Security Is More Than a Library Call: How Security Features Live in Code
Implementing security features---functionalities that protect sensitive data or prevent malicious actions by attackers--
2026-10-07 归档
今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Efficient HQC Implementations on RISC-V: A Cross-Layer Design Space Exploration
RISC-V-based hardware/software co-design has become an established methodology for implementing post-quantum cryptograph
Runaway Reaction: When Benign Skills Compose into Malicious Behavior
Agent skills package task-specific knowledge and procedures that can be composed to support complex agent tasks, while p
Agentic-ZTA: A Multi-Agent Architecture for Autonomous Zero Trust Enforcement
Agentic AI is emerging as a promising paradigm for automating complex cybersecurity decisions, yet its use in enforcing
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
CVE-2026-106123
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP (31) and SSH_MSG_KEX_DH_GEX_REPLY (33...
CVE-2026-84897
src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_M
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal....
CVE-2026-16516
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiate
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router setti...
CVE-2026-14911
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a rem
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive ...
CVE-2026-19396
A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE5
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the e...
CVE-2026-19386
A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code v
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially...
CVE-2026-16528
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the GatewayPo...
CVE-2026-106589
In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpected
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaff...
CVE-2026-106506
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh token. An unexpired...
CVE-2026-101023
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type,
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an ...
CVE-2026-102162
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vuln
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malform...
CVE-2026-106122
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.
An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3...
CVE-2026-80327
An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway version
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner tot_len When the start of an inner packet is split ...
CVE-2026-98371
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short i
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). Commit bfdb01283ee8 ("af_unix: Assign a ...
CVE-2026-98289
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unify scc_index when finalising SCC in __u
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrup...
CVE-2026-98275
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt co