Acknowledgements
Acknowledgements
2026-08-26 归档
今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression a...
CVE-2026-55546
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engin
Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, ...
CVE-2026-71300
Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Cam
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from...
CVE-2026-66906
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel:
CountDown: Refcount-guided Fuzzing for Exposing Temporal Memory Errors in Linux Kernel.
本文针对 Linux 内核中由引用计数使用不当引发的释放后使用（UAF）漏洞提出了一种新的模糊测试方法。作者首先统计发现，近期内核 UAF 漏洞中约有 36.1% 与引用计数操作错误相关，此类漏洞根因复杂且可利用性高，对系统安全构成严重威胁
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected...
CVE-2026-79911
A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the functio
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter...
CVE-2026-80138
ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to s
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If...
CVE-2026-65905
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize req
DB-GPT builds the destination path for an uploaded skill from the multipart filename without...
CVE-2026-80104
DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the uplo
Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65...
CVE-2026-79288
Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to
Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote...
CVE-2026-79282
Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbit
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed...
CVE-2026-79286
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to po
Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65...
CVE-2026-79273
Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacke
Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977...
CVE-2026-79254
Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote atta
Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65...
CVE-2026-79256
Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attack
Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote...
CVE-2026-79241
Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
CVE-2026-45019
### Am I affected? Only if your deployment sets `features.mcp.enabled = true` in `.chainlit/config.toml`. **MCP has bee
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching
CVE-2026-49757
### Summary AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address rather than b
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
CVE-2026-55663
### Summary mediasoup's built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcod
gRPC Erlang package has unbounded gzip decompression (decompression bomb)
CVE-2026-53430
### Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compr