Ivanti Endpoint Manager Mobile代码注入漏洞
根据知道创宇/Seebug漏洞库（SSVID-99967）的公告，Ivanti Endpoint Manager Mobile（EPMM）存在代码注入漏洞。EPMM是Ivanti提供的移动设备管理（MDM）解决方案，用于统一管理企业移动设备
2026-08-31 归档
今日共收录 884 条安全情报，包含 132 个 CVE，408 篇安全通告，以及 86 篇研究论文。
← 返回归档列表TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
该公告由知道创宇/Seebug收录，标题为“TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)”，涉及天融信（TOPSEC）防火墙产品。公告代号ELIGIBLEBACHELOR表明存在一
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
根据知道创宇Seebug漏洞库发布的公告，Fortinet公司的FortiGate防火墙产品被披露存在一个远程代码执行漏洞，该漏洞被赋予专用代号EGREGIOUSBLUNDER。FortiGate是广泛应用于企业、政府和运营商网络边界的安全
Chrome Web Store extensions caught stealing crypto, browser data
据BleepingComputer报道，Google Chrome和Microsoft Edge的官方扩展商店中出现多个恶意扩展，它们携带一个恶意软件框架，能够部署模块以窃取加密货币、敏感数据、浏览器历史记录，并向用户展示ClickFix诱
Ring Referral: Efficient Publicly Verifiable Ad hoc Credential Scheme with Issuer and Strong User Anonymity for Decentralized Identity and More.
本文提出了一种称为“环推荐”（Ring Referral）的新型密码学方案，它是传统环签名（Ring Signature）的自然扩展。在传统环签名中，签名者可以从一个临时选定的签名者集合（环）中匿名地签署消息；而环推荐方案允许一个证明者（用
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
根据知道创宇 Seebug 漏洞库发布的公告（SSVID-99926），Citrix NetScaler 产品存在一个内存泄漏漏洞，编号为 CVE-2025-5777。公告标题明确指出了漏洞类型为内存泄漏，但由于公告正文未公开，受影响的具体
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是CrowdStrike与Zscaler于2026年8月31日发布的一则合作公告。双方宣布将把持续身份安全能力引入零信任访问体系，结合CrowdStrike的Falcon Identity Protection（身份威胁检测与响应能力）
CrowdStrike Announces Continuous Identity for AI Agents
2026年8月31日，CrowdStrike发布官方博客，宣布推出面向AI代理的持续身份解决方案（Continuous Identity for AI Agents）。该方案旨在解决AI代理在自动化工作流中面临的身份治理与访问控制挑战，例如
Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
CVE-2026-81636
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated
SiYuan before v3.8.1 Stored XSS via confirmDialog
CVE-2026-82653
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package nam
Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
CVE-2026-82642
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized wit
browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage
CVE-2026-82640
browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or
browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation
CVE-2026-82637
browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing atta
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
CVE-2026-82633
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API
Pake arbitrary file write via unsanitized download_file filename
CVE-2026-82635
Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads
SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
CVE-2026-80227
Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriag
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Fuzzing JavaScript Engines with a Graph-based IR.
该论文针对 JavaScript 引擎模糊测试中的突变质量瓶颈，提出了一种基于图结构中间表示（Graph-based IR）的新方法。当前主流 JS 引擎模糊测试工具通常使用抽象语法树（AST）或定制的字节码级中间语言来表示程序，但这些表示
On the Effectiveness of Prompt Stealing Attacks on In-the-Wild Prompts.
本文系统研究了针对现实世界（in-the-wild）提示词（Prompt）的“提示词窃取攻击”（Prompt Stealing Attacks）有效性。随着大型语言模型（LLM）的普及，高质量提示词已成为提示词市场中的宝贵商品，但攻击者试图