AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
CVE-2026-63405
### Summary The Pusher-compatible REST API includes `body_md5` in the HMAC signature string but never computes or verifi
2026-09-19 归档
今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
CVE-2026-61833
### Summary A bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot re
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
CVE-2026-61672
## Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on thei
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
CVE-2026-61794
### Summary A validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `F
Echo: Learning-based Matching Decompilation using Trusted Back Translation
神经反编译器（neural decompiler）能从二进制中恢复可读、甚至可重新编译的源代码，但其输出缺乏可验证的正确性保证，安全分析人员难以判断恢复结果是否忠实于原始逻辑。匹配式反编译（matching decompilation）正是
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and i...
CVE-2026-89081
CVE-2026-89081 是 WordPress 插件 Tutor LMS – eLearning and online course solution 中的一处反射型跨站脚本（Reflected XSS）漏洞，影响 4.0.8 及之前
The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization ...
CVE-2026-87909
该漏洞影响 WordPress 的 WP Photo Album Plus 插件（所有版本）。漏洞位于插件的 wppa_image_magick 函数：该函数在调用 ImageMagick 处理图片时，会把经由 multipart 上传得到
The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oaut...
CVE-2026-15660
WordPress 的 SEO Booster 插件在 7.4.7 及之前所有版本中存在缺失授权（Missing Authorization）漏洞。问题根因在于 handle_oauth_callback() 函数：该函数被挂载到 admi
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to ...
CVE-2026-13354
WordPress 的 Asset CleanUp: Page Speed Booster 插件（用于优化页面加载速度）被披露存在存储型跨站脚本（Stored XSS）漏洞，影响所有版本直至 1.4.0.5。该漏洞源于插件对评论内容处理时，
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficien...
CVE-2026-77820
CVE-2026-77820 是 WordPress 生态中 WPComplete 插件（仅 Pro/付费版本受影响）的一个存储型跨站脚本（Stored XSS）漏洞，影响 2.9.9.0 及之前的所有版本。漏洞根因位于该插件对短代码（sh
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted n...
CVE-2026-93923
CVE-2026-93923 是 SiYuan(思源笔记)中一个存储型跨站脚本(XSS)漏洞,影响 3.8.4 及之前的所有版本。问题根因在于渲染层对 HTML 的转义处理不完整:当应用把笔记中的标题(heading)渲染进「大纲(outl
京公网安备 11000002002063号
本条记录标题为『京公网安备 11000002002063号』，正文摘要为空，来源标注为「360CERT 安全报告」，所给链接指向公安联网备案系统的备案信息查询页面（beian.gov.cn），对应的是某北京地区网站的公安备案编号，而非任何安
京ICP证080047号[京ICP备08010314号-6]
本次输入未包含任何可分析的威胁情报正文内容，无法形成对具体攻击活动的技术描述。输入中提供的信息仅有：标题为“京ICP证080047号[京ICP备08010314号-6]”，该字符串实际上是工信部 ICP 备案编号，并非文章标题；来源标记为“
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019
Cloud ManagerManage your cloud computing services
Cloud ManagerManage your cloud computing services
See all Cloud Computing
See all Cloud Computing
智利银行在勒索软件攻击后关闭所有分行
智利银行在勒索软件攻击后关闭所有分行
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019
Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019
Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO]Jan 22, 2019
Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018
Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]Aug 20, 2018