📡 GitHub Security Lab · 0 Community-powered security with AI: an open source framework for security research Kevin Backhouse I'm a security researcher on the GitHub Security Lab team. I try to help make open source software more secure by searching for vulnerabilities and working with maintainers to get them

每日漏洞情报汇总 · 2026-05-28 📊 2026-05-28 漏洞情报日报 📋 共 200 条 🔥 高危/严重 90 条 🚨 CISA-KEV 3 条 💣 Exploit-DB-RSS 13 条 🐙 GitHub-Advisory 70 条 🔥36 🛡️ NVD-Latest 54 条 🔥54 ⚔️ Sploitus 60 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-44632 / CVE-2026-46562 / CVE-2026-46621 (Yamcs)：航天任务控制系统Yamcs出现三枚严重RCE漏洞，攻击者可通过Janino、Nashorn及Jython引擎注入恶意算法文本实现远程代码执行，无需认证即可完全控制受控系统，属于“一键击穿”级别威胁。 * CVE-2026-23734 / CVE-2026-33137 (XWiki Platform)：XWiki曝出两枚严重漏洞：路径遍历可读取任意配置文件（如WEB-INF/xwiki.cfg）

每日漏洞情报汇总 · 2026-05-27 📊 2026-05-27 漏洞情报日报 📋 共 200 条 🔥 高危/严重 64 条 🚨 CISA-KEV 1 条 💣 Exploit-DB-RSS 6 条 🐙 GitHub-Advisory 22 条 🔥13 🛡️ NVD-Latest 51 条 🔥51 ⚔️ Sploitus 120 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-33137 (XWiki Platform)：严重未授权XAR导入漏洞。攻击者无需认证即可通过REST API `/wikis/{wikiName}` 创建或修改wiki文档，可能导致完全接管Wiki服务器。 * CVE-2026-43945 (FUXA)：前未授权远程代码执行。通过路径操纵与配置注入，无需登录即可触发以root权限执行任意命令，直接威胁工业控制系统安全。 * CVE-2026-9458 / 9457 / 9456 等

每日漏洞情报汇总 · 2026-05-26 📊 2026-05-26 漏洞情报日报 📋 共 200 条 🔥 高危/严重 76 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 13 条 🔥7 🛡️ NVD-Latest 69 条 🔥69 ⚔️ Sploitus 117 条 🤖 今日安全态势分析 🎯 今日重点关注 * UniFi OS 三连击 (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910)： Ubiquiti UniFi OS 设备爆出三个CVSS 10.0漏洞，分别涉及命令注入、路径遍历和权限控制缺陷。攻击者只需网络可达，即可实现设备完全控制，影响面极广。 * Nezha Monitoring 跨租户命令执行 (CVE-2026-46716)： 开源监控面板Nezha中，普通的RoleMember角色用户可通过Cron

每日漏洞情报汇总 · 2026-05-25 📊 2026-05-25 漏洞情报日报 📋 共 200 条 🔥 高危/严重 87 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 17 条 🔥7 🛡️ NVD-Latest 80 条 🔥80 ⚔️ Sploitus 102 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-34908/34909/34910 (CVSS 10.0) - Ubiquiti UniFi OS：三枚满分漏洞组合，分别涉及不当访问控制、路径遍历与命令注入。拥有网络访问权限的攻击者可借此完全控制底层系统，影响范围包括所有UniFi OS设备。 * CVE-2026-46716 - Nezha Monitor：权限绕过漏洞。低权限的RoleMember用户可通过cron API接口（

📡 Security Affairs · 2026-04-27 Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting CVE-2026-6770 A vulnerability, tracked as CVE-2026-6770, allowed attackers to fingerprint Firefox users, even in Private Browsing, and also impacted the Tor Browser. The flaw worked even when Tor’s New Identity feature was used, bypassing protections meant to

📡 Imperva Blog · 2026-03-24 API Security for AI Agents: Why Protection Has Never Been More Important. For years, a lot of risky APIs survived simply because they were hard to find. They weren’t documented. Only a handful of engineers knew the endpoints. And if an attacker wanted to abuse them,

📡 Security Blog · Article #925 CVE-2024-1708CVE-2026-32202CVE-2026-31431 TeamPCP Weekly Analysis: 2026-W18 (2026-04-27 through 2026-05-03) Summary The most significant development of the week was the April 29 to 30 Mini Shai-Hulud worm, a self-propagating supply chain campaign that compromised four official SAP npm packages, two PyTorch Lightning PyPI versions, two intercom-client npm versions,

每日漏洞情报汇总 · 2026-05-24 📊 2026-05-24 漏洞情报日报 📋 共 200 条 🔥 高危/严重 114 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 17 条 🔥7 🛡️ NVD-Latest 107 条 🔥107 ⚔️ Sploitus 75 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-46716 (Nezha Monitoring)：权限提升/跨租户命令执行。RoleMember角色用户可通过未正确鉴权的Cron API在任意服务器上执行Shell命令，影响所有Nezha监控部署。 * CVE-2026-46670 (YesWiki)：未认证SQL注入。攻击者可在默认安装的Bazar表单导入路径中注入恶意SQL，进而拖取全库数据，无需任何权限。 * CVE-2026-34908/34909/34910 (UniFi OS)：三连击CVSS 10.0漏洞。包括命令注入、

📡 Elastic Security Labs · 0 Your UEBA is lying to you: Why entity record quality decides everything There's an uncomfortable truth in security analytics that nobody talks about at conferences: The quality of your detections, alerts, and investigations is only as good as the entity records that represent the

