Traefik: Gateway API route identity collision allows cross-namespace backend hijacking
CVE-2026-71327
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes
2026-08-08 归档
今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。
← 返回归档列表SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds...
CVE-2026-66151
SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the
The OnCallNotificationActivity in the Datadog Android application is declared android:exported=...
CVE-2026-44964
The OnCallNotificationActivity in the Datadog Android application is declared android:exported="true" in AndroidManifest
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no...
CVE-2026-47361
BubbleChatActivity in the Datadog Android application is declared android:exported="true" with no permission guard and a
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
Hedge fund cyberattacks tied to BlackFile-linked UNC6671 extortion group
根据BleepingComputer报道，近期针对对冲基金、私募股权公司及其他金融机构的一波网络攻击被安全研究人员关联至UNC6671勒索组织。UNC6671据称与BlackFile威胁行为者存在联系，BlackFile可能是一种勒索软件家
In Other News: AI Slop Limits Apple Bounties, North Carolina Port Attacks, Hackers Target Wall Street
这篇SecurityWeek文章是‘In Other News’系列新闻综述，汇总了多条可能被忽视的安全事件。正文摘要明确提到了三个值得关注的故事：一、美国相关方面拟禁止中国数据中心技术，这可能是出于国家安全考虑，对采用相关技术的企业带来合
IPvSeeYou: Exploiting Leaked Identifiers in IPv6 for Street-Level Geolocation.
本文提出一种名为 IPvSeeYou 的隐私攻击方法，允许远程且无特权的攻击者以街道级精度物理定位大量住宅 IPv6 主机和网络。核心方法分为三步：首先，通过高速网络探测，从 IPv6 地址中提取嵌入式 MAC 地址（这些 MAC 地址由
A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps.
本文是一篇关于 Android 应用中第三方追踪（third-party tracking）与用户同意（consent）机制的实证研究。研究背景是：第三方追踪允许企业收集用户行为数据、跨设备追踪用户活动，可能将用户私生活的深度洞察暴露给陌生
Janus: Enabling Expressive and Efficient ACLs in High-speed RDMA Clouds.
本论文提出 JANUS，一个面向高速 RDMA 云环境的 ACL（访问控制列表）系统。RDMA（远程直接内存访问）云正日益普及，ACL 对于管控 RDMA 应用、服务和租户的未授权网络访问至关重要。然而，RDMA 独特的队列对（QP）语义和
SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learning.
这篇SoK论文聚焦于机器学习模型部署中的数据推断隐私风险。当模型在生产环境中被使用时， adversary（对手）可能通过模型输出推断出训练数据中的敏感信息。以往文献从不同角度分析了多种推断攻击，例如成员推断攻击（判断某样本是否在训练集中）
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike与Zscaler宣布达成合作，将连续身份验证能力融入零信任访问解决方案。该合作旨在将CrowdStrike Falcon平台的身份威胁检测与Zscaler的零信任交换（Zscaler Zero Trust Exchan
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint
### Impact When a Nuxt dev server is bound to a network-reachable interface (for example `nuxt dev --host` for on-devic
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints
CVE-2026-67621
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perf
Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
CVE-2026-71325
Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by ...
CVE-2026-61808
LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds t