GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1
CVE-2026-90970
GitLab 于 2026 年 10 月 2 日发布 GitLab AI Gateway 的补丁版本 19.2.4、19.3.2 和 19.4.1，修复一个被评定为 Critical 的安全缺陷，编号 CVE-2026-90970，CVSS
2026-10-03 归档
今日共收录 1361 条安全情报，包含 499 个 CVE，489 篇安全通告，以及 100 篇研究论文。
← 返回归档列表CVE-2026-0250 GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (Severity: MEDIUM)
CVE-2026-0250
Palo Alto Networks 于 2026-10-02 发布安全公告，披露其 GlobalProtect App 中存在一个缓冲区溢出漏洞，编号 CVE-2026-0250，厂商在标题中自评严重级别为 MEDIUM（中危）。Glob
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persi
Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
CVE-2026-90970
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 1
CVE-2026-104480
CVE-2026-104480
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecogn
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
Fortigate Firewalls - Remote Code Execution (EGREGIOUSBLUNDER)
The web management service in affected RouterOS versions contains an integer underflow in its...
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
CVE-2026-71416
### Summary The Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests be
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
CVE-2026-74802
**High** ## Package gomod `github.com/siyuan-note/siyuan/kernel` ## Affected versions 3.7.3 ## Patched versions *(non
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
本文是先知社区（xz.aliyun.com）发布的一篇研究性质文章，标题为《从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）》，发布时间为 2026-10-03，标签为 research / community /
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks
CVE-2026-104286
Fortinet 向客户发布安全警告，披露其邮件安全网关产品 FortiMail 中存在一个严重级别漏洞，编号 CVE-2026-104286，且该漏洞已被用于零日攻击。据厂商说明，攻击者可利用该漏洞在受影响设备上执行未授权的代码或命令，意
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
CVE-2026-10032
### Summary The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.open()` witho
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an...
CVE-2023-54405
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitr
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-96940
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike 于 2026-10-03 发布博客，宣布推出面向 AI 智能体（AI Agents）的「Continuous Identity（持续身份）」能力。该文属于厂商产品与能力发布公告，并非针对某起具体攻击活动、漏洞或勒索事
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
### Summary: 5 findings — `BashTool` shell-injection sink (F6, the canonical RCE primitive), `BackgroundRunTool` async
Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks
CVE-2026-104420
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scorin
Missing authentication for critical function in Loom for AWS
CVE-2026-103956
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remot