Protocol Prying: Systematic Vulnerability Research in the AirDrop and Android Quick Share Proximity Transfer Protocols.
该论文对 Apple AirDrop 和 Google/Samsung Quick Share 两种近场文件传输协议进行了首次跨平台的逆向工程与协议感知模糊测试研究。这两种协议被超过 50 亿台设备使用，但由于实现均为专有且未公开文档，其应
2026-08-28 归档
今日共收录 1697 条安全情报，包含 762 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
网络安全研究人员发现了一系列针对欧洲政府与外交机构的新攻击活动，涉及罗马尼亚、西班牙和土耳其三国，时间跨度从2025年9月下旬持续至2026年4月上旬。这些攻击活动由Recorded Future Insikt Group在调查中披露，并被
Wazuh: Missing input validation in multiple active response scripts allows argument injection
CVE-2026-54085
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
CVE-2026-54083
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. T
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
CVE-2026-54330
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
Ceph: CephX AES Authentication error
CVE-2026-39944
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2
FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization
CVE-2026-68929
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, th
openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email
CVE-2026-81707
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inj
OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route
CVE-2026-81664
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each admi
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints
CVE-2026-80208
APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint
CVE-2026-80207
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. Reso
aiosmtplib: STARTTLS response injection
CVE-2026-55558
## Impact When a connection is upgraded with STARTTLS, aiosmtplib reads the server's 220 go-ahead reply and immediately
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
How Threat Research and MDR Help SMBs Build a Defensive Edge
2026年8月27日，BleepingComputer发布了一篇面向中小型企业（SMB）的防御性文章，由ESET公司阐述威胁研究与托管检测与响应（MDR）服务如何协同增强企业安全能力。文章核心观点是：威胁研究能够帮助企业安全团队了解攻击者的
SoK: Efficient Design and Implementation of Polynomial Hash Functions over Prime Fields.
本文是一篇系统化知识综述（SoK），聚焦于素数域上多项式哈希函数的高效设计与实现，并以广泛部署的 Poly1305 为主要参照对象。Poly1305 的设计理念由 Bernstein 在 2005 年前的一系列论文中奠定，但随着计算机体系结
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
CrowdStrike 与 Zscaler 于 2026 年 8 月 28 日联合宣布了一项合作，旨在将持续身份验证能力与零信任访问架构相结合。该合作的核心是整合 CrowdStrike 的端点检测与响应（EDR）平台及其身份保护模块，与
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
Unsaid, Unsafe? Implicit Security Obligations in LLM-Based RTL Code Generation
该论文聚焦于大语言模型（LLM）生成寄存器传输级（RTL）代码时的安全问题。与软件代码不同，RTL 一旦流片为芯片，安全缺陷将无法通过补丁修复，因此其安全性至关重要。现有研究主要关注 LLM 生成软件代码的安全漏洞，对硬件描述语言（HDL）