FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
CVE-2026-84301
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios
2026-09-23 归档
今日共收录 1513 条安全情报，包含 580 个 CVE，548 篇安全通告，以及 93 篇研究论文。
← 返回归档列表Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope
CVE-2026-77637
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") i
MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
CVE-2026-95671
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element cap
Ivanti Endpoint Manager Mobile代码注入漏洞
该条目来自知道创宇 / Seebug 漏洞库，标题为「Ivanti Endpoint Manager Mobile 代码注入漏洞」。Ivanti Endpoint Manager Mobile（EPMM，前身为 MobileIron Cor
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
CVE-2026-88978
# Cross-tenant disclosure risk on `DurableTask` bidi RPC This is a low-severity, low-risk cross-tenant data exposure vu
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
CVE-2026-84298
## Summary The V1 `DurableTask` stream handler registers worker-supplied durable task external IDs in an in-memory call
Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope
CVE-2026-77637
### Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
CVE-2026-86062
### Summary The LightRAG WebUI renders assistant/answer chat content as **raw HTML** — `react-markdown` is configured wi
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
CVE-2026-85740
## Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack d
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85734
### Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can
KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
CVE-2026-62370
## Summary KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
先知社区发布一篇针对 vLLM（主流大语言模型推理与在线服务框架）的技术分析文章，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》，讨论编号为 CVE-2026-71486 的安全问题。文章以 vLLM 对
D-Link warns of max severity zero-day bug in DIR-822A routers
CVE-2026-86296
D-Link 发布安全公告，警告其已停止支持的旧款 DIR-822A 双频 Wi-Fi 路由器存在一个最高严重等级（Max Severity）的零日漏洞，编号 CVE-2026-86296。该漏洞目前没有官方补丁，且公开的漏洞验证代码（Po
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to...
CVE-2026-16346
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands du
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
本文为 CrowdStrike 于 2026-09-23 发布的官方产品公告，标题为《CrowdStrike 为 AI Agent 推出 Continuous Identity（持续身份）》。从标题与厂商定位来看，该能力面向的是企业环境中快
SelfOp: An Optimization Algorithm for Self-Improving Security Agents
LLM 智能体正被用于漏洞发现、漏洞复现与补丁生成等安全任务，但在模型层面提升其能力通常依赖专家演示或可计算奖励，而安全任务恰恰很少具备这两点：执行轨迹昂贵、失败原因难以诊断、奖励稀疏且难以自动判定。因此研究重心转向执行框架（harness
Stable Channel Update for Desktop
CVE-2026-95291 · CVE-2026-95301 · CVE-2026-95281 · CVE-2026-95274 · CVE-2026-95329 · CVE-2026-95373 · CVE-2026-95313 · CVE-2026-95283 · CVE-2026-95277 · CVE-2026-95338 · CVE-2026-95350 · CVE-2026-95318 · CVE-2026-95298 · CVE-2026-95322 · CVE-2026-95284 · CVE-2026-95315 · CVE-2026-95293 · CVE-2026-95355 · CVE-2026-95356 · CVE-2026-95339 · CVE-2026-95357 · CVE-2026-95282 · CVE-2026-95286 · CVE-2026-95348 · CVE-2026-95335 · CVE-2026-95372 · CVE-2026-95324 · CVE-2026-95310 · CVE-2026-95349
The Chrome team is delighted to announce the promotion of Chrome 154 to the stable channel for Windows, Mac and Linux. T
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-85734
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/a