Ivanti Endpoint Manager Mobile代码注入漏洞
根据知道创宇/Seebug 漏洞平台发布的信息，Ivanti Endpoint Manager Mobile（企业移动设备管理产品）被披露存在代码注入漏洞。该漏洞类型为代码注入，攻击者可能通过构造恶意输入在目标设备上执行任意代码或注入恶意逻
2026-09-08 归档
今日共收录 1006 条安全情报，包含 268 个 CVE，456 篇安全通告，以及 21 篇研究论文。
← 返回归档列表Huawei Secoway USG firewall weak password
华为Secoway USG是华为面向企业及运营商推出的统一安全网关/防火墙产品，主要部署于网络边界，用于访问控制、入侵防御、VPN等安全防护。该安全公告指出设备存在弱口令问题，即管理接口可能使用默认口令或强度不足的口令。攻击者在能访问管理接
Yokogawa YFGW410 gateway
根据知道创宇/Seebug漏洞数据库收录的信息，披露了横河电机（Yokogawa）YFGW410网关相关的一条安全公告。YFGW410通常用于工业无线网络中的网关设备，属于工业控制系统（ICS）基础设施。本次公告并未提供具体漏洞成因、技术细
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
根据知道创宇/Seebug 漏洞库的收录信息，Citrix NetScaler 存在一个被标识为 CVE-2025-5777 的内存泄漏漏洞。内存泄漏属于软件资源管理缺陷，通常指程序在分配内存后未能及时释放，导致可用内存逐渐减少。对于 Ne
Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
CVE-2026-18726
Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 9 月 8 日发布了题为“CrowdStrike Announces Continuous Identity for AI Agents”的官方公告。该公告介绍了一项新功能或产品增强，旨在为 AI
The History Is the Detector: Executing CVE Patch History, End-to-End
本文提出 BUGSTONE-E2E，一种将漏洞历史（尤其是 CVE 修复提交）转化为可执行检测规则并自动化验证的端到端框架。当前公共漏洞数据库虽然记录了已知软件缺陷的类型、影响组件和补丁信息，但这些信息主要用于人工查阅，缺乏自动化复用机制，
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
多款Huawei路由器信息泄露漏洞
多款Huawei路由器信息泄露漏洞
MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects
CVE-2026-86451
Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool:
commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
CVE-2026-86431
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability i
MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs
CVE-2026-86440
Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The
MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users
CVE-2026-86418
Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the sa
MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events
CVE-2026-86408
Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKe
XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import
CVE-2026-78325
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allow
CVE-2026-85201
CVE-2026-85201
In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-
MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
CVE-2026-86351
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with
CVE-2026-84173
CVE-2026-84173
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates mul
MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information
CVE-2026-86342
Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview