Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations...
CVE-2026-47879
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto de
2026-08-27 归档
今日共收录 918 条安全情报，包含 88 个 CVE，417 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root
CVE-2026-54563
## Summary A Cloudreve WebDAV account stores a `uri` that defines the account's root folder. The WebDAV request handler
Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system
CVE-2026-54523
## Summary In Kyverno v1.18.1, a tenant who can create a `NamespacedMutatingPolicy` in their own namespace can instruct
Ivanti Endpoint Manager Mobile代码注入漏洞
根据知道创宇/Seebug漏洞库（SSVID-99967）的公告，Ivanti Endpoint Manager Mobile（EPMM）存在代码注入漏洞。EPMM是Ivanti公司提供的移动设备管理（MDM）解决方案，用于企业统一管理移动
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in...
CVE-2026-80557
In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via miss
senaite.core Vulnerable to Eval Injection and Missing Authorization
CVE-2026-54569
### Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable
Distributed Broadcast Encryption for Confidential Interoperability across Private Blockchains.
本文针对私有区块链网络之间进行机密互操作时面临的安全挑战，提出了一种基于完全分布式广播加密（FDBE）的解决方案。在传统的跨链互操作场景中，不同私有网络传输账本状态通常依赖一个受信任的中心化代理，该代理负责解密发送方的加密状态并转发给接收方
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
2026年8月27日，CrowdStrike与Zscaler联合宣布，将把持续身份安全能力集成到零信任访问架构中。此次合作旨在将CrowdStrike Falcon平台的身份威胁检测与Zscaler Zero Trust Exchange的
CrowdStrike Announces Continuous Identity for AI Agents
2026年8月27日，CrowdStrike宣布推出‘Continuous Identity for AI Agents’（面向AI代理的持续身份）功能。该功能是CrowdStrike Falcon平台的延伸，旨在应对AI代理（如自主工作流
Poster: MSILDiffer - A Security Patch Analysis Framework Based on Microsoft Intermediate Language for Large Software.
本文提出 MSILDiffer，一个基于 Microsoft 中间语言（MSIL）的安全补丁分析框架，旨在解决大型软件中安全补丁定位与理解困难的问题。传统补丁分析通常面向源代码或原生二进制，但在大型软件（尤其使用 .NET 技术栈的产品）中
better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
CVE-2026-80192
@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) con
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
CVE-2026-52776
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versio
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
多款Huawei路由器信息泄露漏洞
多款Huawei路由器信息泄露漏洞
LLMs in the SOC: An Empirical Study of Human-AI Collaboration in Security Operations Centres.
本文是一篇关于安全运营中心（SOC）中人类与AI协作的实证研究。研究背景是，随着大语言模型（LLM）在安全分析工具中的快速集成，理解人类分析师如何与这些AI系统实际协作变得至关重要。然而，目前缺乏针对真实SOC环境中人机交互模式的系统性、实
Incalmo: an Autonomous Llm-Assisted System for Red Teaming Multi-Host Networks.
本文针对企业级多主机网络红队测试中依赖人工专家、成本高昂且难以扩展的问题，提出利用大语言模型（LLM）自动化执行红队演练。作者首先系统评估了现有最先进的LLM辅助攻击系统（如PentestGPT、CyberSecEval3）结合顶级LLM（