Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
CVE-2026-45018
### Am I affected? Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has bee
2026-08-26 归档
今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文为 CrowdStrike 官方博客，发表于 2026 年 8 月 26 日。文章宣布 CrowdStrike 与 Zscaler 达成合作，将连续身份认证功能引入零信任访问架构。零信任模型强调对每一次访问请求均进行身份验证与设备合规性
eml_parser vulnerable to DoS via deeply nested parens in Received headers
CVE-2026-55620
### Summary `eml_parser` strips parenthesised CFWS comments from `Received:` headers using a regex-based fix-point loop
eml_parser has a URL extraction bypass via HTML entities in URLs
CVE-2026-55618
## Summary `eml_parser` performs certain validations on potential URL strings to discard bogus values. In versions prio
djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls
CVE-2026-55571
### Impact djust's `LiveViewConsumer` mounts a `LiveView` over a WebSocket. When a view is gated (`login_required` / `p
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
PolyDoc: Surveying PDF Files from the PolySwarm network.
该论文介绍了一个名为 PolyDoc 的工具，用于对从 PolySwarm 众包威胁情报网络获取的 PDF 文件进行格式感知的追踪和分析。PDF 格式因其复杂性和对互操作性与一致呈现的严格要求，成为攻击者编码漏洞和攻击的常见载体。研究旨在探
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
### Summary `mcpgateway.services.prompt_service.PromptService` renders user-supplied prompt templates using Jinja2's pl
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 8 月 26 日发布公告，宣布推出面向 AI 代理（AI Agents）的持续身份安全方案（Continuous Identity for AI Agents）。该产品旨在解决 AI 代理在运行时面
Hackers abuse npm mirrors to host phishing redirect pages
攻击者正在滥用 npm 及其公共镜像服务，在镜像中托管恶意 HTML 页面。这些页面伪装成 Cloudflare 的 CAPTCHA 验证界面，当访客访问这些页面时，会被自动重定向到攻击者控制的网站上。这种手法利用了对 npm 生态和官方/
CodeMechanic: Bug-Property-Guided Program Mitigation
本文提出 CodeMechanic，一个基于缺陷属性引导的程序缓解系统，旨在解决自动化测试发现内存损坏漏洞后，开发者来不及修复、导致已知漏洞长时间可利用的问题。现有基于大语言模型（LLM）的端到端修复代理虽然能缩短这一时间窗口，但会生成开放
Stable Channel Update for Desktop
CVE-2026-79069 · CVE-2026-79257 · CVE-2026-79052 · CVE-2026-79218 · CVE-2026-79247 · CVE-2026-79200 · CVE-2026-79194 · CVE-2026-79195 · CVE-2026-79155 · CVE-2026-79292 · CVE-2026-79290 · CVE-2026-79054 · CVE-2026-78989 · CVE-2026-78986 · CVE-2026-79047 · CVE-2026-79202 · CVE-2026-79224 · CVE-2026-79219 · CVE-2026-78935 · CVE-2026-79282 · CVE-2026-79012 · CVE-2026-79150 · CVE-2026-79093 · CVE-2026-79011 · CVE-2026-79183 · CVE-2026-78934 · CVE-2026-79121 · CVE-2026-79175 · CVE-2026-79212 · CVE-2026-79039 · CVE-2026-78939 · CVE-2026-78911
The Chrome team is delighted to announce the promotion of Chrome 152 to the stable channel for Windows, Mac and Linux. T
PowerHooK: Enabling Software-Based Power Side Channels Against AMD SEV Technologies via Transient-Execution Replay.
本文提出了一种名为 PowerHooK 的新型侧信道攻击技术，旨在针对 AMD SEV（安全加密虚拟化）技术实现基于软件的电能侧信道泄露。AMD SEV 系列（包括 SEV、SEV-ES 和 SEV-SNP）被广泛用于保护云环境中的虚拟机隔
gRPC Erlang package's path bindings are overridable by query string and request body
CVE-2026-48599
### Summary In the HTTP-to-gRPC transcoding layer of the `grpc` Hex package, query-string and request-body parameters c
reachy_mini Allows Unrestricted Upload of File with Dangerous Type
CVE-2026-55419
## Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file valid
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
CVE-2026-55677
### Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the ra
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS