📡 GitHub-Advisory · 2026-05-08 CVE-2026-44209 - banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI CVE-2026-44209 GHSA-gphh-9q3h-jgpp HIGH pip/banks CVE: CVE-2026-44209 Summary banks <= 2.4.1 uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44728 - @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling CVE-2026-44728 GHSA-fv7c-fp4j-7gwp HIGH npm/@babel/plugin-transform-modules-systemjs CVE: CVE-2026-44728 Impact Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. Known affected plugins are: * @babel/plugin-transform-modules-systemjs * @babel/

📡 GitHub-Advisory · 2026-05-08 CVE-2026-32689 - Phoenix: Long-poll NDJSON body splitting causes large memory allocation CVE-2026-32689 GHSA-628h-q48j-jr6q HIGH erlang/phoenix CVE: CVE-2026-32689 Summary An unauthenticated denial-of-service vulnerability in Phoenix's long-poll transport allows a remote client to allocate a large amount of memory with a HTTP request. A handful of concurrent

📡 GitHub-Advisory · 2026-05-08 GHSA-qhh4-458h-xwh2 - @cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to GHSA-qhh4-458h-xwh2 MEDIUM npm/@cyclonedx/cdxgen CVE: Docker registry auth substring match forwards credentials to a different registry Repository cdxgen/cdxgen Affected product/package * Ecosystem: npm * Package: @cyclonedx/cdxgen * Reviewed tree version: 12.3.3 * Reviewed commit:

每日漏洞情报汇总 · 2026-05-09 📊 2026-05-09 漏洞情报日报 📋 共 200 条 🔥 高危/严重 90 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 80 条 🔥42 🛡️ NVD-Latest 48 条 🔥48 ⚔️ Sploitus 71 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-33587 (CVSS 10.0) - Open Notebook v1.8.3 由于未对用户输入进行清理，导致存在服务器端模板注入（SSTI）。攻击者可通过创建笔记触发任意Python代码执行，进而控制Docker容器，构成完全接管风险。 * CVE-2026-43999 (CVSS 9.x Critical) - vm2沙箱逃逸漏洞。

📡 NVD-Latest · 2026-05-06 CVE-2026-40010 (CVSS 9.1) - Missing invocation of Servlet http web request method changeSessionId after sess CVE-2026-40010 CVE-2026-40010 CVSS:9.1 Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache

每日漏洞情报汇总 · 2026-05-08 📊 2026-05-08 漏洞情报日报 📋 共 200 条 🔥 高危/严重 75 条 🚨 CISA-KEV 1 条 💣 Exploit-DB-RSS 6 条 🐙 GitHub-Advisory 107 条 🔥56 🛡️ NVD-Latest 19 条 🔥19 ⚔️ Sploitus 67 条 🤖 今日安全态势分析 🎯 今日重点关注 * vm2 系列沙箱逃逸漏洞 (CVE-2026-43999, CVE-2026-44006, CVE-2026-44007 等): 多个CRITICAL级别漏洞集中爆发。攻击者可通过绕过内置白名单、利用代理对象或启用嵌套模式等方式，从受保护的沙箱中逃逸，在宿主主机上执行任意代码。影响所有使用vm2库的Node.js应用，利用条件低。 * 供应链投毒攻击 (PyTorch Lightning, Intercom): PyTorch Lightning和Intercom的官方软件包/

📡 NVD-Latest · 2026-05-05 CVE-2026-7823 (CVSS 9.8) - A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Aff CVE-2026-7823 CVE-2026-7823 CVSS:9.8 A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi.

📡 NVD-Latest · 2026-05-05 CVE-2026-7834 (CVSS 9.8) - A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This i CVE-2026-7834 CVE-2026-7834 CVSS:9.8 A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This issue affects the function get_csrf_whites of the

📡 Sploitus · 2026-05-06 Exploit for CVE-2026-0300 exploit CVE-2026-0300 Exploit for CVE-2026-0300 exploit 📌 来源: Sploitus | 🆔 CVE-2026-0300 | 📅 2026-05-06

每日漏洞情报汇总 · 2026-05-07 📊 2026-05-07 漏洞情报日报 📋 共 200 条 🔥 高危/严重 102 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 100 条 🔥45 🛡️ NVD-Latest 57 条 🔥57 ⚔️ Sploitus 42 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-44351 - fast-jwt (CVSS 9.8): 异步密钥解析器接受空HMAC密钥，导致任何未认证攻击者均可伪造任意JWT，实现完全身份绕过。影响所有使用fast-jwt的认证系统。 * CVE-2026-42607 / GHSA-vj3m-2g9h-vm4p - Grav CMS (多个RCE): 存在至少4个远程代码执行向量，包括恶意插件ZIP上传绕过、反序列化漏洞等。仅需低权限管理员账户，即可获取服务器控制权。 * CVE-2026-42300 -

每日漏洞情报汇总 · 2026-05-06 📊 2026-05-06 漏洞情报日报 📋 共 193 条 🔥 高危/严重 121 条 💣 Exploit-DB-RSS 6 条 🐙 GitHub-Advisory 50 条 🔥26 🛡️ NVD-Latest 95 条 🔥95 ⚔️ Sploitus 42 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-42300 (DevGuard, 未认证身份绕过)：攻击者通过构造`X-Admin-Token`请求头即可冒充任意用户，无需任何身份凭证，利用难度极低。 * CVE-2026-42369 (GV-VMS V20, 远程代码执行)：CVSS 10.0的严重漏洞，影响视频监控软件，攻击者可通过网络远程接管服务器，风险极高。 * GHSA-vj3m-2g9h-vm4p (Grav CMS, 多处RCE)：包含三个关键RCE向量(

