IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain...
CVE-2026-78573
IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the
2026-09-11 归档
今日共收录 1356 条安全情报，包含 483 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
CVE-2026-88018
### Summary `rclone serve s3`'s handler chain, when `--auth-proxy` is configured, is (outermost first): `authPairMiddlew
Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
CVE-2026-20079
思科（Cisco）已确认其 Secure Firewall Management Center（FMC，安全管理中心）软件中存在一个最高严重级别的身份认证绕过漏洞，编号 CVE-2026-20079，且该漏洞已在真实攻击中被积极利用。FMC
Surfshark VPN says hackers breached internal testing, proxy servers
VPN 服务商 Surfshark 公开披露了一起内部服务器被入侵事件：由于一台内部测试服务器存在配置错误，被直接暴露在互联网上，攻击者借此取得了对该服务器的访问权限。据公开报道，受影响资产还包括代理（proxy）服务器。Surfshark
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
据 BleepingComputer 于 2026 年 9 月 10 日报道，Cisco Talos 披露：近期修补的两个 Cisco Secure Firewall Management Center（FMC）漏洞已被至少三个互不相同的威
Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends
CVE-2026-87017
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
CVE-2026-87014
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role sync
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause...
CVE-2026-80436
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
CVE-2026-88006
## Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the O
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
CVE-2026-88009
## Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form (for example `GET http
Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes
CVE-2026-87014
## Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every us
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
CVE-2026-87016
## Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match i
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain...
CVE-2026-82107
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause...
CVE-2026-82100
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create...
CVE-2026-80424
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Chromium: CVE-2026-85046 Type confusion in V8
CVE-2026-85046
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability.
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents