每日漏洞情报汇总 · 2026-05-26 📊 2026-05-26 漏洞情报日报 📋 共 200 条 🔥 高危/严重 76 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 13 条 🔥7 🛡️ NVD-Latest 69 条 🔥69 ⚔️ Sploitus 117 条 🤖 今日安全态势分析 🎯 今日重点关注 * UniFi OS 三连击 (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910)： Ubiquiti UniFi OS 设备爆出三个CVSS 10.0漏洞，分别涉及命令注入、路径遍历和权限控制缺陷。攻击者只需网络可达，即可实现设备完全控制，影响面极广。 * Nezha Monitoring 跨租户命令执行 (CVE-2026-46716)： 开源监控面板Nezha中，普通的RoleMember角色用户可通过Cron

每日漏洞情报汇总 · 2026-05-25 📊 2026-05-25 漏洞情报日报 📋 共 200 条 🔥 高危/严重 87 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 17 条 🔥7 🛡️ NVD-Latest 80 条 🔥80 ⚔️ Sploitus 102 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-34908/34909/34910 (CVSS 10.0) - Ubiquiti UniFi OS：三枚满分漏洞组合，分别涉及不当访问控制、路径遍历与命令注入。拥有网络访问权限的攻击者可借此完全控制底层系统，影响范围包括所有UniFi OS设备。 * CVE-2026-46716 - Nezha Monitor：权限绕过漏洞。低权限的RoleMember用户可通过cron API接口（

📡 Security Affairs · 2026-04-27 Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting CVE-2026-6770 A vulnerability, tracked as CVE-2026-6770, allowed attackers to fingerprint Firefox users, even in Private Browsing, and also impacted the Tor Browser. The flaw worked even when Tor’s New Identity feature was used, bypassing protections meant to

📡 Imperva Blog · 2026-03-24 API Security for AI Agents: Why Protection Has Never Been More Important. For years, a lot of risky APIs survived simply because they were hard to find. They weren’t documented. Only a handful of engineers knew the endpoints. And if an attacker wanted to abuse them,

📡 Security Blog · Article #925 CVE-2024-1708CVE-2026-32202CVE-2026-31431 TeamPCP Weekly Analysis: 2026-W18 (2026-04-27 through 2026-05-03) Summary The most significant development of the week was the April 29 to 30 Mini Shai-Hulud worm, a self-propagating supply chain campaign that compromised four official SAP npm packages, two PyTorch Lightning PyPI versions, two intercom-client npm versions,

每日漏洞情报汇总 · 2026-05-24 📊 2026-05-24 漏洞情报日报 📋 共 200 条 🔥 高危/严重 114 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 17 条 🔥7 🛡️ NVD-Latest 107 条 🔥107 ⚔️ Sploitus 75 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-46716 (Nezha Monitoring)：权限提升/跨租户命令执行。RoleMember角色用户可通过未正确鉴权的Cron API在任意服务器上执行Shell命令，影响所有Nezha监控部署。 * CVE-2026-46670 (YesWiki)：未认证SQL注入。攻击者可在默认安装的Bazar表单导入路径中注入恶意SQL，进而拖取全库数据，无需任何权限。 * CVE-2026-34908/34909/34910 (UniFi OS)：三连击CVSS 10.0漏洞。包括命令注入、

📡 Elastic Security Labs · 0 Your UEBA is lying to you: Why entity record quality decides everything There's an uncomfortable truth in security analytics that nobody talks about at conferences: The quality of your detections, alerts, and investigations is only as good as the entity records that represent the

每日漏洞情报汇总 · 2026-05-23 📊 2026-05-23 漏洞情报日报 📋 共 200 条 🔥 高危/严重 102 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 42 条 🔥17 🛡️ NVD-Latest 85 条 🔥85 ⚔️ Sploitus 72 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-46670 (YesWiki) — 未认证SQL注入：影响YesWiki默认安装，攻击者无需登录即可通过Bazar表单导入路径注入任意SQL语句，导致数据库全量读取与数据泄露，风险极高。 * CVE-2026-46614 (Fission) — 内部路由公开暴露：Fission路由组件未验证HTTPTrigger是否存在，导致所有函数内部路由对外暴露，攻击者可未经授权直接调用函数，引发远程代码执行风险。 * CVE-2026-46633 (Twig) — PHP代码注入：模板引擎Twig在处理`{% use %}`标签时，因对单引号转义缺失，导致PHP代码注入。任何允许用户