ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
CVE-2026-59178
## Summary The dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier
2026-09-16 归档
今日共收录 2620 条安全情报，包含 1789 个 CVE，446 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Chromium CVE-2026-87641: Race condition in Browser
CVE-2026-87641
微软 MSRC 于 2026-09-14 发布更新指南条目，对应 CVE-2026-87641，标题为「Chromium CVE-2026-87641: Race condition in Browser」。公告说明该 CVE 由 Chro
Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
日本数字厅（Digital Agency）披露一起数据泄露事件，可能暴露约24.6万条包含政府雇员个人信息的记录。事件源于VPN设备漏洞，攻击者疑似利用该漏洞访问了内部系统。数字厅在发现异常后展开调查，确认部分人员数据可能被未授权访问。目前
Ivanti Endpoint Manager Mobile代码注入漏洞
该条目来自知道创宇 Seebug 漏洞库，标题为“Ivanti Endpoint Manager Mobile 代码注入漏洞”，发布时间为 2026-09-16。Ivanti Endpoint Manager Mobile（EPMM，原 M
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
该条目来自知道创宇 Seebug 漏洞库（编号 ssvid-92331），标题为《TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)》，发布时间为 2026-09-16。从标题可以确认的
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Insufficient validation of inputs supplied through affected VeloCloud Edge management and...
CVE-2026-86108
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may al
The VeloCloud Edge software update workflow may accept update bundles without properly validating...
CVE-2026-86109
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures becau
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in...
CVE-2026-92256
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_s
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS...
CVE-2026-82567
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a conn
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in...
CVE-2026-76871
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH)...
CVE-2026-73444
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unau
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
CVE-2026-69216
## Summary Ember's chunk decoder parses the size token leniently: it strips leading and trailing whitespace and accepts
Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
CVE-2026-69205
## Summary Ember's HTTP/1.1 header parser matches the `Transfer-Encoding` header value with a case-sensitive substring
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
先知社区（阿里云安全社区）发布的一篇漏洞研究文章，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》，发布于 2026-09-16，关联编号为 CVE-2026-71486，标签为 xianzhi / res
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
CVE-2026-61568
`@zereight/mcp-gitlab` exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicio
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Chromium CVE-2026-87612: Type confusion in V8
CVE-2026-87612
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium CVE-2026-87625: Use after free in V8
CVE-2026-87625
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-85893
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.