The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate...
CVE-2026-16947
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path b
2026-08-30 归档
今日共收录 849 条安全情报，包含 76 个 CVE，428 篇安全通告，以及 85 篇研究论文。
← 返回归档列表Deep Dive into In-app Browsers: Uncovering Hidden Pitfalls in Certificate Validation.
本论文针对应用内浏览器（WebView）的证书验证机制进行了系统性安全评估，重点考察其对X.509证书标准的符合程度，以及对吊销与证书透明度（CT）等高级扩展的支持情况。作者开发了统一测试框架FAITH，利用实体设备（iOS）和模拟器（An
KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints
CVE-2026-82473
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verificati
SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint
CVE-2026-56100
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows a
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without...
CVE-2026-82473
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verificati
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI...
CVE-2026-81520
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session ope
MariaDB has cleartext password disclosure to a MITM on the initial-handshake
CVE-2026-55856
### Summary When a Java application connects with sslMode=verify-full (or verify-ca) and a password but does not pin a
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
CVE-2026-55874
### Summary The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `Co
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset
CVE-2026-55678
## Summary Arc Enterprise clustering accepts cluster join requests without authentication when `cluster.enabled=true` b
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
CVE-2026-55761
## Summary Portainer supports restoring an instance from a backup archive via the /api/restore endpoint. This endpoint i
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
CVE-2026-55696
### Summary Stored cross-site scripting (XSS) in PrivateBin's attachment download link. An anonymous attacker can creat
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file...
CVE-2026-82460
Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoint
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary...
CVE-2026-19295
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是CrowdStrike官方博客发布的一则合作公告，宣布与Zscaler共同推进零信任安全架构，重点实现连续身份验证能力。传统零信任通常在登录时验证一次身份，而该合作将CrowdStrike Falcon平台的实时端点身份和风险信号（如
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 8 月 30 日发布公告，宣布推出面向 AI 代理的连续身份（Continuous Identity for AI Agents）能力。这是一项产品功能更新，而非具体的攻击事件或漏洞披露。该功能旨在
OS-Aware Vulnerability Prioritization via Differential Severity Analysis.
该论文提出了一种面向操作系统（OS）的漏洞优先级排序方法，核心思想是引入‘差分严重性分析’（Differential Severity Analysis）。传统漏洞评分（如CVSS）仅基于漏洞本身的固有属性，忽略了同一漏洞在不同操作系统环境