{"fetchedAt":"2026-10-26T15:41:00.962Z","sources":[{"source":"cve","ok":false,"count":0,"ms":5138,"error":"TypeError: fetch failed"},{"source":"ghsa","ok":true,"count":22,"total":60,"ms":1873},{"source":"kev","ok":true,"count":20,"total":1756,"ms":584},{"source":"cn","ok":true,"count":15,"total":241,"ms":564},{"source":"news","ok":true,"count":30,"ms":4500,"feeds":[{"name":"安全客","ok":true,"count":6,"ms":463},{"name":"先知社区","ok":true,"count":6,"ms":1250},{"name":"Seebug Paper","ok":true,"count":6,"ms":4498},{"name":"Krebs on Security","ok":true,"count":6,"ms":1108},{"name":"Schneier on Security","ok":true,"count":6,"ms":1009}]}],"enrich":{"epss":{"ok":true,"count":43,"ms":1423},"poc":{"ok":true,"checked":43,"found":22,"ms":8442,"error":"1 个查询失败"}},"items":[{"source":"ghsa","sourceName":"GitHub Advisory · pip / virtualenv","id":"GHSA-394h-qwmc-48pf","title":"CVE-2026-113718 — virtualenv: Xonsh activation literals depend on the script decoding codec","url":"https://github.com/advisories/GHSA-394h-qwmc-48pf","summary":"## Summary\n\nCaller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment.\n\n## Affected area\n\nXonsh reads a UTF-8 activation script using a legacy multibyte encoding such as GBK. Printable non-ASCII bytes can\nchange how the reader recognizes an adjacent quote. The report concerns POSIX activation. It does not establish exposure\nthrough unrelated activators.\n","severity":"HIGH","publishedAt":"2026-10-23T22:24:43Z","tags":[],"cve":"CVE-2026-113718","seenIn":["ghsa"],"epss":0.00177,"epssPct":0.07252,"priority":49,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / virtualenv","id":"GHSA-6w3r-xr62-4xcp","title":"CVE-2026-113723 — virtualenv: Bash prompt values can change meaning under older compatibility modes","url":"https://github.com/advisories/GHSA-6w3r-xr62-4xcp","summary":"## Summary\n\nCaller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the\nvalue passed to virtualenv, and a user must subsequently activate the environment and draw the prompt.\n\n## Affected area\n\nBash runs with compatibility level 4.2 and draws the environment prompt. Its replacement-string behavior differs from\nnewer compatibility modes, leaving prompt text subject to a second interpretation. The report concerns POSIX activation.\nIt does ","severity":"HIGH","publishedAt":"2026-10-23T22:21:57Z","tags":[],"cve":"CVE-2026-113723","seenIn":["ghsa"],"epss":0.00177,"epssPct":0.07252,"priority":49,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · npm / @azure/msal-node","id":"GHSA-xcx6-jx8p-x3h5","title":"CVE-2026-109461 — MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint","url":"https://github.com/advisories/GHSA-xcx6-jx8p-x3h5","summary":"### Impact\n\nOrigin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth_code flow.\n\n### Patches\n\nVersion 7.1.0 and higher are patched.\n\n### Workarounds\n\nEnsure you pass in only the auth_code to to acquireTokenByCode","severity":"HIGH","publishedAt":"2026-10-23T22:16:44Z","tags":["microsoft"],"cve":"CVE-2026-109461","seenIn":["ghsa"],"epss":0.00361,"epssPct":0.2969,"priority":62,"reasons":["关注厂商：microsoft"]},{"source":"ghsa","sourceName":"GitHub Advisory · npm / undici","id":"GHSA-xjj6-f33q-929c","title":"CVE-2026-109869 — undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","url":"https://github.com/advisories/GHSA-xjj6-f33q-929c","summary":"### Impact\n\nundici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects such responses (a content-encoding limit), but it created the internal response stream before that check and returned without attaching an error listener or aborting the request. The early close then surfaces a content-length mismatch on that orphaned internal stream, which Node.js treats as an ","severity":"HIGH","publishedAt":"2026-10-23T22:14:31Z","tags":[],"cve":"CVE-2026-109869","seenIn":["ghsa"],"epss":0.00344,"epssPct":0.27674,"priority":54,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · npm / multer","id":"GHSA-q7qp-rjg7-q26m","title":"CVE-2026-113872 — multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown","url":"https://github.com/advisories/GHSA-q7qp-rjg7-q26m","summary":"### Impact\n\nWhen `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async `fileFilter` is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled `'error'` event, and the process exits. A single unauthen","severity":"HIGH","publishedAt":"2026-10-23T22:08:22Z","tags":[],"cve":"CVE-2026-113872","seenIn":["ghsa"],"epss":0.00442,"epssPct":0.38118,"poc":{"count":1,"stars":0,"top":[{"name":"santihabib/multer-CVE-2026-113872","url":"https://github.com/santihabib/multer-CVE-2026-113872","stars":0}]},"priority":69,"reasons":["公开 PoC ×1"]},{"source":"ghsa","sourceName":"GitHub Advisory · npm / happy-dom","id":"GHSA-834v-8h66-3h79","title":"CVE-2026-115895 — Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution","url":"https://github.com/advisories/GHSA-834v-8h66-3h79","summary":"## Summary\n\nThe ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolating them into generated JavaScript.\n\nAs a result, an invalid ESM import alias can be transformed into a valid JavaScript destructuring default initializer and executed.\n\nThis appears to be an alternate injection path and incomplete remediation of GHSA-6q6h-j7hj-3r64 / CVE-2026-33943. The previous fix validates `importName` in the local `export { ... }` handler, but the named impo","severity":"HIGH","publishedAt":"2026-10-23T22:06:13Z","tags":["windows","docker"],"cve":"CVE-2026-115895","seenIn":["ghsa"],"epss":0.00367,"epssPct":0.30282,"priority":63,"reasons":["关注厂商：windows、docker"]},{"source":"ghsa","sourceName":"GitHub Advisory · rust / wasmtime","id":"GHSA-897f-g5gm-fmxm","title":"CVE-2026-115889 — Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation","url":"https://github.com/advisories/GHSA-897f-g5gm-fmxm","summary":"## Summary\n\nIn Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can result in silent overflow in release builds, and result in incorrect value references in the IR resulting in arbitrary miscompilation. A very large Wasm function body, or one that is specially crafted to use many SSA values, can use this to force type-confusion or other arbitrary side-effects and escape the sandbox.\n\nCranelift was changed in Wasmtime v43 to use a full `u32` inde","severity":"CRITICAL","publishedAt":"2026-10-23T22:02:20Z","tags":[],"cve":"CVE-2026-115889","seenIn":["ghsa"],"epss":0.00454,"epssPct":0.39155,"priority":69,"reasons":["Critical"]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / filelock","id":"GHSA-v4x8-3wr5-3wq8","title":"CVE-2026-112940 — filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","url":"https://github.com/advisories/GHSA-v4x8-3wr5-3wq8","summary":"`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control. On Linux the lock validates its database through a descriptor (the number the kernel gives a process for an open file). It then connects SQLite to `/proc/self/fd/<n>`, a Linux path that names the process's own open file `n`. SQLite turns that path back into a plain path and reopens it by name, following symlinks (a symlink is a file that points at another path). On every POSIX ","severity":"HIGH","publishedAt":"2026-10-23T21:59:08Z","tags":["windows","linux"],"cve":"CVE-2026-112940","seenIn":["ghsa"],"epss":0.0019,"epssPct":0.08617,"priority":57,"reasons":["关注厂商：windows、linux"]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / pillow","id":"GHSA-5x8w-8jj5-q52h","title":"CVE-2026-112398 — Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","url":"https://github.com/advisories/GHSA-5x8w-8jj5-q52h","summary":"### Credits\n\n**Researcher**: Alex Bouffard (mixbo@pebwalker.com)\n\n### Summary\n\nA heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC","severity":"CRITICAL","publishedAt":"2026-10-23T21:55:21Z","tags":["linux","docker"],"cve":"CVE-2026-112398","seenIn":["ghsa"],"epss":0.0057,"epssPct":0.46943,"poc":{"count":1,"stars":0,"top":[{"name":"mcpmark-eval-liuhezi/security-advisory-research","url":"https://github.com/mcpmark-eval-liuhezi/security-advisory-research","stars":0}]},"priority":91,"reasons":["Critical","公开 