Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
2026-10-06 归档
今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Huawei Secoway USG firewall weak password
Huawei Secoway USG firewall weak password
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
CVE-2026-105754
## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
CVE-2026-104852
Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hiv
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
OpenClaw: Channel read actions could skip target allowlists
### Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft
Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass
CVE-2026-105641
Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/comm
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
CVE-2026-71486
从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）
Citrix patches NetScaler SAML zero-day exploited in attacks
CVE-2026-88779
Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation
CVE-2026-88779
Categories: Threat ResearchTags: advisory, vulnerability, Citrix
Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)
CVE-2026-105640
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth an
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
CVE-2026-105636
Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/web
Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU
CVE-2026-104977
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an
Cache poisoning via unvalidated image layer DiffIDs
CVE-2026-93318
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versio
Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint
CVE-2026-104967
Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/
Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)
CVE-2026-104955
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request
linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication
CVE-2026-105237
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin
Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY...
CVE-2026-105641
Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/comm
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS