luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload,...
CVE-2026-72841
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated user
2026-08-14 归档
今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。
← 返回归档列表The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens...
CVE-2026-73669
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfa
hashi-vault-js: Vault token and secret values exposed in thrown errors
CVE-2026-55102
## Summary Vault token and secret values are exposed in thrown errors when using `hashi-vault-js`. ## Details Every A
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
CVE-2026-54917
## Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with `mux.NewRouter().SkipCl
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
【腾讯云认证】腾讯私有云交付运维工程师 - 里约智能网关认证下架公告
【腾讯云认证】腾讯私有云交付运维工程师 - 里约智能网关认证下架公告
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the...
CVE-2026-73843
CVE-2026-73843 是 OpenChoreo（一个面向 Kubernetes 的完整开源开发者平台）中的高危未授权访问漏洞。根据 NVD 披露，在 1.0.2 和 1.1.2 之前的版本中，internal/cluster-gat
Hundreds of fake Chrome VPN extensions route traffic through a proxy
2026年8月12日，BleepingComputer报道称Chrome网上应用商店中出现了超过737个假冒知名VPN和代理服务的浏览器扩展。这些恶意扩展会将用户的浏览流量通过由同一供应商运营的SOCKS5代理服务器进行路由，从而可能截获、
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is...
CVE-2026-72839
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default Cr
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是 CrowdStrike 与 Zscaler 的官方合作公告，核心内容是两家公司将联合把‘连续身份安全’（Continuous Identity Security）能力集成到零信任访问（Zero Trust Access）解决方案中。
CrowdStrike Announces Continuous Identity for AI Agents
2026年8月14日，CrowdStrike官方博客发布了一篇题为《CrowdStrike Announces Continuous Identity for AI Agents》的公告，宣布推出面向AI代理的持续身份（Continuous
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
GPUBreach: Privilege Escalation Attacks on GPUs Using Rowhammer.
本文研究了 NVIDIA GPU 上的 Rowhammer 攻击如何实现权限提升。此前，GPU 上的 Rowhammer 攻击仅限于在受害者数据中注入比特翻转，例如破坏机器学习模型的权重以降低准确率，无法像 CPU 攻击那样实现权限提升。作
LLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband Lower Layers.
本文提出 LLFuzz，一个针对蜂窝基带低层（如物理层、MAC层）的空中（over-the-air）动态测试框架。基带芯片是移动设备中处理蜂窝通信的关键组件，其低层协议栈通常运行在专用实时操作系统上，且与上层应用隔离，传统基于主机的模糊测试
Lazarus hackers exploited Windows zero-day to target defense firms
CVE-2026-68820
North Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector com
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec...
CVE-2026-73842
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files out...
CVE-2026-72841
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated user
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rt...
CVE-2026-14525
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnera
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
CVE-2026-55086
## Description `src/node/handler/ImportHandler.ts` and `src/node/handler/ExportHandler.ts` both compute their temporary
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS