vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When...
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `
2026-09-27 归档
今日共收录 1038 条安全情报，包含 222 个 CVE，481 篇安全通告，以及 74 篇研究论文。
← 返回归档列表A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function...
CVE-2026-100740
A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to...
CVE-2026-100739
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead...
CVE-2026-72668
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload...
CVE-2026-82901
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via...
CVE-2026-78582
Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configure
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable...
CVE-2026-85984
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass
Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data...
CVE-2026-100716
Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP...
CVE-2026-100715
Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl...
CVE-2026-100717
froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall...
CVE-2026-100706
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting:...
CVE-2026-100714
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings h
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist ...
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.2
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped...
CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media t
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the...
CVE-2026-100691
Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does no
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
CVE-2026-57443
### Summary The AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email
The Tokens Remember: When Tokenization Bypasses Knowledge Editing and Unlearning
该论文研究开放权重大模型时代的一个关键安全问题：模型编辑（model editing）与机器遗忘（machine unlearning）被广泛用于在不重新训练的前提下修改或删除模型中的特定知识，以支撑合规删除（如被遗忘权）和有害内容抑制。但
DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis via Static Graph and LLM Distillation
该论文针对 Node.js/NPM 生态中恶意包泛滥、软件供应链攻击频发的问题，提出了一套名为 DistillGuard 的轻量级恶意 NPM 包检测框架。作者指出，恶意代码主要在包安装、导入（import）和运行时三个阶段被触发，而现有防
Codetta: High-Capacity, Keyless, and Undetectable Multi-Agent Collusion
该论文研究的是基于大语言模型（LLM）的多智能体系统在高风险场景（金融、医疗、软件工程）中的隐蔽串通风险。由于智能体之间通过自然语言消息协调，这些通道同样可被用于泄露机密信息或协调未授权操作；而隐写术可以把这类通信隐藏成对审计者而言看似普通
Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution
该论文（cs.AI / cs.DC / cs.OS，作者 José Luis Pino）以一次被作者称为 Incident-2026-Alpha 的入侵事件为对象，给出第一性原理式的取证复盘与防御架构提案。论文叙述：2026 年 7 月，某