HID: magicmouse: do not keep a stale msc->input if no input is claimed
CVE-2026-80782
HID: magicmouse: do not keep a stale msc->input if no input is claimed
2026-09-08 归档
今日共收录 1006 条安全情报，包含 268 个 CVE，456 篇安全通告，以及 21 篇研究论文。
← 返回归档列表nfc: llcp: bound the connect_sn TLV walk to the skb
CVE-2026-80800
nfc: llcp: bound the connect_sn TLV walk to the skb
HID: nintendo: stop device IO before hid_hw_stop on probe failure
CVE-2026-80770
HID: nintendo: stop device IO before hid_hw_stop on probe failure
tcp: clamp route advmss to TCP_MIN_MSS
CVE-2026-80847
tcp: clamp route advmss to TCP_MIN_MSS
nvmet-fc: fix invalid free in LS IOD error path
CVE-2026-80790
nvmet-fc: fix invalid free in LS IOD error path
Bluetooth: hci_event: fix LE list UAF on reset
CVE-2026-80764
Bluetooth: hci_event: fix LE list UAF on reset
crypto: sun8i-ss - Remove crypto_rng interface
CVE-2026-80833
crypto: sun8i-ss - Remove crypto_rng interface
crypto: qce - fix CCM AAD buffer underallocation
CVE-2026-80832
crypto: qce - fix CCM AAD buffer underallocation
xfrm: espintcp: fix UAF during close
CVE-2026-80848
xfrm: espintcp: fix UAF during close
nfc: st21nfca: validate ATR_REQ length against the received frame
CVE-2026-80823
nfc: st21nfca: validate ATR_REQ length against the received frame
erofs: cap LZMA stream pool size
CVE-2026-80892
erofs: cap LZMA stream pool size
crypto: virtio - bound the akcipher result length
CVE-2026-80836
crypto: virtio - bound the akcipher result length
HID: sensor: custom: Fix use-after-free in enable_sensor
CVE-2026-80767
HID: sensor: custom: Fix use-after-free in enable_sensor
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
CVE-2026-85393
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding
xmldom: Quadratic-memory consumption
CVE-2026-83615
xmldom: Quadratic-memory consumption
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
CVE-2026-83614
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()`
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
CVE-2026-83616
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83605
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
xmldom: DocType `name` Injection Bypasses requireWellFormed
CVE-2026-83608
xmldom: DocType `name` Injection Bypasses requireWellFormed
Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting
本文研究HTTP/2协议在网页指纹（Website Fingerprinting, WF）攻击下的隐私保护潜力。网页指纹攻击能够仅从加密的HTTPS流量中推断用户访问的网页，从而在不解密的情况下泄露用户隐私。现有WF防御手段通常通过噪声、填