ARCHIVE
按时间、分类、严重程度检索全部安全漏洞与安全信息。当前共收录 261 条记录。
Yet Another ClickFix Campaign Published : 2026 10 28. Last Updated : 2026 10 29 00:42:15 UTC by Brad Duncan (Version: 1) Introduction On Wednesday, 2026 10 28, I ran across a ClickFix campaign I haven't seen before. Like…
PHP2Shell高危漏洞已遭在野利用，因资产可见性不足、补丁落地难，将在企业环境残留数年，危害或超Log4Shell。
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorize…
攻击者串联PHP2Shell与Linux内核漏洞，15分钟即可获取root权限，攻陷25台服务器、渗透美政府关联内网，仅打补丁不够，需警惕残留后门。
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First…
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identi…
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published…
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities…
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regul…
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to re…
谷歌发布旗舰大模型Gemini 4 Carbon，网络安全能力大幅升级，漏洞修复效率超竞品10倍，幻觉、提示注入风险显著降低。
无需内存损坏漏洞！研究员靠纯逻辑漏洞链攻破Edge沙箱实现任意代码执行，斩获Pwn2Own17.5万美元奖金，微软已推送修复补丁。
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVS…
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machi…
作者：Zhiyue Xu, Xukai Wang, Zhiyuan Huang, Mingjie Zhan, Jian Zhao, Xu-Yao Zhang 原文链接：https://arxiv.org/html/2610.28425v1 摘要 现代 LLM 智能体通过两条通道在会话之间持久化状态：一是被静默前置到系统提示中的长期记忆文件，二是无需用户输入即可唤醒智能体的定时任务。一次性的间接提示...
JeecgBoot 近期被披露存在“权限绕过 + SQL注入”组合漏洞（QVD-2026-56312 / LDYVUL-2026-00170236），CVSS 3.1 评分为 8.6（高危）。该漏洞允许未授权的远程攻击者绕过系统鉴权，通过 SQL 盲注窃取数据库敏感信息，甚至接管系统。
