安全日报 - 2026-10-06 - Cyber Security Daily Radar

安全公告2026-10-05 发布INFO

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

CVE-2026-105757

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-20 #cwe-248 #cwe-755 #severity:medium

安全公告2026-10-05 发布INFO

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

CVE-2026-105756

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-20 #cwe-248 #severity:medium

安全公告2026-10-05 发布INFO

uv: Path traversal on Windows through wheel extraction

CVE-2026-104843

### Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #rust #cwe-22 #severity:medium

安全公告2026-10-05 发布INFO

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

CVE-2026-102991

## Summary On Windows, a `TemplateLookup` URI beginning with a drive designator (e.g. `C:/../../secret.txt` or `C:\..\.

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #severity:medium

安全公告2026-10-05 发布INFO

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

CVE-2026-104845

# Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-770 #severity:high

安全公告2026-10-05 发布INFO

Nx daemon and plugin worker sockets are accessible to other local users

CVE-2026-104854

## Summary Nx creates the Unix domain sockets for its daemon and its plugin workers in a shared temporary directory wit

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-269 #cwe-732 #severity:high

安全公告2026-10-05 发布INFO

Nx: Path traversal in nx migrate package-migrations extraction

CVE-2026-104853

## Summary `nx migrate` reads each target package's `nx-migrations.migrations` value from its manifest and extracts the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-22 #cwe-73 #severity:medium

安全公告2026-10-05 发布INFO

compression vulnerable to Denial of Service via memory leak on premature response close

CVE-2026-87776

### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconne

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-401 #cwe-459 #severity:high

安全公告2026-10-05 发布INFO

pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods

CVE-2026-88029

### Impact When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-943 #severity:medium

安全公告2026-10-05 发布INFO

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

CVE-2026-88023

### Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Li

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #severity:medium

安全公告2026-10-05 发布INFO

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

CVE-2026-100722

## Summary An untrusted script run by `VM.run` can construct an embedder-exposed host function that returns a rejected

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-248 #cwe-703 #severity:high

威胁情报2026-10-06 发布INFO

京ICP证080047号[京ICP备08010314号-6]

历史摘要 · 未重新核验 · 360CERT 安全报告

#apt #malware #report #360

威胁情报2026-10-06 发布INFO

京网文〔2020〕6051-1195号

历史摘要 · 未重新核验 · 360CERT 安全报告

#apt #malware #report #360

威胁情报2026-10-06 发布INFO

（总）网出证（京）字第281号

历史摘要 · 未重新核验 · 360CERT 安全报告

#apt #malware #report #360

威胁情报2026-10-06 发布INFO

京公网安备 11000002002063号

历史摘要 · 未重新核验 · 360CERT 安全报告

#apt #malware #report #360

威胁情报2026-10-06 发布INFO

Video Highlights the 4 Key Steps to Successful Incident ResponseDec 02, 2019

历史摘要 · 未重新核验 · CrowdStrike

#apt #edr #crowdstrike

威胁情报2026-10-06 发布INFO

Cloud ManagerManage your cloud computing services

历史摘要 · 未重新核验 · Akamai Security Research

#botnet #akamai #ddos

威胁情报2026-10-06 发布INFO

See all Cloud Computing

历史摘要 · 未重新核验 · Akamai Security Research

#botnet #akamai #ddos

威胁情报2026-10-06 发布INFO

智利银行在勒索软件攻击后关闭所有分行

历史摘要 · 未重新核验 · CNCERT

#government #cncert #report

威胁情报2026-10-06 发布INFO

Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]Feb 21, 2019

历史摘要 · 未重新核验 · CrowdStrike

#apt #edr #crowdstrike

2026-10-06 归档