Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
CVE-2026-41510
## Root Cause File: `internal/corazawaf/transaction.go`, lines 770–808 (since commit 2fd87b89, PR #812, 2023-06-14) ``
2026-10-07 归档
今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
CVE-2026-41508
## Root Cause File: `internal/bodyprocessors/multipart.go` (since commit `3347961b`, PR #1453 *"feat: ignore unexpected
Payload: SQL Injection in SQLite and Postgres
CVE-2026-105845
### Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - Y
i18next-http-backend incomplete URL validation permits SSRF
CVE-2026-105800
There is an SSRF vulnerability when using `i18next-http-backend`. A colon in an attacker-controlled language value can m
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
CVE-2026-105794
# Summary Improper TLS hostname verification allows a man-in-the-middle (MITM) attack on MsQuic. # Details Only MsQu
BARE-AI: Bit-Flip Attack Resilience in AI Hardware through Built-in Performance Monitors
Deep Neural Networks (DNNs) are integral to many safety critical systems, yet they remain highly vulnerable to bit-flip
Surviving the Router: Optimizing Skill Injections for Retrieval and Execution
AI agents increasingly rely on modular third-party "skills" that are dynamically selected by skill routers to execute co
Safeguarding LLMs via Model-Agnostic Latent Safety Signals from Dark Knowledge
LLMs have advanced rapidly, raising growing concerns about their safety. Recent work has proposed approaches to detect a
Polar: LLM-Powered Synthesis of Real-World Cyber Evidence for Prioritization and Mitigation
Cyber threat analysis increasingly depends on evidence distributed across vendor advisories, vulnerability databases, an
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud
Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud
CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms
CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms
CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks
CrowdStrike Extends Endpoint Security to Stop Software Supply Chain Attacks