Chromium: CVE-2026-76035 Inappropriate implementation in Media
CVE-2026-76035
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
2026-08-22 归档
今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。
← 返回归档列表Chromium: CVE-2026-76034 Buffer overflow in WebGL
CVE-2026-76034
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-76033 Inappropriate implementation in CORS
CVE-2026-76033
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文章为 CrowdStrike 与 Zscaler 两家安全厂商发布的合作公告，核心内容是将持续身份验证（Continuous Identity）能力集成到零信任访问（Zero Trust Access）解决方案中。文章指出，传统零信任架
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 8 月 22 日发布公告，宣布推出面向 AI 代理的“连续身份”（Continuous Identity）解决方案。该公告聚焦于 AI 代理作为企业环境中一种新兴的“非人身份”类别，其身份管理与传统
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter
CVE-2026-63462
## Summary An unauthenticated `POST` to any OpenAPI-validated endpoint, including the anonymous `POST /edge/validate` a
A stack-based out-of-bounds write vulnerability exists in the login request handling...
CVE-2026-17252
A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth...
CVE-2026-77812
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low Energy) without encry
Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
CVE-2026-72846
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/b
TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
CVE-2026-54508
TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect follo
CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`
CVE-2026-55769
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and
LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API
CVE-2026-49436
LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /ap
BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
CVE-2026-55491
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record
Mongoose: Stored XSS via unescaped filenames in directory listing
CVE-2026-73254
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML pa
LangBot: Authenticated RCE Via MCP Configuration
CVE-2026-54449
LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-65801
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges ov
Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network w...
CVE-2026-49360
Recce 是一个用于增强 dbt（数据构建工具）代码审查的数据验证工具。在版本 1.50.0 之前，如果 OSS 服务器部署将 recce server 暴露给不受信任的网络且未启用认证，攻击者可通过查询运行 API 执行未经认证的 SQ
Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at `internal/cluster/replication/receiver....
CVE-2026-48106
CVE-2026-48106 影响 Arc（一个开源的、SQL 原生时间序列数据库）的 Enterprise 集群复制功能。在版本 26.06.1 之前，位于 internal/cluster/replication/receiver.go