Malware bypasses browser checks to force install Chrome, Edge extensions
BleepingComputer 于 2026 年 9 月 16 日报道了一起自 2025 年年中以来持续活跃的银行木马攻击活动。该活动使用一套名为 KREMLIN 的工具包，其核心能力是绕过浏览器自身的扩展安装校验机制，在受害者的 Chr
2026-09-17 归档
今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
根据知道创宇/Seebug 收录的标题，Ivanti Endpoint Manager Mobile 存在代码注入漏洞。输入未提供受影响组件的具体用途、受影响版本、漏洞成因、触发方式及利用条件。代码注入类漏洞通常指应用程序未对用户输入进行充
TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)
Seebug 漏洞平台收录了一个标题为“TOPSEC Firewalls - Remote Exploit (ELIGIBLEBACHELOR)”的漏洞条目。TOPSEC（天融信）是中国知名的网络安全厂商，其防火墙产品广泛部署于企业网络边界
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
本条情报来自 Seebug 漏洞库（条目 ssvid-92335），标题为「Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)」，指向 Fortinet FortiG
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
先知社区（阿里云安全社区）于 2026-09-17 发布一篇以 CVE-2026-71486 为主题的研究文章，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》。vLLM 是当前主流的开源大模型推理与服务框
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity,...
CVE-2026-92787
Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypas
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated,...
CVE-2026-76460
A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to byp
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
CVE-2026-61568
`@zereight/mcp-gitlab` exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicio
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
本条情报来自 CrowdStrike 官方博客，标题为《CrowdStrike Announces Continuous Identity for AI Agents》，发布时间为 2026-09-17。需要首先说明：本次抓取到的正文摘要为
Stable Channel Update for Desktop
CVE-2026-91744 · CVE-2026-91710 · CVE-2026-91712 · CVE-2026-91745 · CVE-2026-91708 · CVE-2026-91724 · CVE-2026-91747 · CVE-2026-91721 · CVE-2026-91731 · CVE-2026-91717 · CVE-2026-91736 · CVE-2026-91740 · CVE-2026-91711 · CVE-2026-91733 · CVE-2026-91743 · CVE-2026-91741 · CVE-2026-91729 · CVE-2026-91748 · CVE-2026-91746 · CVE-2026-91728 · CVE-2026-91718 · CVE-2026-91726 · CVE-2026-91709 · CVE-2026-91715 · CVE-2026-91720 · CVE-2026-91716 · CVE-2026-91734 · CVE-2026-91727 · CVE-2026-91749 · CVE-2026-91737 · CVE-2026-91735
The Stable channel has been updated to 153.0.8010.47/.48 for Windows and Mac and 153.0.8010.47 for Linux, which will rol
nvmet-tcp: reject unsolicited H2CData PDUs
CVE-2026-89968
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmet_t
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
CVE-2026-89964
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invali
iio: dac: m62332: Fix regulator reference count imbalance
CVE-2026-89936
In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imb
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
CVE-2026-89863
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX S
vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption
CVE-2026-92220
A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_
`tts-be` application has a Broken Access Control vulnerability
CVE-2026-88065
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command e...
CVE-2026-86106
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions with
A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with ...
CVE-2026-76675
A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploi
Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to exe...
CVE-2026-76674
Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways t