In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network...
CVE-2026-76362
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOA
2026-08-20 归档
今日共收录 1886 条安全情报，包含 1062 个 CVE，406 篇安全通告，以及 120 篇研究论文。
← 返回归档列表In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the...
CVE-2026-76355
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edg
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway...
CVE-2026-76351
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9,
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
CVE-2026-63123
### Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to ca
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
CVE-2026-73974
## Summary Every Linuxfabrik check plugin that supports the shared `--test` argument (routed through `lib.lftest.test()`
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection.
该论文针对基于溯源（provenance）的入侵检测系统（PIDS）中规则方法检测精度不足、误报率高的问题展开研究。现有规则型PIDS虽然具备轻量级、实时性强和可解释性等优势，但规则通常过于粗糙且缺乏针对具体环境的配置，导致在实际部署中难以
PILOT: Command-Line Interface Fuzzing Via Path-Guided, Iterative Large Language Model Prompting.
该论文提出了一种名为 PILOT 的新型命令行界面（CLI）模糊测试框架。CLI 模糊测试通过同时变异命令行选项和输入文件内容来测试程序，从而发现仅在特定选项与输入组合下才会触发的深层漏洞。然而，现有 CLI 模糊测试方法在生成语义丰富的选
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是CrowdStrike与Zscaler的联合公告，宣布双方将把连续身份验证能力（Continuous Identity）集成到零信任访问（Zero Trust Access）解决方案中。该合作旨在实现用户身份与设备状态的实时校验，确保
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike于2026年8月20日发布公告，宣布推出“Continuous Identity for AI Agents”新功能。该功能旨在应对AI代理（如自动化脚本、智能机器人、大模型驱动的自主系统等）在身份安全方面带来的新挑战
Stable Channel Update for Desktop
CVE-2026-76042 · CVE-2026-76047 · CVE-2026-76033 · CVE-2026-76046 · CVE-2026-76043 · CVE-2026-76035 · CVE-2026-76041 · CVE-2026-76038 · CVE-2026-76039 · CVE-2026-76040 · CVE-2026-76044 · CVE-2026-76045 · CVE-2026-76037 · CVE-2026-76034 · CVE-2026-76036
The Stable channel has been updated to 151.0.7922.169/.170 for Windows and Mac and 151.0.7922.169 for Linux, which will
In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk...
CVE-2026-76388
In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security role cou
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold...
CVE-2026-76353
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, all...
CVE-2026-18031
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session
A Comprehensive Memory Safety Analysis of Bootloaders.
引导加载程序（bootloader）在系统启动流程中扮演关键角色，它连接固件与操作系统，负责验证并加载操作系统镜像，是安全启动链的核心环节。一旦bootloader存在漏洞，攻击者可能绕过安全启动机制，在系统启动早期植入恶意代码。近年来，随