从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
2026-09-12 归档
今日共收录 1637 条安全情报，包含 801 个 CVE，449 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Check Point Patches Critical VPN Vulnerabilities
CVE-2026-85103 · CVE-2026-85102
Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws could be exploited for remote code execution. The post Check Poi
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute...
CVE-2026-89010
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command inject
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwri...
CVE-2026-89009
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file wr
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker...
CVE-2026-84390
A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, F
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality...
CVE-2026-80462
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain
IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.
CVE-2026-78573
IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description
CVE-2026-81911
Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_templ
In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating...
CVE-2026-89767
In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mism
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
CVE-2026-88008
## Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 `Upgrade` mec
Cross User/App Network Attacks - Hijacking TCP Connections and DNS Cache Poisoning via a Malicious User/App (Extended Version)
该论文挑战了一个长期存在的安全假设：由于 TCP 初始序列号（ISN）随机化与 UDP 源端口随机化等内建机制，针对 TCP 及 DNS（基于 UDP）客户端-服务器连接的"路径外"（off-path）攻击在现代网络中已被认为不切实际。作者
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certifi...
CVE-2026-90452
该漏洞影响反向代理与身份提供商（IdP）之间的通信流程。在进行令牌发现、令牌自省以及凭据交换时，反向代理未对身份提供商的服务器证书进行验证。这意味着，位于代理与身份提供商之间的网络路径上的攻击者，可以通过中间人攻击伪造身份提供商，并签发被部
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud
Sign Up for Free Cloud Tier
Sign Up for Free Cloud Tier
iOS 26.4.2 and iPadOS 26.4.2
iOS 26.4.2 and iPadOS 26.4.2
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.7 and iPadOS 18.7.7
iOS 18.7.7 and iPadOS 18.7.7