IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a...
CVE-2026-75878
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated sessio
2026-09-19 归档
今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
CVE-2026-59163
### Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SH
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
CVE-2026-59163
Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_
SysReptor: Host header injection might allow account takeover
CVE-2026-81179
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset
Kyoo: OIDC login token can be redirected to an attacker-controlled URL
CVE-2026-77386
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker cou
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
CVE-2026-58197
ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to Too
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
CVE-2026-81505
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID}
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
CVE-2026-77339
## Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener wh
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
先知社区于 2026-09-19 发布了一篇技术分析文章，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》。文章以 vLLM 这一开源大模型推理与服务框架为对象，通过某个“辅助 API”作为切入点，讨论该框
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
CVE-2026-61682
# Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-88097
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
Chromium CVE-2026-91749: Use after free
CVE-2026-91749
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium CVE-2026-91748: Race condition
CVE-2026-91748
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium CVE-2026-91747: Use after free
CVE-2026-91747
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium CVE-2026-91746: Integer overflow
CVE-2026-91746
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium CVE-2026-91745: Use after free
CVE-2026-91745
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P
Chromium CVE-2026-91744: Race condition
CVE-2026-91744
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. P