Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the...
CVE-2026-101090
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard
2026-09-28 归档
今日共收录 884 条安全情报，包含 147 个 CVE，402 篇安全通告，以及 73 篇研究论文。
← 返回归档列表Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026 年 9 月 28 日通过官方博客发布题为《CrowdStrike Announces Continuous Identity for AI Agents》的公告，宣布推出一项面向 AI Agent（AI
(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange
CVE-2026-93304
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has
Citrix confirms two NetScaler RCE zero-days exploited in attacks
CVE-2026-88771 · CVE-2026-88772
Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CV
Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint
CVE-2026-101056
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.
Cloudreve before 4.16.1 Path Traversal via Remote Download
CVE-2026-101051
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated use
Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
CVE-2026-101048
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/
Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
CVE-2026-101047
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enter
Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
CVE-2026-101042
Parse Server is an open-source backend server. In versions >= 9.0.0 = 8.0.2 < 8.6.91, the code-based authentication adap
Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover
CVE-2026-101041
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
CVE-2026-100868
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION...
CVE-2026-101062
Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dyn
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its...
CVE-2026-93304
A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud
Sign Up for Free Cloud Tier
Sign Up for Free Cloud Tier
iOS 26.4.2 and iPadOS 26.4.2
iOS 26.4.2 and iPadOS 26.4.2