ToxicPanda Android malware uses VPN permissions to block Google Play
ToxicPanda是一款针对Android平台的恶意软件，近期被披露出现新的恶意功能和扩展。根据BleepingComputer的报道，该恶意软件已将其针对的目标应用数量扩大到349个，并支持167条远程控制命令，表明其控制端与受害设备之
2026-08-24 归档
今日共收录 798 条安全情报，包含 82 个 CVE，390 篇安全通告，以及 72 篇研究论文。
← 返回归档列表justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers ...
CVE-2026-5388
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_st
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers...
CVE-2026-74727
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by
Ivanti Endpoint Manager Mobile代码注入漏洞
该公告来自知道创宇 Seebug 漏洞库（SSVID-99967），标题为“Ivanti Endpoint Manager Mobile代码注入漏洞”。Ivanti Endpoint Manager Mobile 是 Ivanti 旗下的移
Euler: Detecting Network Lateral Movement via Scalable Temporal Graph Link Prediction.
该论文提出了一种名为 EULER 的框架，用于通过可扩展的时间图链接预测来检测网络横向移动。横向移动是高级持续性威胁（APT）攻击中的关键阶段，但传统检测方法面临挑战。作者将网络主机日志抽象为离散的时间图，将问题转化为演化网络中的异常边检测
LEAP: Leakage-Abuse Attack on Efficiently Deployable, Efficiently Searchable Encryption with Partially Known Dataset.
本文提出了一种名为 LEAP 的泄漏滥用攻击，针对高效部署且高效搜索的加密（EDESE）方案，特别关注 ShadowCrypt 等实际系统。可搜索加密（SE）允许用户在加密文档上执行私密查询，但许多面向工业部署的方案为了性能而牺牲了一定的信
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
根据知道创宇 Seebug 漏洞库发布的信息，Citrix NetScaler（一款应用交付控制器和负载均衡产品）存在一个内存泄漏漏洞，其编号为 CVE-2025-5777。内存泄漏漏洞通常意味着程序在动态分配内存后未能正确释放，长期运行可
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是 CrowdStrike 与 Zscaler 发布的一篇联合博客，主题为将持续身份安全能力融入零信任访问架构。文章发布于 2026-08-24，来源为 CrowdStrike 官方网站。内容主要介绍两家公司在零信任安全领域的合作，旨在
CrowdStrike Announces Continuous Identity for AI Agents
2026年8月24日，CrowdStrike官方发布公告，宣布推出“面向AI代理的持续身份”功能。该功能旨在为人工智能代理提供动态、持续的身份验证与授权管理，确保AI代理在访问企业资源时具备可信且实时的身份凭证。随着企业越来越多地采用AI代
ClawSentry: A Progressive Multi-Tier Security Monitor for Safeguarding Autonomous LLM Agents
本文提出 ClawSentry，一个面向自主 LLM 智能体的渐进式多层安全监控网关。随着大语言模型从简单对话演进到执行代码、读取本地文件以及编排外部工具，被恶意第三方技能劫持的智能体可能导致数据泄露、权限提升或级联性系统受损。作者认为智能
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
CVE-2026-74672
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to av
Towards Privacy and Security in Private Clouds: A Representative Survey on the Prevalence of Private Hosting and Administrator Characteristics.
本文是一篇针对私有云托管现状与管理员特性的代表性调查研究，旨在探讨私有云环境中的隐私与安全问题。研究背景在于，随着云计算的普及，私有云被许多组织视为比公共云更安全、更可控的选项，但实际上私有云的安全状况在很大程度上依赖于管理员的配置和操作。
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature...
CVE-2026-74702
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Always...
CVE-2026-74700
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Always acquire rtnl_lock when d
mm/damon/ops-common: putback folios on invalid migrate nid
CVE-2026-74644
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migr
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_pas...
CVE-2026-5388
justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_st
An Interactive Prover for Protocol Verification in the Computational Model.
这篇 arXiv 论文提出了一套用于在计算模型下对安全协议进行机械化验证的框架和交互式证明器。研究背景是：安全协议设计的正确性至关重要，需要坚实的数学基础和计算机辅助方法。此前 Bana 和 Comon 提出的形式化方法只能分析固定会话数目
Demo: Detecting Third-Party Library Problems with Combined Program Analysis.
本文介绍了一种结合静态与动态程序分析的方法，用于推断和执行服务端 JavaScript 中第三方库的权限。现代软件开发广泛依赖第三方库，但这些库通常未经人工审查，可能引入 bug、漏洞或恶意攻击，最终影响终端用户。作者提出一个以 RWX（读