OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
CVE-2026-102806
OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist t
2026-09-30 归档
今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile（前身为 MobileIron）是一款企业级移动设备管理（MDM）与统一端点管理（UEM）平台，用于集中管理移动终端、推送策略、分发应用及保障企业数据安全。本次公告标题指出该产品存
Pexip Infinity before 41.0 is affected by improper input validation in the signaling...
CVE-2026-103102
Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remot
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a...
CVE-2026-86101
An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SA
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration...
CVE-2026-86131
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attack
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler...
CVE-2026-103040
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with -
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
该条情报来自先知社区（阿里云开发者社区安全板块）的一篇漏洞研究文章，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》，发布时间为 2026-09-30，附带标签为 research / community。
Hackers exploit Citrix NetScaler zero-day to deploy web shells
CVE-2026-88772
据 BleepingComputer 于 2026 年 9 月 29 日报道，多家网络安全厂商称，攻击者利用 Citrix NetScaler（ADC／安全网关产品线）中的一个零日漏洞 CVE-2026-88772 发动攻击。攻击者在成功利
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
本条情报来自 CrowdStrike 官方博客，标题为《CrowdStrike Announces Continuous Identity for AI Agents》，发布于 2026-09-30，来源标签包含 edr、crowdstri
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
CVE-2026-102824
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh
CVE-2026-102714
CVE-2026-102714
`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.
CVE-2026-102713
CVE-2026-102713
The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tf
DTLS Retransmits Handshake Messages From a Stale Buffer Offset
CVE-2026-84782
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-
Long Term Support Channel Update for ChromeOS
CVE-2026-84349 · CVE-2026-87647 · CVE-2026-95313 · CVE-2026-91716 · CVE-2026-84357 · CVE-2026-87480 · CVE-2026-79088 · CVE-2026-19175 · CVE-2026-91736 · CVE-2026-87514 · CVE-2026-79187 · CVE-2026-91737 · CVE-2026-87581 · CVE-2026-87474 · CVE-2026-87558 · CVE-2026-85043 · CVE-2026-84324
A new LTS version 144.0.7559.264 (Platform Version: 16503.97.0), is being rolled out for most ChromeOS devices. This ve
Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS
CVE-2026-75806
Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthentica
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
CVE-2026-97687
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, pro
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenti...
CVE-2026-103040
LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with -
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO b...
CVE-2026-79538
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpo
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS