Svelte devalue: DoS via malformed input
CVE-2026-81176
### Impact `devalue.parse` prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can
2026-09-18 归档
今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CVE-2026-79752
### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd(
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
CVE-2026-76839
## Summary `system/config/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Com
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
CVE-2026-76846
## Summary `system/config/security.yaml`'s default `twig_sandbox.config_denied_paths` list (`plugins`, `streams`, `secu
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
CVE-2026-72698
## Summary `Grav\Common\Twig\Twig::init()` unconditionally puts the raw `system`, `site`, and `theme` config arrays int
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
CVE-2026-72701
## Summary `Grav\Common\Utils::verifyNonce()`, the core function Grav and its plugins use to validate CSRF nonces, comp
Cybersecurity in Power Grids: Standards and Research Challenges
这是一篇关于智能电网(Smart Grid)网络安全的综述性论文。作者的核心出发点是: 电力系统的安全不能简单套用传统 IT 安全范式, 因为电网同时包含 IT(信息技术)与 OT(运营技术)两套差异显著的环境——IT 侧关注机密性、通用协
京公网安备 11000002002063号
本条记录并非真实威胁情报内容，而是被错误归入情报管道的网页抓取残留数据。其标题为“京公网安备 11000002002063号”，这是中国大陆网站底部的公安联网备案登记编号；source_url 指向公安部“全国互联网安全管理服务平台”（be
（总）网出证（京）字第281号
本次输入的条目并非一篇真正的威胁情报文章，而是一条来自 360.cn 站点、内容为《（总）网出证（京）字第281号》的互联网出版/增值电信业务许可证公示信息（URL 为 https://www.360.cn/licence2.html）。该
京网文〔2020〕6051-1195号
该条目的来源为 360CERT 安全报告栏目下的一个链接，指向 https://www.360.cn/licence1.html，标题为“京网文〔2020〕6051-1195号”。从标题与 URL 判断，这是一份网络文化经营许可证（文网文）
京ICP证080047号[京ICP备08010314号-6]
本条情报记录的标题为「京ICP证080047号[京ICP备08010314号-6]」，来源标注为 360CERT 安全报告，但 source_url 指向的是工业和信息化部 ICP/IP 地址/域名信息备案管理系统（beian.miit.g
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Cloud ManagerManage your cloud computing services
Cloud ManagerManage your cloud computing services
See all Cloud Computing
See all Cloud Computing
智利银行在勒索软件攻击后关闭所有分行
智利银行在勒索软件攻击后关闭所有分行
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019
Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019
Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019
Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018
Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018
Threat Hunting & Intel
Threat Hunting & Intel
Endpoint Security & XDR
Endpoint Security & XDR