Apache Roller: OAuth authorization endpoint trusts request-supplied identity
CVE-2026-82378
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote
2026-09-29 归档
今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
知道创宇 / Seebug 漏洞库于 2026-09-29 收录条目「Ivanti Endpoint Manager Mobile 代码注入漏洞」，将目标组件标记为 Ivanti Endpoint Manager Mobile（EPMM，原
Huawei Secoway USG firewall weak password
该条目来自知道创宇/Seebug漏洞库，标题为“Huawei Secoway USG firewall weak password”，于2026-09-28发布。华为Secoway USG系列是企业级防火墙/统一安全网关，通常部署在网络边界
A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this...
CVE-2026-101859
A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escap
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
先知社区（阿里云安全社区）于 2026 年 9 月 29 日发布一篇技术研究文章，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》，围绕开源大模型推理与服务框架 vLLM 中编号为 CVE-2026-714
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
CVE-2026-88771 · CVE-2026-88772
Unit 42 于 2026-09-28 发布威胁简报，援引 Citrix 的通报称，NetScaler 产品线存在两个安全漏洞 CVE-2026-88771 与 CVE-2026-88772，且已在真实攻击中被利用（exploited i
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
本文是 CrowdStrike 发布的产品能力公告，主题为面向 AI Agent（AI 智能体）的「持续身份」（Continuous Identity for AI Agents）。核心背景是：随着企业大规模部署自主或半自主的 AI Age
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
### Summary Nodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-
COGNIT-Guard: Calibrated Standalone Direct-Decision Guardrails with Heterogeneous CPU-NPU Confidence Cascading under Explicit Latency and False-Positive Constraints
该论文研究的是"预摄取（pre-ingestion）阶段"的实时安全护栏问题：在目标大模型开始 prefill 之前就要完成提示词筛查，并同时满足三个约束——概率输出必须经过校准、必须把合规类"两用"查询的误报压到极低、以及要在明确的延迟
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
CVE-2026-55156
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge gra
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
CVE-2026-55157
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge gra
Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration
CVE-2026-101062
Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dyn
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
CVE-2026-97493
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation
CVE-2026-88771 · CVE-2026-88772
Categories: Threat ResearchTags: advisory, vulnerability, Citrix
Axios: Prototype Pollution Gadget in axios toFormData Options
CVE-2026-101909
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFo
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
CVE-2026-101908
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
CVE-2026-101907
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses t
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
CVE-2026-101906
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy appl
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
CVE-2026-101905
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib