ARCHIVE
历史归档
按时间、分类、严重程度检索全部安全漏洞与安全信息。当前共收录 261 条记录。
基于证据锚定的大语言模型辅助 Android 移动取证报告
作者：Madhab Chandra Das, Sajid Ahmed, Tasnia Tabassum, Qingzhong Liu 原文链接：https://arxiv.org/pdf/2610.26946v1 摘要 大语言模型可以辅助起草取证报告，但流畅的输出并不能保证证据层面的可靠性。本研究提出一个以证据为锚定的框架，用于在原子主张（atomic-claim）层面评估大语言模型辅助生成的 A...
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent S…
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization af…
CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitati…
Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets…
Routeros CVE-2026-67281 分析
近日routeros连续爆出一系列高危漏洞。其中 `CVE-2026-67281` 是暴露在`www`口的任意文件读漏洞，影响范围相对ssh更广泛一些。
CVE-2026-104368：The Export and Import Users and Customers plugin for WordPress is vuln
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exist…
CVE-2026-103963：A flaw was found in glib-networking. When establishing connections usi
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host…
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix…
全球最大加密交易所币安遭入侵，被盗金额或超57亿美元
全球最大加密交易所币安疑似遭黑客入侵，被盗金额或超57亿美元，若核实将成加密史上最大窃案，已暂停充提服务，承诺全额赔付，正联动多方冻结涉案资金。
A quiet week in infosec
In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all, there are still good people doing good work.
CVE-2026-111357：Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-10…
Linux Kernel IPv4 TCP释放后重用漏洞(CVE-2026-98432)安全风险通告
攻击者可利用该漏洞通过网络触发内核内存损坏、信息泄露（绕过 KASLR）、拒绝服务，或在特定条件下（如 MPTCP...
CVE-2026-118527：Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Th…
EDUCAUSE发布2027年高等教育信息技术十大议题
更灵活、更迅速地适应，带着明确目的去适应，始终以人为中心。 近日，美国高等教育信息化协会EDUCAUSE发布2027年高等教育信息技术十大议题（Top 10）报告，其主题为持续变革的时代（The Age of Perpetual Change），意在表明变化无处不在，且这种势头不太可能减缓。高等教育要么被这股浪潮席卷而去，要么在坚守其根本宗旨的同时适应这种变化。报告同时指出，AI首次跃居榜首，但其排名更多体现紧迫性而非共识，高等教育机构…
