Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an...
CVE-2026-75925
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands
2026-09-05 归档
今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。
← 返回归档列表OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation
CVE-2026-73842
### Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs (`/api/proxy/`, `/api/exec/`,
Chromium: CVE-2026-84349 Use after free in Browser
CVE-2026-84349
CVE-2026-84349 是 Chromium 中浏览器组件（Browser）存在的一处释放后使用（Use after free）漏洞。Microsoft Edge（基于 Chromium）会集成 Chromium 的上游代码，因此该漏
GPU Travelling: Efficient Confidential Collaborative Training with TEE-Enabled GPUs.
本文提出了一种名为 GPU Travelling 的新型机制，旨在解决机密协作机器学习（Confidential Collaborative ML）中因模型和数据集规模快速增长而导致的通信开销过大的问题。在传统的多方联合训练场景中，多个互不
Sok: Evaluating Jailbreak Guardrails for Large Language Models.
本文是一篇针对大语言模型（LLM）越狱防护机制的系统化知识（SoK）综述。研究背景在于：尽管LLM取得了显著进展，但其部署暴露了严重的安全漏洞，尤其是越狱攻击能够绕过模型的安全对齐机制。为应对这一威胁，防护栏（guardrails）——即用
Ivanti Endpoint Manager Mobile代码注入漏洞
根据知道创宇Seebug漏洞库收录的信息，存在一则关于Ivanti Endpoint Manager Mobile的代码注入漏洞公告。公告标题表明该产品存在代码注入风险，但当前公告中未提供具体受影响版本、CVE编号、技术细节或严重性分级。I
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which...
CVE-2026-77393
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenti
SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key a...
CVE-2026-72793
**CVE:** This vulnerability corresponds to [CVE-2026-72793](https://nvd.nist.gov/vuln/detail/CVE-2026-72793). ### Summa
SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
CVE-2026-72794
**CVE:** This vulnerability corresponds to [CVE-2026-72794](https://nvd.nist.gov/vuln/detail/CVE-2026-72794). ### Summa
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
CVE-2026-63735
An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different
Critical Citrix NetScaler auth bypass now leveraged in attacks
CVE-2026-19490
2026年9月4日，据BleepingComputer报道，安全情报公司Previdian指出攻击者已在野外针对Citrix NetScaler中一个严重级别的身份验证绕过漏洞（CVE-2026-19490）展开利用。该漏洞允许攻击者绕过身
How to secure edge AI in customer-owned environments
本文是微软安全团队于2026年9月4日发布的一篇技术指南，主题为在客户自有的边缘计算环境中安全部署和管理AI系统。随着AI推理逐渐从云端下沉到边缘设备，组织往往需要在自身控制的基础设施上运行AI模型，并处理敏感数据、凭据和模型资产。微软指出
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
CVE-2026-75913
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
Web Application Vulnerability Repair Via Context-Aware Fault Localization and Directed Differential Fuzzing.
本文针对Web应用程序漏洞修复过程中存在的关键挑战：漏洞定位困难、修复补丁可能引入新问题或修复不完整等。作者提出了一种结合上下文感知的故障定位（Context-Aware Fault Localization）与定向差异模糊测试（Direc
SWIFT: Super-fast and Robust Privacy-Preserving Machine Learning.
本文提出 SWIFT，一个面向安全外包计算（SOC）范式的鲁棒隐私保护机器学习（PPML）框架。在 SOC 中，计算被外包给一组功能强大的服务器，按使用付费提供服务。现有 PPML 框架通常仅提供公平性（fairness），即恶意方可以阻止
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Chromium: CVE-2026-84359 Information leak in Skia
CVE-2026-84359
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-84358 Improper privilege management in Downloads
CVE-2026-84358
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-84357 Improper input validation in Omnibox
CVE-2026-84357
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
Chromium: CVE-2026-84356 UI misrepresentation in FullScreen
CVE-2026-84356
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.