PoC ×1","关注厂商：linux、docker"]},{"source":"ghsa","sourceName":"GitHub Advisory · npm / postal-mime","id":"GHSA-f2hq-32vh-53cc","title":"postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words","url":"https://github.com/advisories/GHSA-f2hq-32vh-53cc","summary":"### Impact\n\nDecoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, an","severity":"HIGH","publishedAt":"2026-10-23T21:54:36Z","tags":[],"seenIn":["ghsa"],"priority":47,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · composer / laravel/framework","id":"GHSA-f9x3-7vq9-cph6","title":"CVE-2026-114509 — Laravel TokenGuard authentication bypass through non-string API credentials","url":"https://github.com/advisories/GHSA-f9x3-7vq9-cph6","summary":"Laravel's built-in TokenGuard, **when configured with a standard token-based API guard**, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. \n\n**Under certain database configurations (MySQL/MariaDB)** an attacker can submit a specially crafted, non-string credential value that is mishandled during the authentication lookup, causing the underlying query to match an unintended user record rather than failing authentication as expected.\n\n### Im","severity":"CRITICAL","publishedAt":"2026-10-23T21:50:27Z","tags":[],"cve":"CVE-2026-114509","seenIn":["ghsa"],"epss":0.00696,"epssPct":0.52763,"poc":{"count":5,"stars":11,"top":[{"name":"hakaioffsec/CVE-2026-114509-PoC","url":"https://github.com/hakaioffsec/CVE-2026-114509-PoC","stars":11},{"name":"tajulasri/-CVE-2026-114509-POC","url":"https://github.com/tajulasri/-CVE-2026-114509-POC","stars":1},{"name":"emirwtz/CVE-2026-114509","url":"https://github.com/emirwtz/CVE-2026-114509","stars":1}]},"priority":84,"reasons":["Critical","公开 PoC ×5"]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / vllm","id":"GHSA-gx7p-2j49-hfq4","title":"CVE-2026-114055 — vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)","url":"https://github.com/advisories/GHSA-gx7p-2j49-hfq4","summary":"## Summary\n\nAPI clients can supply arbitrary `mm_processor_kwargs` per request. vLLM\nforwards these values through the multimodal rendering and processing pipeline\nto Hugging Face and custom image/video processor constructors and calls.\nResource-sensitive values such as image size, patch size, patch count, crop\ncount, or frame count can therefore be controlled by a remote client.\n\nFor processors that upscale inputs, a single request can force an allocation\nlarge enough to terminate the API serve","severity":"HIGH","publishedAt":"2026-10-23T20:58:36Z","tags":[],"cve":"CVE-2026-114055","seenIn":["ghsa"],"epss":0.0042,"epssPct":0.36042,"priority":56,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / pypdf","id":"GHSA-6c7f-9265-g8fw","title":"CVE-2026-115572 — pypdf: Possible long runtimes for repeated references to the same missing object","url":"https://github.com/advisories/GHSA-6c7f-9265-g8fw","summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file (like their pages) where the same, but non-existent indirect object is referenced multiple times.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).","severity":"HIGH","publishedAt":"2026-10-23T20:55:15Z","tags":[],"cve":"CVE-2026-115572","seenIn":["ghsa"],"epss":0.00375,"epssPct":0.31232,"priority":55,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / pypdf","id":"GHSA-jr96-gvgh-j3r4","title":"CVE-2026-115585 — pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)","url":"https://github.com/advisories/GHSA-jr96-gvgh-j3r4","summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with repeated malformed cross-reference streams.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4240](https://github.com/py-pdf/pypdf/pull/4240).\n\n### Notes\n\nThis is a follow-up to https://github.com/py-pdf/pypdf/securi","severity":"HIGH","publishedAt":"2026-10-23T20:54:27Z","tags":[],"cve":"CVE-2026-115585","seenIn":["ghsa"],"epss":0.0041,"epssPct":0.34973,"priority":56,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / pypdf","id":"GHSA-gmh7-3g9r-mjh5","title":"CVE-2026-115580 — pypdf: Possible long runtimes for large xref table header limits","url":"https://github.com/advisories/GHSA-gmh7-3g9r-mjh5","summary":"### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires opening a file with large/wrong upper limits in the xref table.