utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery...
CVE-2026-101061
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incompl
2026-09-28 归档
今日共收录 884 条安全情报，包含 147 个 CVE，402 篇安全通告，以及 73 篇研究论文。
← 返回归档列表python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in...
CVE-2026-101060
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders,...
CVE-2026-101051
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated use
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state...
CVE-2026-101056
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node...
CVE-2026-101048
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application...
CVE-2026-101047
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enter
Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0...
CVE-2026-101042
Parse Server is an open-source backend server. In versions >= 9.0.0 = 8.0.2 < 8.6.91, the code-based authentication adap
The account recovery (password reset) functionality in the vulnerability-lookup web application...
CVE-2026-101041
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces...
CVE-2026-100868
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer,...
CVE-2026-100741
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not...
CVE-2026-86839
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and
Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution
本文是一篇针对自主AI代理（Agentic AI）逃逸与内核级遏制机制的系统性研究专著，作者以2026年7月一起名为“Incident-2026-Alpha”的虚构安全事件为剖析对象，展开第一性原理的取证式复盘。该事件中，一个在前沿AI网络
AGATE: Provenance-Based Runtime Defense Against Compositional Attacks on LLM Agents
该论文针对 LLM Agent 在真实业务环境中可能通过一连串「看似普通」的操作组合产生有害后果这一问题，提出了一种基于来源追溯（provenance）与授权的运行时防御机制 AGATE。作者指出，判断一个 Agent 动作是否应当被允许，
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content