Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
CVE-2026-85102
BleepingComputer 报道，Check Point 已确认其 Security Gateway 产品存在一个预认证远程代码执行（RCE）漏洞，编号为 CVE-2026-85102，并且已发现攻击者在真实环境中对该漏洞进行利用。该
2026-09-24 归档
今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Microsoft: September Windows updates break Always On VPN connections
BleepingComputer 报道，微软就 2026 年 9 月批次的 Windows 安全更新发出新的已知问题警告：该批补丁可能在部分 Windows 11 系统上破坏 Always On VPN（AOVPN）连接。Always On
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
CVE-2026-61695
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's S
NetworkManager-l2tp Privilege Escalation via pppd Username Injection
CVE-2026-75131
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local use
Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device
CVE-2026-96456
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects
Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint
CVE-2026-96455
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 9 月 24 日在其官方博客发布标题为《CrowdStrike Announces Continuous Identity for AI Agents》的公告。从标题、来源与厂商定位判断，这是一则产
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Yokogawa YFGW410 gateway
Yokogawa YFGW410 gateway
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
CVE-2026-82409
**Component:** Elasticsearch indexer (`indexer/`) **Primary location:** `indexer/common.go:2395-2407` (`serializedDataFo
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
CVE-2026-61695
### Summary Wire's Swift runtime (`Wire` SPM/CocoaPods product, implemented by `wire-runtime-swift`) did not reject a n
9router: Image prefetch DNS rebinding allows SSRF to internal services
CVE-2026-56676
## Summary 9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
CVE-2026-56675
## Summary 9router treats local loopback requests as trusted and allows access to `/v1/*` without an API key. In a docu
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session ...
CVE-2026-85724
moquette is reachable by untrusted MQTT clients (anonymous by default), so every byte from any client, including pre-aut
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation
该论文聚焦于 JavaScript 引擎的安全测试难题。现代 Web 安全高度依赖 JS 引擎的正确性，而引擎本身结构复杂、长期存在高危缺陷。当前最先进的模糊测试器（fuzzer）面临一个关键瓶颈——覆盖度平台期（coverage plat
Stable Channel Update for Desktop
CVE-2026-95335 · CVE-2026-95372 · CVE-2026-95282 · CVE-2026-95373 · CVE-2026-95324 · CVE-2026-95283 · CVE-2026-95338 · CVE-2026-95310 · CVE-2026-95349 · CVE-2026-95350 · CVE-2026-95318 · CVE-2026-95348 · CVE-2026-95277 · CVE-2026-95298 · CVE-2026-95329 · CVE-2026-95286 · CVE-2026-95357 · CVE-2026-95322 · CVE-2026-95313 · CVE-2026-95355 · CVE-2026-95356 · CVE-2026-95339 · CVE-2026-95281 · CVE-2026-95274 · CVE-2026-95315 · CVE-2026-95293 · CVE-2026-95301 · CVE-2026-95291 · CVE-2026-95284
The Chrome team is delighted to announce the promotion of Chrome 154 to the stable channel for Windows, Mac and Linux. T
md/raid1,raid10: fix bio accounting for split md cloned bios
CVE-2026-74373
md/raid1,raid10: fix bio accounting for split md cloned bios
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）