Chrome for Android Update
Hi, everyone! We've just released Chrome 153 (153.0.8010.47) for Android. It'll become available on Google Play over
2026-09-17 归档
今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Chrome Beta for Android Update
Hi everyone! We've just released Chrome Beta 155 (155.0.8059.4) for Android. It's now available on Google Play.You can s
Chrome for Android Update
Hello Everyone! We've just released Chrome 154 (154.0.8037.49) for Android to a small percentage of users. It'll become
Chrome Beta for iOS Update
Hi everyone! We've just released Chrome Beta 155 (155.0.8059.2) for iOS; it'll become available on App Store in the next
Firewall for AI
Firewall for AI
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Security researchers at Forever Security have shown that one ordinary browser extension could take control of the AI ass
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the...
CVE-2026-92576
HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an...
CVE-2026-89034
TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low En
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
CVE-2026-61453
## Summary The XSS blueprint validator (`Security::detectXss()`) runs on the **raw page content before Twig processing*
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
CVE-2026-61588
### Impact When a Django `Model` instance is assigned to a **public** view attribute, djust serialized it to the client
djust has an authorization bypass on the WebSocket/SSE mount path
CVE-2026-61594
### Impact The live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
CVE-2026-61592
### Impact SSE sessions were keyed solely by a **client-chosen** `session_id` with no binding to the authenticated user
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in...
CVE-2026-92811
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints,
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps,...
CVE-2026-92815
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attac
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on...
CVE-2026-92805
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in Conf
Nango through 0.70.4 fails to validate caller-supplied connection configuration values...
CVE-2026-92804
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into...
CVE-2026-92784
@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source co
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when...
CVE-2026-92794
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verif
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools...
CVE-2026-92795
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticate