Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state
CVE-2026-104855
### Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as `memory.copy`, contains a
2026-10-04 归档
今日共收录 931 条安全情报，包含 128 个 CVE，457 篇安全通告，以及 95 篇研究论文。
← 返回归档列表aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
CVE-2026-18140
### Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smith
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
CVE-2026-96780
### Impact A denial-of-service (infinite loop) can occur in `text()` / `textSync()` when **both**: - `whitespaceBreak: t
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
CVE-2026-77387
### Impact `geopy.Point` and `Point.from_string()` may take excessive CPU time when parsing long, malformed coordinate
Aletheia: Permission-Minimality Testing for Coding-Agent Rules
该论文关注编码智能体（coding agent）所依赖的「仓库指令文件」（如 AGENTS.md、copilot-instructions 一类指导性规则）带来的安全风险：这些文件本意是引导智能体正确完成开发任务，但也构成一条 prompt
The Achilles' Heel of Partial Reconfiguration: Optical Side-Channel Leakage on the 7-Series ICAP
FPGA 厂商普遍在比特流中引入加密以保护敏感的配置数据,但主流器件中一些保护方案是硬连线、不可修补的,已被多项研究绕过或完全攻破,因此业界转向可升级、可修补的加密方案。本文针对 7 系列 FPGA,首先实现了 AMD 提出的一种用于比特流
京公网安备 11000002002063号
本次输入并非一篇威胁情报文章，而是一条来自 beian.gov.cn（全国互联网安全管理服务平台）的网站备案信息页面记录。标题为“京公网安备 11000002002063号”，其中 11000002002063 是北京市公安机关核发的网站备
（总）网出证（京）字第281号
本条目标题为“（总）网出证（京）字第281号”，是360公司的一项ICP备案许可证编号，来源标注为“360CERT安全报告”，但提供的URL（https://www.360.cn/licence2.html）实际指向360的许可证页面，并非
京网文〔2020〕6051-1195号
本文分析的对象是标题为“京网文〔2020〕6051-1195号”的网页，来源为360CERT安全报告，链接指向 https://www.360.cn/licence1.html。该编号是北京市网络文化经营许可证的批准文号，通常用于公示企业从
京ICP证080047号[京ICP备08010314号-6]
本次输入未包含任何可供分析的情报正文，属于典型的“空壳条目”。条目标题为“京ICP证080047号[京ICP备08010314号-6]”，实际是工信部ICP备案编号，而非文章标题；来源被标注为“360CERT 安全报告”，但 source_
A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket ...
CVE-2026-105099
该漏洞披露自 NVD,影响 Omega Solution 出品的 CoinEx Crypto 2025 产品。问题位于 /user/ticket 路径所对应的工单(Ticket)功能中的“工单附件上传”(Ticket Attachment
A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The m...
CVE-2026-105098
该漏洞影响 Omega Solution 公司的 CoinEx Crypto 2025 产品。问题出在“支持工单 API”（Support Ticket API）组件中 /ticket/customer 这一接口的未知功能函数上：当攻击者对
A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. ...
CVE-2026-105097
CVE-2026-105097 是一枚被分配在 Omega Solution 旗下产品 CoinEx Crypto 2025 中的授权绕过（Authorization Bypass）漏洞。根据 NVD 描述，问题位于组件 Customer
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a m...
CVE-2026-105096
CVE-2026-105096 是 NVD 收录的一则授权绕过漏洞，影响 Omega Solution 开发的 CoinEx Crypto 2025 产品。漏洞位于该产品 Customer Profile API（客户资料接口）的 /cus
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemp...
CVE-2026-105128
CVE-2026-105128 是 LaraDashboard 1.4.8 之前版本中存在的一个开放重定向（Open Redirect）漏洞。该项目的邮件模板管理功能由 EmailTemplateController 实现，其中 build
LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI ve...
CVE-2026-105127
CVE-2026-105127 涉及 LaraDashboard 在 1.4.2 至 1.4.8 之前的版本中存在的资源耗尽与安全校验失效问题。该产品在面向未认证用户的「忘记密码」和「重置密码」流程中，默认启用了较为严格的高级邮箱地址验证逻
W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and...
CVE-2026-105124
该漏洞影响 vincent-peugnet/wcms 项目（通常简称为 W）3.18.0 及之前的所有版本，属于存储型跨站脚本（Stored XSS）类型。漏洞的根本成因是应用在多个位置将用户可控输入写入页面时未进行充分的输出编码/转义处理
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member:...
CVE-2026-96451
CVE-2026-96451 是 WordPress 生态中广泛使用的会员/用户资料插件 Ultimate Member (ultimate-member) 的一个授权绕过漏洞，缺陷类型为 CWE-639「通过用户可控键实现授权绕过 (Au
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, ...
CVE-2026-103342
WordPress 插件 Unlimited Elements For Elementor（Free Widgets, Addons, Templates）存在反射型跨站脚本（Reflected XSS）漏洞，编号 CVE-2026-103
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resour...
CVE-2026-105122
CVE-2026-105122 是 OpenAM（ForgeRock 系身份与访问管理平台）16.1.3 之前版本中存在的一个服务端请求伪造（SSRF）漏洞。其根因在于 OpenAM 在处理 OAuth 2.0 / OpenID Conne