Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of...
CVE-2026-100707
Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources
2026-09-27 归档
今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。
← 返回归档列表Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address...
CVE-2026-100699
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser)
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy...
CVE-2026-100703
Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free...
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex patter
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such...
CVE-2026-100702
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, all
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the...
CVE-2026-100704
Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyvern
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the...
CVE-2026-100693
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-litera
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port()...
CVE-2026-100698
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/f
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink...
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopp
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js...
CVE-2026-100690
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.j
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules...
CVE-2026-100689
GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodu
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF)...
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the option
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers...
CVE-2026-100697
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID()...
CVE-2026-100695
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpol
CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
CVE-2026-100368
### Impact An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the `CliInv
CliInvoke: Argument Injection in Extensibility Runner Factory
CVE-2026-100369
### Impact An argument-injection vulnerability exists in the `CliInvoke` package's runner factory: `RunnerProcessFactory
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
CVE-2026-86439
## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memo
Containerd has image-pull DoS via crafted OCI index graph amplification
CVE-2026-53493
### Impact A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply
Safety-Aware Zero Trust Enforcement for IoT and Cyber-Physical Systems
该论文关注零信任（Zero Trust, ZT）架构在物联网（IoT）与信息物理系统（CPS）中落地时被忽视的一个关键矛盾：ZT 用显式、持续、上下文感知的授权取代基于边界的隐式信任，这对异构、生命周期长、远程连接的 IoT/CPS 组件尤
（总）网出证（京）字第281号
本条“情报”并非威胁情报内容，而是 360 官网（www.360.cn）上的互联网信息服务经营许可证公示页面，编号为“（总）网出证（京）字第281号”，发布于 2026-09-27。页面本身仅用于声明该网站已按照中国相关法规取得 ICP 经