ARCHIVE
按时间、分类、严重程度检索全部安全漏洞与安全信息。当前共收录 123 条记录。
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting…
2025年爆出的某电子签署平台验签功能 /api/pdfverifier 漏洞还是比较经典的。本身是 Jar 包启动的Web服务，验签漏洞是 zip 文件上传然后ZipSlip 漏洞，在这个场景下进行RCE。本篇文章主要记录下签署平台在该ZipSlip漏洞下的RCE方式。
研究人员披露微软Edge存在串联5个漏洞的零点击利用链，无需内存破坏、无需额外点击即可突破沙箱在Windows执行代码，用户需尽快安装安全更新。
PHP2Shell高危漏洞已遭在野利用，因资产可见性不足、补丁落地难，将在企业环境残留数年，危害或超Log4Shell。
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorize…
攻击者串联PHP2Shell与Linux内核漏洞，15分钟即可获取root权限，攻陷25台服务器、渗透美政府关联内网，仅打补丁不够，需警惕残留后门。
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First…
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities…
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to re…
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regul…
谷歌发布旗舰大模型Gemini 4 Carbon，网络安全能力大幅升级，漏洞修复效率超竞品10倍，幻觉、提示注入风险显著降低。
无需内存损坏漏洞！研究员靠纯逻辑漏洞链攻破Edge沙箱实现任意代码执行，斩获Pwn2Own17.5万美元奖金，微软已推送修复补丁。
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVS…
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machi…
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer co…
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or pot…
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
