVE-2026-16804
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta:...
CVE-2026-64502
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad_sigma_delta: fix clear_pending_event f
AWS API MCP Server Security Policy Bypass via Startup Initialization Failure
CVE-2026-16584
## Summary The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to in