ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
CVE-2026-35273
据 BleepingComputer 报道，勒索与数据勒索团伙 ShinyHunters 正在针对 Oracle PeopleSoft 部署发起新一轮攻击，其关键手法是利用 URL 编码（URL-encoding）变体绕过 Web 应用防火
2026-09-27 归档
今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。
← 返回归档列表Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
CVE-2026-100701
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each c
Netty 4.2.2 through 4.2.15 HTTP/1 Host Header Authority Confusion
CVE-2026-100664
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority
Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
CVE-2026-100663
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CON
SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header
CVE-2026-100646
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authen
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per...
CVE-2026-100837
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to...
CVE-2025-71425
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contr
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the...
CVE-2026-100701
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each c
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
本文来源为先知社区，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》，发布时间为 2026-09-27。文章聚焦开源大模型推理与服务框架 vLLM 中一个被分配了 CVE 编号（CVE-2026-71486
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 9 月 27 日通过官方博客发布产品公告，宣布推出 "Continuous Identity for AI Agents"（面向 AI 代理的持续身份）能力，将其 Falcon 平台的身份保护范围从
stoatchat before 0.15.5 Denial of Service via mass mentions
CVE-2026-100675
stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes
Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
CVE-2026-100660
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPA
SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie
CVE-2026-100635
SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are is
SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
CVE-2026-100633
SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensi
Kyverno before 1.19.1 SSRF via legacy apiCall service executor
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.2
Hugo before 0.166.0 Cross-Site Scripting via text/org
CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media t
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
CVE-2026-100691
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does no