Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
CVE-2026-54908
### Impact Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. ### Patches
2026-08-02 归档
今日共收录 946 条安全情报，包含 146 个 CVE，466 篇安全通告，以及 75 篇研究论文。
← 返回归档列表PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
ACE: A Security Architecture for LLM-Integrated App Systems.
本文研究 LLM 集成应用系统（LLM-integrated app systems）的安全性问题。这类系统通过第三方应用扩展大语言模型（LLM）的功能，系统 LLM 采用交错规划和执行的方式调用第三方应用来回答用户查询。然而，这种架构引入
Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agents.
本文首次对大语言模型（LLM）智能体在多工具集成场景下的任务控制流安全性进行了系统分析。LLM 智能体利用一组工具进行推理和规划，但多工具集成带来了工具管理、兼容性、依赖关系和控制流保护等安全挑战。作者提出了一种新型威胁——跨工具收割与污染
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in...
CVE-2026-55735
CVE-2026-55735 影响 Elixir 生态中的 ueberauth guardian 库（版本 1.0.0 至 2.4.1 之前）。该漏洞源于 Guardian.revoke/3 函数在撤销会话时未正确验证 JWT 的签名。具体
Firewall for AI
本文为 Akamai 官方发布的“Firewall for AI”产品介绍页面，属于安全解决方案宣传，并非针对具体攻击事件的披露。该产品旨在为人工智能（AI）应用及基础设施提供专门防护，重点抵御分布式拒绝服务（DDoS）攻击与僵尸网络（bo
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all...
CVE-2026-8457
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and inc
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url...
CVE-2026-67352
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java...
CVE-2026-67340
ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) b
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to...
CVE-2026-67333
better-auth before 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redi
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE...
CVE-2026-67341
ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers...
CVE-2026-67342
ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, P
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored...
CVE-2026-67335
better-auth versions before 1.6.2 fail to validate the OAuth state parameter against the stored nonce when using cookie-
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form...
CVE-2026-67324
GitPython 3.1.50 fails to recognize joined short-option forms such as -u (the short form of --upload-pack=) when enforci
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request...
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in...
CVE-2026-67328
@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hard
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing...
CVE-2026-67321
axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level k
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and...
CVE-2026-67307
Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inven