APSB26-111: Security update available for Content Credentials SDK
APSB26-111: Security update available for Content Credentials SDK
2026-08-13 归档
今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。
← 返回归档列表APSB26-123: Security update available for Adobe Campaign Classic
APSB26-123: Security update available for Adobe Campaign Classic
Early Stable Update for Desktop
The Stable channel has been updated to 152.0.7977.42/.43 for Windows and Mac as part of our early stable release to a sm
Chrome Beta for Desktop Update
The Beta channel has been updated to 152.0.7977.42 for Windows, Mac and Linux.A partial list of changes is available in
Broken access control in the RADIUS type admin group
CVSSv3 Score: 8.8 An Improper Authentication vulnerability [CWE-287] in the FortiWeb Remote Radius Type Admin
Content-Encoding WAF Evasion
CVSSv3 Score: 4.8 An incomplete list of disallowed inputs [CWE-184] in FortiWeb WAF may allow an unauthenticat
Heap overflow in kernel driver due to missing size validation
CVSSv3 Score: 7.3 A buffer copy without checking size of input vulnerability [CWE-120] in FortiClient Windows
Server-Side Request Forgery (SSRF)
CVSSv3 Score: 3.4 A Server-Side request forgery (SSRF) [CWE-918] vulnerability in FortiSIEM GUI may allow an a
PAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH)
PAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH)
Activation Probes Surface Code-Security Signals that the Model's Output Misses
该论文研究AI编程助手生成代码的安全审查问题。随着AI编码代理在生产代码中的占比增加，人工安全审查难以扩展。主流代理多为闭源权重，部署方无法读取其内部参数，但可以使用开源权重模型作为审查器来检查代理输出，且该审查器的激活值可读取。论文提出的
Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs
这篇论文揭示了一个针对视觉语言模型（VLM）的新型后门攻击范式。传统VLM后门被视为静态漏洞，通常将有限数量的触发器映射到固定目标（一对一或N对N），且必须在训练前确定映射关系。作者认为这严重低估了威胁，并提出一种'可编程后门'：单次投毒阶
@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar...
CVE-2026-49473
@cedar-policy/authorization-for-expressjs 是一个用于 Express.js 的开源中间件，它将 Cedar 授权策略集成到应用中，通过在请求处理前将 HTTP 请求映射为 Cedar 动作并评估策略
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) agains...
CVE-2026-48791
CVE-2026-48791 是 sigstore-java 项目（用于与 sigstore 基础设施交互的 Java 客户端库）的一个安全漏洞。在版本 2.0.0 中，开发者错误地移除了对集成时间（Rekor 条目时间）与 Fulcio
The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user...
CVE-2026-46688
该漏洞是一个典型的开放重定向（Open Redirect）问题，影响 MRBS 会议房间预订系统 1.12.2 之前的版本。由于程序未对重定向目标 URL 进行充分校验，未认证的恶意请求可以构造包含恶意重定向地址的链接。当用户点击该链接时，
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist acr...
CVE-2026-71194
OpenStack Designate 在 22.0.2 之前的版本中存在一个影响 mDNS 处理器的安全缺陷。该缺陷源于处理器在解析记录查询和 NOTIFY 请求时执行了不区分池（pool-blind）的查找操作。当不同池中存在两个同名区
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read proj...
CVE-2026-47718
FUXA 是一个基于 Web 的流程可视化（SCADA/HMI/Dashboard）软件，广泛应用于工业控制系统的监控和管理。本漏洞存在于 FUXA 1.3.0-2773 版本中，当配置项 secureEnabled 设置为 true（即启
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-15424
CVE-2026-15424 已被其 CVE 编号管理机构（CNA）拒绝或撤回，原因未提供具体说明。该记录仅包含一条拒绝说明，没有漏洞描述、CVSS 评分、EPSS 数据、受影响产品信息或厂商信息。由于该编号被官方撤销，它不代表一个有效的安
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer head...
CVE-2026-15141
CVE-2026-15141 是一个影响某设备 Web 管理界面的请求验证缺陷。该设备的 Web 接口在验证请求时依赖 HTTP Referer 头作为安全机制的一部分，但由于验证逻辑存在不足，当请求中 Referer 头为空或完全缺失时，
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener ca...
CVE-2026-73500
CVE-2026-73500 是 etcd 分布式键值存储中的一个拒绝服务（DoS）漏洞。etcd 常被用作 Kubernetes 控制平面的后端存储，因此该漏洞可能导致关键基础设施的可用性丧失。攻击者只需能够访问 etcd 的 TLS 监
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can...
CVE-2026-73499
etcd 是一个分布式键值存储系统，用于保存分布式系统数据。在版本 3.5.33、3.6.14 和 3.7.1 之前，存在一个权限绕过漏洞。当集群启用了认证后，一个仅被授予某个精确键 READ 权限的用户，可以利用 Watch gRPC A