A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this...
CVE-2026-17432
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functio
2026-07-27 归档
今日共收录 632 条安全情报，包含 14 个 CVE，301 篇安全通告，以及 58 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（EPMM）存在代码注入漏洞。根据知道创宇Seebug的漏洞通告，该漏洞可能允许攻击者通过构造恶意输入，在目标系统上注入并执行任意代码。由于缺乏详细技术细节，具体触发条件和利用方式
PANDORA: Lightweight Adversarial Defense for Edge IoT using Uncertainty-Aware Metric Learning.
物联网设备的快速普及带来了资源受限和安全漏洞增多的挑战，传统基于静态签名或规则匹配的入侵检测系统已难以应对现代、自动化且新颖的零日攻击。现有的机器学习IDS模型在面对概念漂移和未知威胁时泛化能力不足。针对上述问题，本文提出PANDORA（P
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike 和 Zscaler 宣布合作，将持续身份安全集成到零信任访问框架中。该合作旨在结合 CrowdStrike Falcon 平台的端点威胁检测与响应能力以及 Zscaler 的零信任网络访问（ZTNA）解决方案，实现基
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 宣布推出面向人工智能代理的持续身份认证功能（Continuous Identity for AI Agents），旨在解决 AI 代理在自动化工作流中面临的身份安全挑战。随着企业越来越多地部署 AI 代理来执行敏感任
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
该漏洞是 Citrix NetScaler（一款应用交付控制器，常用于负载均衡和Web应用安全）中的内存泄漏问题，编号 CVE-2025-5777。根据知道创宇/Seebug 的公告，攻击者可能通过特定请求触发内存泄漏，导致服务进程内存耗尽
PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier.
该论文提出了一种名为 PatchCleanser 的认证鲁棒防御方法，旨在抵御针对图像分类模型的对抗性补丁攻击。对抗性补丁攻击通过在输入图像的受限区域内注入精心设计的像素（即补丁），导致模型误分类。这种攻击可在物理世界中通过打印并粘贴补丁到
mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
CVE-2026-17458
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file s
mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure
CVE-2026-17457
A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserN
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-57978
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...
CVE-2026-57989
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over
Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an...
CVE-2026-57990
Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker t
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Decompiling the Synergy: An Empirical Study of Human-LLM Teaming in Software Reverse Engineering.
该论文首次系统性地研究了大型语言模型（LLM）在软件逆向工程（SRE）中与人类分析师的协作效果。研究分为两部分：首先通过一项包含153名从业者的在线调查，记录了当前LLM在SRE领域的应用现状；随后设计了一项精细的人类实验，选取两个具有CT
Trust Me, I Know This Function: Hijacking LLM Static Analysis using Bias.
论文摘要未提供，无法生成详细摘要。建议直接查阅原文。
Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57990
CVE-2026-57990 是 Microsoft Edge（基于 Chromium）中的一个信息泄露漏洞。攻击者可以通过网络诱导用户访问恶意网站或点击恶意链接，利用该漏洞读取浏览器可访问的文件或目录内容，导致敏感信息泄露。该漏洞的 CV
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-57978
CVE-2026-57978 是 Microsoft Edge (基于 Chromium) 中的一个源验证错误漏洞。该漏洞允许未经授权的攻击者通过网络执行欺骗攻击。具体而言，攻击者可能利用 Edge 浏览器对页面来源（origin）验证的缺
Firewall for AI
Akamai 推出了名为 'Firewall for AI' 的产品，旨在为人工智能工作负载提供安全保护。该产品可能针对 AI 模型训练和推理过程中面临的 DDoS 攻击、爬虫等威胁，结合 Akamai 的边缘网络能力提供防护。文章未披露具
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function...
CVE-2026-17458
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file s