📡 Imperva Blog · 2026-04-23 Hacking Safari with GPT 5.4 CVE-2026-20664 When Anthropic unveiled Mythos and Project Glasswing, the reaction was immediate and polarized. Some dismissed it as fear-driven marketing, while others treated it as a credible shift in the threat landscape. Like with many things, the truth is probably somewhere

📡 4hou · 2026-04-08 Claude Code源码泄露遭利用，攻击者借GitHub散播窃密木马 Claude Code源码泄露遭利用，攻击者借GitHub散播窃密木马 导语：从以往案例来看，攻击者往往会迅速借热点公开事件发动机会主义攻击，借机入侵目标设备。 威胁组织正利用近期Claude Code源代码泄露事件，通过伪造GitHub仓库向用户分发Vidar窃密木马。 Claude Code是人工智能公司Anthropic推出的一款终端版AI代理工具，可直接在终端中执行编程任务，作为自主代理实现系统直接交互、大语言模型API调用管理、MCP集成以及持久化记忆等功能。 据悉，Anthropic在发布npm包时因疏忽，意外嵌入了一个大小为59.8MB的JavaScript源码映射文件，导致这款新工具的完整客户端源代码被公开泄露。 此次泄露包含1906个文件、共计51.3万行未做混淆处理的TypeScript代码，暴露了该AI代理的调度逻辑、权限与执行机制、隐藏功能、编译细节以及多项安全相关核心实现。 泄露代码很快被大量用户下载并上传至Git

📡 GitHub-Advisory · 2026-05-05 CVE-2026-44221 - ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-c CVE-2026-44221 GHSA-fxc7-fm93-6q77 CRITICAL maven/com.arcadedb:arcadedb-server CVE: CVE-2026-44221 Impact Authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects

📡 GitHub-Advisory · 2026-05-05 CVE-2026-44217 - sse-channel: SSE Injection via unsanitized event fields CVE-2026-44217 GHSA-84hm-wfh8-c5pg MEDIUM npm/sse-channel CVE: CVE-2026-44217 Impact Implementations that allows user-provided values to be passed to event, retry or id fields would be susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. * Event

📡 4hou · 2026-04-09 新型CrystalRAT恶意软件新增远程控制、数据窃取等功能 新型CrystalRAT恶意软件新增远程控制、数据窃取等功能 导语：这款木马与WebRAT高度相似，二者拥有相同的控制面板设计、均使用Go语言编写，且采用类似的机器人销售系统。 一款名为CrystalRAT的新型远程控制木马正在Telegram上以恶意软件即服务（MaaS）模式推广，提供远程控制、数据窃取、键盘记录与剪贴板劫持等核心功能。 该恶意软件于今年1月现身，采用分级订阅模式运营。除Telegram频道外，运营者还在YouTube开设专门营销账号，通过功能演示视频进行推广。 卡巴斯基研究人员在最近发布的报告中指出，这款木马与WebRAT（Salat窃密木马）高度相似，二者拥有相同的控制面板设计、均使用Go语言编写，且采用类似的机器人销售系统。 CrystalX还内置了大量恶作剧功能，用于骚扰用户或干扰其正常工作。尽管带有“娱乐化”外观，该木马仍具备全面且强大的数据窃取能力。 Telegram频道推广CrystaX RAT CrystalX R

📡 Acunetix · 2025-02-12 Understanding Injection Attacks in Application Security: Types, Tools, and Examples How Injection Attacks Exploit Web Application Vulnerabilities Injection attacks occur when malicious input is inserted into a web application, exploiting vulnerabilities in unvalidated user input to execute unintended commands. Attackers craft payloads that manipulate how the application processes

📡 Acunetix · 2025-02-12 XSS Filter Evasion: How Attackers Bypass XSS Filters – And Why Filtering Alone Isn’t Enough XSS filter evasion techniques allow attackers to bypass cross-site scripting (XSS) protections designed to block malicious scripts. This article explores some of the most common filter bypass strategies, explains why relying solely on

📡 SANS ISC · 2026-04-29 [local] Atlona ATOMERX21 - Authenticated Command Injection CVE-2024-30167 // Exploit Title: Atlona AT-OME-RX21 Authenticated Command Injection // Google Dork: N/A // Date: 2025-12-28 // Exploit Author: RIZZZIOM // Vendor Homepage: https://atlona.com // Software Link: https://atlona.com/product/at-ome-rx21/ // Version: Firmware <= 1.5.1 // Tested on: AT-OME-RX21 Embedded Firmware

📡 SANS ISC · 2026-04-30 [webapps] SUSE Manager 4.3.15 - Code Execution CVE-2025-46811 # Exploit Title: SUSE Manager 4.3.15 - Code Execution # Date: 29.01.2026 # Exploit Author: Wiktor Maj # Vendor Homepage: https://www.uyuni-project.org/ # Software Link: https://github.com/uyuni-project/uyuni # Version: Uyuni 2025.05, SUSE Manager

📡 每日漏洞情报简报 — 2026-05-06 📊 共 10 篇 | 🔴 高危 0 | 🆔 CVE 0 📋 漏洞分类汇总 其他 (10) * [webapps] SUSE Manager 4.3.15 - Code Execution— * [local] Linux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation— * [local] Linux nf_tables 6.19.3 - Local Privilege Escalation— * [hardware] Linksys E1200 2.0.04