Chromium: CVE-2026-18013 Inappropriate implementation in Chrome for iOS
CVE-2026-18013
CVE-2026-18013 是 Chromium 项目中的一个安全漏洞，其问题类型为“不恰当的实现”（Inappropriate implementation），主要影响 Chrome for iOS 浏览器。由于 Microsoft E
2026-08-01 归档
今日共收录 1220 条安全情报，包含 330 个 CVE，503 篇安全通告，以及 110 篇研究论文。
← 返回归档列表Chromium: CVE-2026-18016 Insufficient policy enforcement in Chrome for iOS
CVE-2026-18016
CVE-2026-18016 是一个由 Chromium 项目分配并修复的安全漏洞，涉及 Chrome for iOS 中的策略执行不足（Insufficient policy enforcement）。该漏洞由 Google Chrome
Chromium: CVE-2026-17835 Inappropriate implementation in Chrome for iOS
CVE-2026-17835
该CVE由Google Chrome团队分配，涉及Chrome for iOS中的“不当实现”（Inappropriate implementation）类安全问题。由于Microsoft Edge（基于Chromium内核）会集成Chro
Chromium: CVE-2026-17838 Incorrect security UI in Chrome for iOS
CVE-2026-17838
CVE-2026-17838 是 Chromium 项目中的一个安全性用户界面（Security UI）显示不当漏洞，主要影响 Chrome for iOS 以及所有基于 Chromium 内核的浏览器（如 Microsoft Edge）。
Chromium: CVE-2026-17839 Inappropriate implementation in Chrome for iOS
CVE-2026-17839
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-17841 Race in Chrome for iOS
CVE-2026-17841
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-17842 Inappropriate implementation in Chrome for iOS
CVE-2026-17842
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-17849 Inappropriate implementation in Chrome for iOS
CVE-2026-17849
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-17863 Inappropriate implementation in Browser
CVE-2026-17863
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
TuDoor Attack: Systematically Exploring and Exploiting Logic Vulnerabilities in DNS Response Pre-processing with Malformed Packets.
该论文针对 DNS 响应预处理阶段存在的逻辑漏洞进行了系统性研究。作者将 DNS 比作一盘棋局，规则简单但实现极其复杂。他们通过系统分析 DNS RFC 和多种 DNS 软件实现，发现了三类新型逻辑漏洞，并据此提出了名为 TuDoor 的攻
Pool-Party: Exploiting Browser Resource Pools for Web Tracking.
该论文研究浏览器中一类未被现有防御机制缓解的隐蔽信道攻击，作者将其命名为“pool-party”攻击。这类攻击通过操纵浏览器中有限但未分区（unpartitioned）的资源池来创建跨站点的隐蔽信道。虽然之前已有类似攻击的报道，但本文首次系
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This...
CVE-2026-9044
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
CVE-2026-54910
### Summary The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters:
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven...
CVE-2026-18141
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthentic
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
CVE-2026-54725
## Summary The vault-secrets-webhook reads the `vault.security.banzaicloud.io/vault-addr` annotation from any ConfigMap
Sparrow: Space-Efficient zkSNARK for Data-Parallel Circuits and Applications to Zero-Knowledge Decision Trees.
本文提出 Sparrow，一种面向数据并行算术电路的高空间效率零知识简洁非交互式证明（zkSNARK）方案。在部署 SNARK 的实践中，证明者的空间开销是主要障碍之一，往往远超本地计算的资源需求。针对这一问题，Sparrow 实现了两个显
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是 CrowdStrike 与 Zscaler 发布的官方合作公告，介绍双方将连续身份验证能力集成到零信任访问中。文章强调，传统网络访问控制往往在初始认证后即信任用户身份，而此次合作旨在通过持续校验用户身份与端点安全状态来提升动态访问控