Litestar: HTML Injection Through CSRF Token
CVE-2026-48060
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which
2026-07-29 归档
今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。
← 返回归档列表Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
CVE-2026-49258
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
CVE-2026-54332
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow dec
Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data
CVE-2026-66920
Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affec
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauth
Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links
CVE-2026-66825
Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with li
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM...
CVE-2026-7362
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0...
CVE-2026-7769
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0...
CVE-2026-3157
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0...
CVE-2026-1918
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0...
CVE-2026-3158
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM
In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server...
CVE-2026-16771
In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on
Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel
CVE-2026-49446
### Summary The Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to th
Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
CVE-2026-49447
### Summary `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that s
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Linux 内核提权 CVE-2026-31431(copy-fail)
CVE-2026-31431
Linux 内核提权 CVE-2026-31431(copy-fail)
Secure Multiparty Computation of Threshold Signatures Made More Efficient.
该论文提出了一种更高效的阈值签名安全多方计算协议，特别是针对 ECDSA 等非线性签名方案。现有阈值签名方案在分布式签名过程中常采用两两乘性到加性份额转换，导致每个签名者的通信复杂度为 O(n)、验证复杂度为 O(n^2)，且大多数方案缺乏
Protecting IoT Devices through Localized Detection of BGP Hijacks for Individual Things.
本文提出了一种针对物联网（IoT）设备的本地化BGP劫持检测方法。传统上，BGP路由劫持被视为大规模系统问题，需要网络服务提供商采取行动，而边缘网络（如家庭网络）的路由信息被认为不具有可操作性。作者利用IoT设备功能有限以及单个家庭网络中间
Privacy Analyses in Machine Learning.
该论文研究了美国最高法院推翻罗诉韦德案（Roe v. Wade）后，公众对患者隐私问题的反应。研究收集了2022年5月至12月期间的大量Twitter数据，采用计算分析与定性内容分析相结合的混合方法，分析了公众对医疗隐私，特别是电子病历访问
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike与Zscaler宣布达成合作，旨在将持续身份安全能力集成到零信任访问架构中。该合作结合了CrowdStrike Falcon平台（端点检测与响应，EDR）与Zscaler Zero Trust Exchange（零信任