Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
CVE-2026-111057
### Summary A missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to
2026-10-20 归档
今日共收录 730 条安全情报，包含 0 个 CVE，352 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream...
CVE-2026-105299
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstrea
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery ...
CVE-2026-8355
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authe
Mercury: Unauthenticated Remote Code Execution via /api/kernels
CVE-2026-111058
Mercury runs a JupyterLab server with **anonymous access by default** (`mercury_app/__main__.py` sets `--IdentityProvide
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CVE-2025-5777
Citrix NetScaler 内存泄漏(CVE-2025-5777)
CrowdStrike Announces Continuous Identity for AI Agents
CrowdStrike Announces Continuous Identity for AI Agents
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
## Summary The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT `sub` claim) specifi
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
## Summary The Fortran extractor's C-preprocessor step (`graphify/extractors/fortran.py`, `_cpp_preprocess`) applies an
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
CVE-2026-88771
CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams d
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
CVE-2026-0257
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulner
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized...
CVE-2026-75753
Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send speci
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent...
CVE-2026-17518
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrup
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud
Sign Up for Free Cloud Tier
Sign Up for Free Cloud Tier
iOS 26.4.2 and iPadOS 26.4.2
iOS 26.4.2 and iPadOS 26.4.2
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.8 and iPadOS 18.7.8