每日漏洞情报汇总 · 2026-05-23 📊 2026-05-23 漏洞情报日报 📋 共 200 条 🔥 高危/严重 102 条 🚨 CISA-KEV 1 条 🐙 GitHub-Advisory 42 条 🔥17 🛡️ NVD-Latest 85 条 🔥85 ⚔️ Sploitus 72 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-46670 (YesWiki) — 未认证SQL注入：影响YesWiki默认安装，攻击者无需登录即可通过Bazar表单导入路径注入任意SQL语句，导致数据库全量读取与数据泄露，风险极高。 * CVE-2026-46614 (Fission) — 内部路由公开暴露：Fission路由组件未验证HTTPTrigger是否存在，导致所有函数内部路由对外暴露，攻击者可未经授权直接调用函数，引发远程代码执行风险。 * CVE-2026-46633 (Twig) — PHP代码注入：模板引擎Twig在处理`{% use %}`标签时，因对单引号转义缺失，导致PHP代码注入。任何允许用户

📡 Security Affairs · 2026-04-28 Microsoft fixes Entra ID flaw enabling privilege escalation Microsoft addressed a flaw in Microsoft Entra ID that could let attackers take over service accounts. The issue involved the Agent ID Administrator role, which manages AI agent identities and access, and could be abused for privilege escalation. Microsoft’

📡 SANS ISC · 2026-04-28 HTTP Requests with X-Vercel-Set-Bypass-Cookie Header, (Tue, Apr 28th) HTTP Requests with X-Vercel-Set-Bypass-Cookie Header This weekend, we saw a few requests to our honeypot that included an "X-Vercel-Set-Bypass-Cookie" header. A sample request: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

📡 SANS ISC · 2026-04-27 TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns, (Mon, Apr 27th) CVE-2026-33634 TeamPCP Supply Chain Campaign: Update 008 - 26-Day Pause Ends with Three Concurrent

📡 SANS ISC · 2026-04-23 Apple Patches Exploited Notification Flaw, (Thu, Apr 23rd) CVE-2026-28950 Apple Patches Exploited Notification Flaw Apple yesterday released iOS/iPadOS 26.4.2 and iOS/iPadOS 18.7.8. This update fixes a single Notification Services vulnerability, CVE-2026-28950: Impact: Notifications marked for deletion could be unexpectedly retained on

📡 SANS ISC · 2026-04-21 A .WAV With A Payload, (Tue, Apr 21st) A .WAV With A Payload There have been reports of threat actors using a .wav file as a vector for malware. It's a proper .wav file, but they didn't use staganography. The .wav file will

📡 Security Affairs · 2026-04-28 New Android spyware Morpheus linked to Italian surveillance firm The non-partisan, non-religious, nonprofit organization Osservatorio Nessuno spyware vendors, many operating quietly outside public scrutiny. exposed a new spyware called Morpheus, distributed through fake Android apps posing as updates. Once installed, it can steal extensive data from the

📡 Security Affairs · 2026-04-27 LINKEDIN BROWSERGATE BrowserGate is an investigation conducted by Fairlinked (https://browsergate.eu/), an association of commercial LinkedIn users, which documents what it describes as one of the largest data breach and corporate espionage scandals in digital history. The central thesis: every time one of the billions of

📡 Security Affairs · 2026-04-27 Fast16: Pre-Stuxnet malware that targeted precision engineering software SentinelOne uncovered Fast16, a sabotage malware used in 2005, years before Stuxnet. The malicious code is written in Lua and targeted high-precision calculation software, altering results and spreading across systems. The malware appeared in the ShadowBrokers leak of NSA

每日漏洞情报汇总 · 2026-05-22 📊 2026-05-22 漏洞情报日报 📋 共 200 条 🔥 高危/严重 96 条 🚨 CISA-KEV 2 条 💣 Exploit-DB-RSS 5 条 🐙 GitHub-Advisory 67 条 🔥30 🛡️ NVD-Latest 66 条 🔥66 ⚔️ Sploitus 60 条 🤖 今日安全态势分析 🎯 今日重点关注 * CVE-2026-42960 (Unbound DNS 服务器) — DNS缓存投毒：影响NLnet Labs Unbound ≤1.25.0版本。攻击者可利用权威区段的混杂记录投毒DNS缓存，CVSS评分10.0，可导致大规模流量劫持，影响范围广且利用难度低。 * CVE-2026-43633 (HestiaCP 控制面板) — 反序列化导致RCE：

📡 Schneier on Security · 2026-04-27 Italy moves to extradite Chinese national to the U.S. over hacking charges Italy is moving to extradite Xu Zewei, the Chinese national arrested in 2025 at the request of U.S. authorities on cyber-espionage charges, Bloomberg reported. The case stands out because it ties a

📡 Palo Alto Unit42 · 2026-04-23 Frontier AI and the Future of Defense: Your Top Questions Answered Over the last several weeks, Palo Alto Networks and Unit 42 have been talking with CISOs and security leaders globally to discuss the emergence of frontier AI models and their broader implications on cybersecurity. A

📡 Palo Alto Unit42 · 2026-04-20 Fracturing Software Security With Frontier AI Models Introduction Unit 42 recently got hands-on with frontier AI models, and our initial findings indicate a major shift in the speed, scale and capability of AI models to identify software vulnerabilities. We are now seeing the first frontier models

📡 Palo Alto Unit42 · 2026-04-17 Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17) Updates Update April 17, 2026 As of April 17, 2026, Iran has begun restoring limited access to the internet after disconnecting from it for the past 47 days. Iran is limiting domestic access to

📡 Palo Alto Unit42 · 2026-04-06 Understanding Current Threats to Kubernetes Environments CVE-2025-55182 Executive Summary The rapid adoption of container orchestration has positioned Kubernetes as a high-value target for adversaries seeking to compromise enterprise-scale environments. Our telemetry reveals that Kubernetes-related threat actor operations, including stealing Kubernetes tokens, increased 282% over the last