Chromium: CVE-2026-79041 Missing authorization in Browser
CVE-2026-79041
Microsoft MSRC 发布了一则关于 Chromium 项目的安全公告，涉及 CVE-2026-79041。该漏洞被描述为“Browser 中的缺失授权（Missing authorization in Browser）”，表明 C
2026-08-29 归档
今日共收录 1687 条安全情报，包含 687 个 CVE，604 篇安全通告，以及 114 篇研究论文。
← 返回归档列表The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate...
CVE-2026-16947
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path b
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI...
CVE-2026-81520
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session ope
MariaDB has cleartext password disclosure to a MITM on the initial-handshake
CVE-2026-55856
### Summary When a Java application connects with sslMode=verify-full (or verify-ca) and a password but does not pin a
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
CVE-2026-55874
### Summary The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `Co
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset
CVE-2026-55678
## Summary Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` b
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
CVE-2026-55761
## Summary Portainer supports restoring an instance from a backup archive via the /api/restore endpoint. This endpoint i
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
CVE-2026-55696
### Summary Stored cross-site scripting (XSS) in PrivateBin's attachment download link. An anonymous attacker can creat
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary...
CVE-2026-19295
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the...
CVE-2026-80203
The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
根据The Hacker News报道，Recorded Future Insikt Group的研究人员披露了一起针对欧洲政府与外交组织的网络间谍活动。攻击主要瞄准罗马尼亚、西班牙和土耳其的政府机构与外交部门，活动时间从2025年9月底持
Mad-Dag: Protecting Blockchain Consensus From MEV.
本文提出并分析了一种名为 MAD-DAG（Mutually-Assured-Destruction Directed-Acyclic-Graph）的新型区块链共识协议，旨在抵御在不利条件下（如网络传播优势、矿工可提取价值 MEV、以及接受贿
Swivel: Hardening WebAssembly against Spectre.
本文提出Swivel，一个用于加固WebAssembly（Wasm）免受Spectre攻击的编译器框架。在浏览器之外，Wasm已成为一种流行的轻量级进程内沙箱，常用于边缘云计算和函数即服务（FaaS）平台中隔离不同客户端。然而，Spectr
Batchman and Robin: Batched and Non-batched Branching for Interactive ZK.
本文提出了一种针对交互式零知识证明（ZK）中析取语句（即多个分支子句的或）的高效证明方法。当前基于向量不经意线性求值（VOLE）的ZK协议虽已实现快速可扩展的证明，但将证明语句编译为控制流无关形式（如电路）仍然导致昂贵的证明开销。对于形如
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Chromium: CVE-2026-79236 Type confusion in V8
CVE-2026-79236
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-79214 Improper input validation in Preload
CVE-2026-79214
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-79291 Information leak in CSS
CVE-2026-79291
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-79094 Race condition in Workers
CVE-2026-79094
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.