Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown
CVE-2026-82881
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored c
2026-09-01 归档
今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
根据输入信息，Ivanti Endpoint Manager Mobile（EPMM）存在一个代码注入漏洞。Ivanti Endpoint Manager Mobile 是 Ivanti 公司提供的移动设备管理（MDM）解决方案，用于帮助企
Backdoor Attacks Against Dataset Distillation.
该论文首次系统性地研究了数据集蒸馏（Dataset Distillation）技术面临的后门攻击风险。数据集蒸馏旨在将大规模训练数据压缩成小规模合成数据集，使模型在合成数据上训练后仍能达到与原始数据训练相近的性能，从而提升数据效率。然而，现
Private Access Control for Function Secret Sharing.
该论文首次系统性地研究了函数秘密共享（Function Secret Sharing, FSS）中的访问控制问题。FSS 允许一个分发者将函数 f 的份额分发给两个或多个评估者，评估者可以在不泄露 f 本身信息的情况下，对任意输入 x 本地
Sparrow: Space-Efficient zkSNARK for Data-Parallel Circuits and Applications to Zero-Knowledge Decision Trees.
本文提出 Sparrow，一种面向数据并行算术电路的空间高效零知识简洁非交互式证明（zkSNARK）方案。zkSNARK 在实际部署中常因证明者空间开销过大而受限，其空间需求可能比原生计算高出数个数量级。Sparrow 首次在固定有限域上实
Entangled Watermarks as a Defense against Model Extraction.
本文针对机器学习模型被窃取（model extraction）的知识产权保护问题，提出了一种名为 Entangled Watermarking Embeddings (EWE) 的模型水印方法。传统模型水印通过让模型在训练时过拟合到一些远离
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
根据知道创宇/Seebug漏洞库的公告，Citrix NetScaler 存在一个内存泄漏漏洞，编号为 CVE-2025-5777。内存泄漏漏洞通常会导致设备在长时间运行后内存资源被逐渐耗尽，从而引发性能下降、响应缓慢甚至服务不可用，可能影
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
本文是 CrowdStrike 与 Zscaler 于 2026 年 9 月发布的产品合作公告，核心内容是将 CrowdStrike 的 Falcon 平台（EDR/XDR）与 Zscaler 的零信任访问能力（Zscaler Privat
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike官方博客宣布推出“面向AI代理的持续身份”（Continuous Identity for AI Agents）功能。该功能旨在为企业和组织中日益普及的AI代理提供持续的身份验证、授权和访问治理能力，确保AI代理在调用
Microsoft warns of TerminalFix attacks deploying reverse tunnels
Microsoft 发布安全警告，披露一种名为 TerminalFix 的新型 ClickFix 攻击变种。攻击者在已沦陷的网站上植入伪造的 Cloudflare CAPTCHA 验证页面，利用用户对验证码的信任，诱骗访客在 Windows
FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference
CVE-2026-82821
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of
FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow
CVE-2026-82820
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the c
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
CVE-2026-79745
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
CVE-2026-81852
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce,
Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
CVE-2026-81636
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated
Ghost Domain Reloaded: Vulnerable Links in Domain Name Delegation and Revocation.
本研究提出一种名为 PHOENIX DOMAIN 的新型通用攻击方法，能够使已被撤销的恶意域名在大规模范围内持续可解析，从而复活旧有的 Ghost Domain 攻击。该攻击不违反任何 DNS 规范或最佳安全实践，因此影响所有主流 DNS
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality...
CVE-2026-67395
A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validati
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the...
CVE-2026-82957
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptio
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the...
CVE-2026-82821
A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf_object_get of
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the...
CVE-2026-82820
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the c