OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
CVE-2026-73843
### Summary The OpenChoreo control-plane **cluster-gateway** served its caller-facing management APIs on the same networ
2026-09-03 归档
今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表A flaw was found in submariner. In cert-auth mode, the connection configuration is built using...
CVE-2026-66786
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from th
Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2
CVE-2026-49249
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
CVE-2026-84377
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
CVE-2026-45730
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnera
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
CVE-2026-73841
### Summary The OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption...
CVE-2026-20354
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption...
CVE-2026-20355
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an...
CVE-2026-66362
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
CVE-2026-83548
SonicWall 已发布安全更新，修复其 Secure Mobile Access (SMA) 1000 系列 VPN 设备中两个已被零日利用的安全漏洞。根据 The Hacker News 的报道，这些漏洞由 SonicWall 内部的
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR...
CVE-2026-20279
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR...
CVE-2026-20274
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering t
Demystifying Local Business Search Poisoning for Illicit Drug Promotion.
该论文针对本地搜索服务（如本地知识面板、地图搜索、语音搜索）中出现的一种新型地下非法药物推广活动——非法药物商户列表——进行了首次大规模测量研究。研究发现，不法分子利用上游本地数据经纪商对数据质量管控宽松的漏洞，发布推广非法药物业务的商户信
Mental Damage: Caption Poisoning Attacks on Retrieval-Augmented Text-to-Music Generation.
本文研究了检索增强式文生音乐（Retrieval-Augmented Text-to-Music, TTM）系统面临的一种新型数据投毒攻击。此类系统在用户提示词不明确时，会从音乐描述数据库中检索相关文字描述（caption）来增强提示，再交
Parallelizing Universal Atomic Swaps for Multi-Chain Cryptocurrency Exchanges.
该论文研究的是多链加密货币交易所中原子交换的并行化问题。原子交换是一种去中心化的跨链交易机制，允许不同区块链上的用户直接交换资产而无需信任第三方，但传统原子交换（如哈希时间锁定合约 HTLC）通常只能逐笔串行执行，导致吞吐量低、确认延迟高，
NeuroScope: Reverse Engineering Deep Neural Network on Edge Devices using Dynamic Analysis.
本文针对边缘设备上部署的深度神经网络（DNN）面临模型逆向工程风险这一问题，提出并实现了一种基于动态分析的模型重构框架，称为 NeuroScope。在现实生活中，智能摄像头、智能音箱、工业控制器等边缘设备往往依赖第三方深度学习模型完成推理任
Subverting Stateful Firewalls with Protocol States.
该论文研究了多个 TCP/IP 协议栈实现中协议头字段的生成过程，发现这些字段会泄露关于全局协议状态的信息，并基于此构造了新的隐蔽信道。以往的工作通常假定主机未被防火墙保护，而本研究针对位于防火墙网络（包括源地址验证 SAV）内部的常见主机
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)