ARCHIVE
按时间、分类、严重程度检索全部安全漏洞与安全信息。当前共收录 261 条记录。
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer co…
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Meta的最新实践。 假设用户让智能体“把上周出差的费用整理好，提交报销”。为了完成这项任务，智能体需要读取邮件、提取票据、核对行程，进而调用企业的报销系统。对用户而言，自己交代的只是一件事；但在系统内部，实际展开的却是一连串个人信息处理行为。至于哪些邮件可以读取、票据是否需要发送给外部模型处理、整理出的消费记录能否存入长期记忆，往往并非在任务启动前就全部锁定，而是在任务执行过程中才逐步确定。 这给个人信息保护提出了一个直接而具体的问题…
多个渠道披露的消息显示，公安部已成立无人机安全防控局。 多个渠道披露的消息显示，公安部已成立无人机安全防控局。据四川省公安厅官网10月22日消息，10月14日至15日，2026低空经济产业发展大会公安专场活动在四川自贡举行，公安部无人机安全防控局相关负责同志参加活动。 更早之前，9月10日，据法治日报报道，浙江省县级市玉环市成立全国首个县级低空安全保卫专业大队，补齐县级低空安全保卫力量，该报道同时提及，公安部已成立无人机安全防控局，省公…
What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or…
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or pot…
[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program]
YARA-X's 1.22.0 release brings 11 improvements and 9 bugfixes.
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
CVE-2025-41242是Spring Framework高危路径穿越漏洞，利用Java字符高位截断（幽灵比特）特性，构造特殊Unicode字符生成畸形 %uXXXX 编码，实现跨组件解析不一致绕过，突破Spring路径黑名单校验，在Jetty底层还原出目录穿越符号读取敏感文件。本文从代码审计、漏洞复现到补丁验证完整复盘该漏洞，分析利用链并给出安全防御方案。
