Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
CVE-2026-64642
Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted reque
2026-07-29 归档
今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。
← 返回归档列表Next.js: Denial of Service in App Router using Server Actions
CVE-2026-64641
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 thr
Cross Layer Attacks and How to Use Them (for DNS Cache Poisoning, Device Tracking and More).
该论文分析了Linux内核（以及Android）中使用的prandom伪随机数生成器（PRNG），发现其存在弱点。prandom PRNG被内核中的多个网络层消费者使用，包括UDP源端口生成算法、IPv6流标签生成算法和IPv4 ID生成算
nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
CVE-2026-47725
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every
nebula-mesh: Decrypted CA private key persists in heap after signing
CVE-2026-48025
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, intern
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CVE-2026-59931
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 t
Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
CVE-2026-43910
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. Fro
DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick
CVE-2026-67174
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering
Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests
CVE-2026-67173
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG i
Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References
CVE-2026-66921
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpol
MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server
CVE-2026-9680
Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP
CVE-2026-17528
CVE-2026-17528
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the element. An atta
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
CVE-2026-59730
Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is
Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
CVE-2026-66824
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the
Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
CVE-2026-64649
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 thr
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective...
CVE-2026-16347
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessi
Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks
CVE-2026-50569
`HTTPTriggerSpec.Validate()` validated `Methods`, `FunctionReference`, `Host`, `IngressConfig`, and `CorsConfig`, but si
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Firewall for AI
Akamai 于 2026 年 7 月 29 日发布了名为“Firewall for AI”的产品，旨在为人工智能基础设施提供专门的安全保护。该产品针对 AI 工作负载面临的独特威胁，特别是分布式拒绝服务（DDoS）攻击和僵尸网络攻击。随着