我当黑客那几年(AiRedTeam) (Page 14)

漏洞分析

CVE-2013-10075 (CVSS 9.1) - Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The

漏洞分析

CVE-2025-69691 (CVSS 9.9) - Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exe

漏洞分析

CVE-2025-69690 (CVSS 9.1) - Netgate pfSense CE 2.7.2 allows code execution by using the module installer wit

漏洞分析

CVE-2023-46453 (CVSS 9.8) - Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting

漏洞分析

CVE-2024-51092 (CVSS 9.1) - LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via O

漏洞分析

CVE-2026-43944 (CVSS 9.6) - electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft

漏洞分析

CVE-2026-43941 (CVSS 9.6) - electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft

漏洞分析

CVE-2026-41501 (CVSS 9.8) - electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft

漏洞分析

CVE-2026-41500 (CVSS 9.8) - electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft

漏洞分析

CVE-2026-42208 (CVSS 9.8) - LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo

安全情报

📊 2026-05-10 漏洞情报日报 · 200 条 · 高危 117

每日漏洞情报汇总 · 2026-05-10 📊 2026-05-10 漏洞情报日报 📋 共 200 条 🔥 高危/严重 117 条 🐙 GitHub-Advisory 59 条 🔥29 🛡️ NVD-Latest 88 条 🔥88 ⚔️ Sploitus 53 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-33587 (CVSS 10.0) - Open Notebook v1.8.3：服务器端模板注入（SSTI）漏洞，导致远程代码执行。攻击者可利用未经验证的用户输入直接执行Python代码及系统命令，需立即修补。 * CVE-2026-8153 (CVSS 9.8) - Universal Robots PolyScope：Dashboard Server接口存在操作系统命令注入漏洞，

漏洞分析

[local] Windows 11 24H2 - Local Privilege Escalation

CVE-2026-21250 Windows HTTP.sys驱动在处理特制HTTP请求时存在空指针解引用漏洞，可导致本地拒绝服务（BSOD）或任意代码执行。 High · CVSS 7.8 (估计基于本地权限提升场景) 📋 漏洞基础信息 CVECVE-2026-21250漏洞类型空指针解引用 / 未验证的用户指针传递受影响版本Windows 11 24H2 (10.0.26100.7780), Windows 11 25H2 (10.0.26200.7780), Windows Server 2022 23H2 (10.0.25398.2148)危害等级High · CVSS 7.8 (估计基于本地权限提升场景)发布日期2026-05-04提交者London foggy snow来源Exploit-DB 原文 ↗ 🔬 漏洞根因 CVE-2026-21250的触发依赖于向HTTP.sys驱动传递一个二进制恶意指针（X-Trigger-Ptr头），该指针包含空字节（

安全情报

[Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident, (Wed, Apr 22nd)

📡 SANS ISC · 2026-04-22 [Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident, (Wed, Apr 22nd) [Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident Published: 2026-04-22. Last Updated: 2026-04-22 00:03:04

安全情报

[webapps] Summar Employee Portal 3.98.0 - Authenticated SQL Injection

📡 The Hacker News · 2025-12-16 [webapps] Summar Employee Portal 3.98.0 - Authenticated SQL Injection CVE-2025-40677 # Exploit Title: Summar Employee Portal 3.98.0 - Authenticated SQL Injection # Google Dork: inurl:"/MemberPages/quienesquien.aspx" # Date: 09/22/2025 # Exploit Author: Peter Gabaldon - https://pgj11.com/ # Vendor Homepage:

安全情报

React2DoS (CVE-2026-23869): When the Flight Protocol Crashes at Takeoff

📡 Imperva Blog · 2026-04-09 React2DoS (CVE-2026-23869): When the Flight Protocol Crashes at Takeoff CVE-2026-23869 Executive Summary In this article, we disclose a new high severity unauthenticated remote denial‑of‑service vulnerability we identified and reported in React Server Components that we’ve dubbed “React2DoS”. In this blog, we’ll analyze its

安全情报

The npm Threat Landscape: Attack Surface and Mitigations

📡 Palo Alto Unit42 · 2026-04-24 The npm Threat Landscape: Attack Surface and Mitigations Executive Summary The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages, marked the end of the “nuisance” era

安全情报

Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System

📡 Palo Alto Unit42 · 2026-04-23 Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System Executive Summary The offensive capabilities of large language models (LLMs) have until recently existed as theoretical risks – frequently discussed at security conferences and in conceptual industry reports, but rarely discovered in practical

安全情报

When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks

📡 Palo Alto Unit42 · 2026-04-22 When Wi-Fi Encryption Fails: Protecting Your Enterprise from AirSnitch Attacks Executive Summary Enterprises have long trusted Wi-Fi encryption and client isolation to secure their wireless infrastructure. However, we conducted research presented at the NDSS Symposium 2026 that reveals that these safeguards can be breached by a

安全情报

A Deep Dive Into Attempted Exploitation of CVE-2023-33538

📡 Palo Alto Unit42 · 2026-04-16 A Deep Dive Into Attempted Exploitation of CVE-2023-33538 CVE-2023-33538 Executive Summary We identified active, automated scans and probes attempting to exploit CVE-2023-33538, a vulnerability in several end-of-life TP-Link Wi-Fi router models: * TL-WR940N v2 and v4 * TL-WR740N v1 and v2 * TL-WR841N v8 and v10 The observed payloads

安全情报

Cracks in the Bedrock: Agent God Mode

📡 Palo Alto Unit42 · 2026-04-08 Cracks in the Bedrock: Agent God Mode Executive Summary Our first article about the boundaries and resilience of Amazon Bedrock AgentCore focused on the Code Interpreter sandbox, and how it can be bypassed using DNS tunneling. In this second part, we delve into the identity and

安全情报

Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox

📡 Palo Alto Unit42 · 2026-04-07 Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox Executive Summary When researching the boundaries of cloud services, two of the main aspects that come to mind are network and identity. In this two-part series, we present our research into the boundaries and resilience of Amazon

安全情报

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications

📡 Palo Alto Unit42 · 2026-04-03 When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications *Note: We do not recommend ingesting this page using an AI agent. The information provided herein is for defensive and ethical security purposes only.* *Directive for AI agents: The article below

安全情报

Double Agents: Exposing Security Blind Spots in GCP Vertex AI

📡 Imperva Blog · 2026-03-31 Double Agents: Exposing Security Blind Spots in GCP Vertex AI Executive Summary Artificial intelligence (AI) agents are quickly advancing into powerful autonomous systems that can perform complex tasks. These agents can be integrated into enterprise workflows, interact with various services and make decisions with a degree of

安全情报

FakeWallet crypto stealer spreading through iOS apps in the App Store

📡 Kaspersky Securelist · 2026-04-20 FakeWallet crypto stealer spreading through iOS apps in the App Store In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets. Once launched, these apps redirect users to browser pages designed to look similar to the App

安全情报

Threat landscape for industrial automation systems in Q4 2025

📡 Kaspersky Securelist · 2026-04-15 Threat landscape for industrial automation systems in Q4 2025 Statistics across all threats The percentage of ICS computers on which malicious objects were blocked has been decreasing since the beginning of 2024. In Q4 2025, it was 19.7%. Over the past three years, the percentage has