Chromium: CVE-2026-84323 Missing authorization in FileSystem
CVE-2026-84323
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
2026-09-04 归档
今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。
← 返回归档列表CrowdStrike Announces Continuous Identity for AI Agents
2026年9月4日，CrowdStrike宣布推出面向AI代理的Continuous Identity（连续身份）解决方案。该功能旨在解决AI代理在自动化业务流程中的身份安全挑战，通过持续的身份验证、授权与监控，确保每个AI代理在执行任务时
CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation
该论文提出并研究了针对检索增强代码生成（RACG）系统的知识投毒攻击框架 CodePoisonRAG。RACG 通过检索外部代码片段、文档和补丁并注入到生成上下文中来辅助大语言模型生成代码，但这种对外部知识的依赖引入了新的信任边界：攻击者无
Stable Channel Update for Desktop
CVE-2026-85042 · CVE-2026-85049 · CVE-2026-85051 · CVE-2026-85044 · CVE-2026-85045 · CVE-2026-85047 · CVE-2026-85048 · CVE-2026-85050 · CVE-2026-85053 · CVE-2026-85052 · CVE-2026-85043 · CVE-2026-85046
The Stable channel has been updated to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, which will rol
MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
CVE-2026-85221
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property w
2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption
CVE-2026-85100
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentS
langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
CVE-2026-85022
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace
langgenius dify Splash Layout splash.tsx router.replace cross site scripting
CVE-2026-85021
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(s
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validat...
CVE-2026-66786
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from th
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
CVE-2026-53728
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identi
Waku: Cross-Origin CSRF on RSC Server Action Dispatch
CVE-2026-49455
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions
GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter
CVE-2026-58400
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the S
Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
CVE-2026-85238
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a us
Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
CVE-2026-85237
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unre
MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
CVE-2026-85236
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed
Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
CVE-2026-71403
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `userna
Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
CVE-2026-85227
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The t
MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
CVE-2026-85226
MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from ma