OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
CVE-2026-77394
## Summary A user who can save a telemetry **screen** (permission `system_set`) can embed JavaScript in a screen `BUTTON
2026-09-24 归档
今日共收录 1600 条安全情报，包含 683 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
CVE-2026-82407
**Location:** `core/kapp/validators/validators.go:201` (`Register`), (`genesis/checking/nodesSetupChecker.go:73`). `core
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
CVE-2026-77602
### Summary COSMOS reads configuration from a user-writable overlay (`targets_modified/`) before the read-only plugin-i
A Bulletproof Business? Towards Detecting Infrastructure-as-a-Service Offerings on Telegram
该论文聚焦网络犯罪支撑体系中的「基础设施即服务」(IaaS) 生态, 即犯罪分子租用托管、代理、VPN 等可复用数字基础设施的模式。这类服务通常经由网络犯罪即服务 (CaaS) 市场交易, 并在 Telegram 等即时通讯平台上公开投放广
Rouxii: Exploiting Honeypots with Deception-Aware AI Pentesters
该论文研究的是一个常被忽视的对抗设定: 当自主渗透测试 AI 明确知道自己可能面对蜜罐时，蜜罐的欺骗效果还能剩下多少。此前的研究确实表明，蜜罐不仅能欺骗人类攻击者，也能让基于 LLM 的自主渗透测试智能体走偏、失效；但这些评估基本都默认攻击
SR-Fraud: An Outcome-Supervised Reflective LLM Agent Framework for Non-Stationary Payment Fraud Detection
该论文针对实时支付欺诈检测中的非平稳流式预测问题提出 SR-Fraud 框架。问题的核心在于：欺诈对手的战术会先于监督标签成熟而演化，局部化的爆发式攻击在周期性重训练之间就能造成实际资金损失；而生产环境普遍采用的表格分类器与人工规则，往往难
C-to-Rust Fallacy: Automatic Refactoring != Memory Security
该论文针对当前自动将 C 代码重构为 Rust 的工具开展了系统性实证研究。研究背景是 Rust 凭借内存与类型安全保证成为系统编程的热门语言，但人工把 C 迁移到 Rust 需要深入的领域知识与大量投入；因此业界出现了基于静态分析与大语言
Decoding the Legalese: A Scalable and Quantitative Framework for Analyzing Corporate Privacy Policies
隐私政策是各类组织披露其如何收集、处理与共享个人数据的主要机制，但由于篇幅冗长、法律措辞密集，普通用户往往难以解读，且这种晦涩可能是有意为之。更关键的问题在于：除了满足监管合规要求之外，业界一直缺乏能够刻画隐私政策关键属性的标准化度量。近年
Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model
该论文提出并评估了一套面向教育信息系统（实验室范围）的“告警后事件编排与响应子系统”，核心目标是在引入本地大语言模型（LLM）辅助分析的同时，保持流程的可控性、可追溯性与可恢复性，避免模型直接触发应急处置动作。架构上明确划分为四个相互解耦的
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced ...
CVE-2026-18467
CVE-2026-18467 是 WordPress 插件 Paytium: Mollie payment forms & donations 中的权限提升漏洞，影响 5.0.3 及之前的所有版本。该插件用于在站点上搭建 Mollie 支付
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud