LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
CVE-2026-84191
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescrip
2026-09-02 归档
今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。
← 返回归档列表A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server...
CVE-2026-18730
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown...
CVE-2026-84287
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the f
Ivanti Endpoint Manager Mobile代码注入漏洞
根据知道创宇Seebug漏洞库发布的信息，Ivanti Endpoint Manager Mobile（EPMM）存在一个代码注入漏洞。EPMM是一款用于企业移动设备管理的解决方案，可帮助IT部门集中管理智能手机、平板电脑等移动设备及安全策
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend...
CVE-2026-84479
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplie
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
CVE-2026-79675
## Vulnerability The fix for CVE-2026-12841 (CWE-88, JVM argument injection) added `_validate_java_options()` to block
Why Even the Best Edge Security Still Misses High-Risk Sessions
文章《为什么即使最好的边缘安全仍会漏掉高风险会话》探讨了攻击者如何利用住宅代理、公共VPN及其他代理服务，使恶意活动在网络层面看起来像正常用户流量，从而规避依赖IP信誉和地理位置等静态信号的边缘安全方案。Spur公司认为，传统的边缘安全往往
Poster: Detecting Adversarial Examples Hidden under Watermark Perturbation via Usable Information Theory.
本论文探讨图像水印扰动作为对抗性噪声时，对深度学习模型产生的欺骗威胁。传统对抗样本 (AE) 检测方法通常假设噪声为典型的扰动模式（如 Lp 范数约束），因此面对嵌入水印标志这类结构化噪声时往往失效，即水印扰动 AE 可绕过现有检测。文章提
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
2026年9月2日，CrowdStrike 发布博客，宣布与 Zscaler 达成技术合作，旨在将“持续身份安全”（Continuous Identity Security）整合进零信任访问体系。根据公开信息，本次合作将 CrowdStri
CrowdStrike Announces Continuous Identity for AI Agents
2026年9月2日，CrowdStrike通过官方博客发布公告，宣布推出面向人工智能代理（AI Agents）的持续身份（Continuous Identity）能力。该公告未附带详细正文，可能代表一项产品功能更新或新方案发布。从标题推断，
Microsoft warns of TerminalFix attacks deploying reverse tunnels
A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
CVE-2026-84308
phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in ph
Stable Channel Update for Desktop
CVE-2026-84329 · CVE-2026-84352 · CVE-2026-84356 · CVE-2026-84331 · CVE-2026-84347 · CVE-2026-84323 · CVE-2026-84350 · CVE-2026-84334 · CVE-2026-84357 · CVE-2026-84326 · CVE-2026-84325 · CVE-2026-84349 · CVE-2026-84358 · CVE-2026-84327 · CVE-2026-84328 · CVE-2026-84353 · CVE-2026-84335 · CVE-2026-84348 · CVE-2026-84333 · CVE-2026-84330 · CVE-2026-84332 · CVE-2026-84355 · CVE-2026-84324 · CVE-2026-84359 · CVE-2026-84351 · CVE-2026-84354
The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will rol
xmldom: Element name injection via createElement() bypasses requireWellFormed
CVE-2026-83607
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83605
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
Kyverno before 1.16.2 SSRF via APICall Feature
CVE-2026-84199
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field
Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
CVE-2026-84196
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authentica
librenms before 26.7.0 Stored XSS via graph_descr settings
CVE-2026-84188
LibreNMS versions configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs
AVideo Cross-Site Request Forgery via plugin/API/set.json.php
CVE-2026-83595
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform s