CrowdStrike and Zscaler Bring Continuous Identity to Zero Trust Access
这是一篇来自 CrowdStrike 官方博客的公告，介绍 CrowdStrike 与 Zscaler 达成合作，旨在将持续身份（Continuous Identity）能力引入零信任访问（Zero Trust Access）。文章核心内容
2026-09-03 归档
今日共收录 1407 条安全情报，包含 491 个 CVE，487 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 9 月 3 日宣布推出面向 AI 代理的持续身份安全功能（Continuous Identity for AI Agents）。该产品旨在应对企业环境中 AI 代理（如自动化工具、智能助手等）所带来
CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation
本文提出 CodePoisonRAG，一种针对检索增强代码生成（RACG）的定向上游知识投毒攻击框架。RACG 通过检索外部代码片段、文档和补丁，并将它们注入到 LLM 的生成上下文中来提升代码生成质量，但这也引入了新的信任边界：外部知识库
Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation
CVE-2026-53611
Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet
Stable Channel Update for Desktop
CVE-2026-84354 · CVE-2026-84359 · CVE-2026-84358 · CVE-2026-84334 · CVE-2026-84357 · CVE-2026-84356 · CVE-2026-84329 · CVE-2026-84347 · CVE-2026-84332 · CVE-2026-84333 · CVE-2026-84350 · CVE-2026-84325 · CVE-2026-84355 · CVE-2026-84352 · CVE-2026-84349 · CVE-2026-84328 · CVE-2026-84348 · CVE-2026-84353 · CVE-2026-84327 · CVE-2026-84326 · CVE-2026-84331 · CVE-2026-84351 · CVE-2026-84324 · CVE-2026-84335 · CVE-2026-84323 · CVE-2026-84330
The Stable channel has been updated to 152.0.7977.75/.76 for Windows and Mac and 152.0.7977.75 for Linux, which will rol
Program Ingredients Abstraction and Instantiation for Synthesis-based JVM Testing.
这篇论文关注 Java 虚拟机（JVM）的测试方法。JVM 是运行 Java 程序的核心基础设施，其可靠性直接影响大量应用的稳定与安全，因此对 JVM 进行严格测试非常重要。现有 JVM 测试技术中，基于合成（synthesis）的方法被认
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
CVE-2026-84366
### Problem Scrapy’s `S3DownloadHandler` sends signed S3 requests over plaintext HTTP by default. A normal request lik
Boruta: OAuth credentials exposed in Boruta business logs
CVE-2026-55221
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
CVE-2026-53649
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1
CVE-2026-84175
CVE-2026-84175
In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs
NocoBase Rich Text Field Stored Cross-Site Scripting via API
CVE-2026-84701
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store
BookStack before 26.05.4 Stored XSS via Drawing Upload
CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept
WWBN AVideo Authentication Bypass via User-Agent Header
CVE-2026-84479
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplie
AVideo Stored XSS via Live Schedule Title Description
CVE-2026-84477
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
CVE-2026-84373
Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and stand
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
CVE-2026-84371
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi
SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
CVE-2026-84369
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version
joi: Prototype pollution via a `__proto__` language key in custom messages
CVE-2026-84368
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
CVE-2026-84363
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query help
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS