Ivanti Endpoint Manager Mobile代码注入漏洞
根据知道创宇 Seebug 漏洞库收录的信息，Ivanti Endpoint Manager Mobile 存在代码注入漏洞。该产品是 Ivanti 旗下的端点管理器移动端组件，通常用于企业移动设备管理（MDM），帮助企业统一管理移动设备、
2026-08-07 归档
今日共收录 1483 条安全情报，包含 647 个 CVE，430 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker...
CVE-2026-68823
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a n
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
CVE-2026-68823
CVE-2026-68823 涉及 Azure Confidential Ledger（Azure 机密账本）中暴露的危险方法或函数。该漏洞允许已获得授权的攻击者通过网络远程执行代码。CVSS 评分为 9.1，属于严重等级。攻击向量为网络（
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter...
CVE-2026-70558
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path)
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote...
CVE-2026-19170
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially per
Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group
据BleepingComputer报道，近期针对对冲基金、私募股权公司及其他金融机构的一连串网络攻击被归因于UNC6671——一个以敲诈勒索为目的的黑客组织。该组织据称与名为BlackFile的威胁行为者存在合作或从属关系。虽然公开渠道尚未
Ghost in the Binder: Binder Transaction Redirection Attacks in Android System Services.
本文研究了Android系统服务中Binder机制的安全问题。Binder是Android应用访问系统服务的核心进程间通信机制，其设计采用客户端-服务器角色模型，通常将系统服务视为服务器、应用视为客户端。然而，越来越多的场景要求系统服务充当
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Azure Confidential Ledger Remote Code Execution Vulnerability
CVE-2026-68823
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a n
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike 与 Zscaler 宣布合作，将连续身份安全能力集成到零信任访问架构中。该合作旨在将 CrowdStrike 的 Falcon 平台（提供端点检测与响应、威胁情报、身份保护）与 Zscaler 的 Zero Trus
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 8 月 7 日宣布推出“面向 AI 代理的连续身份（Continuous Identity for AI Agents）”功能。这是一项产品发布公告，而非针对具体攻击事件的威胁情报。该功能旨在解决
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
CVE-2026-66370
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allow
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
CVE-2026-66843
Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex
aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
CVE-2026-70646
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` d
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
CVE-2026-64604
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update if
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
CVE-2026-64587
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated...
CVE-2026-67621
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perf
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
CVE-2026-18654
### Summary The AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. An