Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
CVE-2026-59163
### Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SH
2026-09-20 归档
今日共收录 942 条安全情报，包含 169 个 CVE，438 篇安全通告，以及 68 篇研究论文。
← 返回归档列表BragJack attacks hijack AI browser agents through malicious extensions
安全厂商 Forever Security 的研究员 Gal Weizman 公开了一个名为 BragJack 的概念验证（PoC）攻击，展示如何用「单个恶意浏览器扩展」同时劫持多款主流浏览器中内置的 AI 助手 / AI 代理。受影响目标
Ivanti Endpoint Manager Mobile代码注入漏洞
该条目来自知道创宇 Seebug 漏洞库，标题为“Ivanti Endpoint Manager Mobile 代码注入漏洞”。Ivanti Endpoint Manager Mobile（简称 EPMM，前身为 MobileIron Co
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open...
CVE-2026-7527
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all version
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper...
CVE-2026-9832
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptograph
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
本文是先知社区（阿里云开发者社区安全板块）于 2026-09-20 发布的一篇漏洞研究类文章，主题为 vLLM 的某个「辅助 API」在资源边界（resource boundary）设计上的缺陷，对应漏洞编号 CVE-2026-71486。
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
2026年9月20日，CrowdStrike 在其官方博客发布公告，推出面向 AI 智能体（AI Agent）的「持续身份」（Continuous Identity）能力。该输入属于厂商产品发布类信息，仅提供标题与来源链接，未附正文摘录、技
ACPI: processor: Unregister cpufreq notifier on init failure
CVE-2026-90364
ACPI: processor: Unregister cpufreq notifier on init failure
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO h...
CVE-2026-75878
IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated sessio
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and...
CVE-2026-18346
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud
Sign Up for Free Cloud Tier
Sign Up for Free Cloud Tier
iOS 26.4.2 and iPadOS 26.4.2
iOS 26.4.2 and iPadOS 26.4.2
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.7 and iPadOS 18.7.7
iOS 18.7.7 and iPadOS 18.7.7
iOS 26.4 and iPadOS 26.4
iOS 26.4 and iPadOS 26.4