Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access

Apple has announced that it's taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due

历史摘要 · 未重新核验 · The Hacker News

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup...

CVE-2026-75962

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown...

CVE-2026-105571

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/p

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names...

CVE-2026-104040

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quot

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted...

CVE-2026-105484

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the functio

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the...

CVE-2026-104036

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry

历史摘要 · 未重新核验 · GitHub Advisory

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

CVE-2026-105750

### Summary When the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `en

历史摘要 · 未重新核验 · GitHub Advisory

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

CVE-2026-105753

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

CVE-2026-105752

## Affected - **Ecosystem / package:** pip / `vllm` - **Affected versions:** vLLM ≤ 0.25.1 (confirmed on 0.25.1, commit

历史摘要 · 未重新核验 · GitHub Advisory

simple-git unsafe-operation guard does not block trailer command configuration

CVE-2026-102828

## Affected product The default `blockUnsafeOperationsPlugin` in `simple-git` when an application permits untrusted val

历史摘要 · 未重新核验 · GitHub Advisory

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

CVE-2026-102275

### Summary PyJWT accepts internally inconsistent OKP private JWKs where the declared public key `x` does not correspon

历史摘要 · 未重新核验 · GitHub Advisory

KaTeX: Existing prototype pollution can bypass trust restrictions

CVE-2026-103923

### Impact KaTeX can act as a read-side prototype pollution gadget in applications where `Object.prototype` has already

历史摘要 · 未重新核验 · GitHub Advisory

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

CVE-2026-104874

## Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6

历史摘要 · 未重新核验 · GitHub Advisory

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

CVE-2026-104846

A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable th

历史摘要 · 未重新核验 · GitHub Advisory

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

CVE-2026-90711

### Impact `proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. Wh

历史摘要 · 未重新核验 · GitHub Advisory

@nx/docker: OS command injection in the @nx/docker release pipeline

CVE-2026-104859

## Summary The `@nx/docker` release pipeline builds its `docker` invocations as shell command strings, interpolating `r

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM custom resolution bypasses external path boundaries

CVE-2026-100721

## Summary At source revision `91034466bfb7f56b95fd48083ec6ca36d058f164` of vm2 3.11.8, an untrusted `NodeVM` guest can

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

CVE-2026-100723

## Summary When an application explicitly exposes Node's `zlib` module through vm2's `NodeVM` builtin allowlist, an unt

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

CVE-2026-103921

## Impact `buildWSLegacyExecutor()` in `@graphql-tools/executor-legacy-ws` previously hardcoded `rejectUnauthorized: fa

历史摘要 · 未重新核验 · GitHub Advisory

Snowflake drivers writes sensitive information to logs

CVE-2026-86597

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers

历史摘要 · 未重新核验 · GitHub Advisory