\n\n### Patches\n\nThis has been fixed in [pypdf==6.21.2](https://github.com/py-pdf/pypdf/releases/tag/6.21.2).\n\n### Workarounds\n\nIf you cannot upgrade yet, consider applying the changes from PR [#4239](https://github.com/py-pdf/pypdf/pull/4239).","severity":"HIGH","publishedAt":"2026-10-23T20:54:12Z","tags":[],"cve":"CVE-2026-115580","seenIn":["ghsa"],"epss":0.0041,"epssPct":0.34974,"priority":56,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · npm / electron","id":"GHSA-jr5w-w6x2-84p9","title":"CVE-2026-115570 — Electron: Mitigation for compromised eMudhra intermediate certificates","url":"https://github.com/advisories/GHSA-jr5w-w6x2-84p9","summary":"### Impact\n\nA set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.\n\nApps are only affected if they make TLS connections over a network an attacker can intercep","severity":"HIGH","publishedAt":"2026-10-23T20:53:41Z","tags":[],"cve":"CVE-2026-115570","seenIn":["ghsa"],"epss":0.00377,"epssPct":0.31459,"priority":55,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · npm / body-parser","id":"GHSA-27r3-jxmh-p828","title":"CVE-2026-111181 — body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","url":"https://github.com/advisories/GHSA-27r3-jxmh-p828","summary":"### Impact\n\nA single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is r","severity":"HIGH","publishedAt":"2026-10-23T20:53:11Z","tags":[],"cve":"CVE-2026-111181","seenIn":["ghsa"],"epss":0.00388,"epssPct":0.32652,"priority":55,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · rust / gix","id":"GHSA-q54r-jf2p-rfr2","title":"gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()","url":"https://github.com/advisories/GHSA-q54r-jf2p-rfr2","summary":"## Summary\n\nIn the `gix` crate, `Cache::protect_options()` in `gix/src/config/cache/access.rs` reads the three filesystem path-protection settings (`core.protectHFS`, `core.protectNTFS`, and `gitoxide.core.protectWindows`) with the unfiltered `gix_config::File::boolean()` accessor instead of the trust-aware `boolean_filter()` accessor used by every other security-critical config read in the same file. When a repository is opened with reduced trust (an ownership mismatch, which maps `.git/config`","severity":"HIGH","publishedAt":"2026-10-23T20:52:28Z","tags":["windows"],"seenIn":["ghsa"],"priority":55,"reasons":["关注厂商：windows"]},{"source":"ghsa","sourceName":"GitHub Advisory · go / github.com/labstack/echo/v4","id":"GHSA-9969-6676-49h5","title":"Echo: WebSocket proxy can retain connections and handlers after client disconnect","url":"https://github.com/advisories/GHSA-9969-6676-49h5","summary":"## Impact\n\nEcho's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior.\n\nRepeated connections can accumulate resources and cause denial of service. The impact depends on the prox","severity":"HIGH","publishedAt":"2026-10-23T20:50:17Z","tags":[],"seenIn":["ghsa"],"priority":47,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · go / github.com/labstack/echo/v4","id":"GHSA-h7wr-284f-5qvc","title":"Echo: Decompress permits unbounded gzip expansion in v4","url":"https://github.com/advisories/GHSA-h7wr-284f-5qvc","summary":"## Impact\n\nEcho v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded size. A small compressed request could therefore produce a very large decoded body. Handlers that read or bind that body could consume excessive memory or CPU, and repeated or concurrent requests could cause denial of service.\n\nThe middleware is not enabled by default. A limit on the compressed request size alone does not bound the decompressed size. Applications that already app","severity":"HIGH","publishedAt":"2026-10-23T20:49:49Z","tags":[],"seenIn":["ghsa"],"priority":47,"reasons":[]},{"source":"ghsa","sourceName":"GitHub Advisory · go / github.com/labstack/echo/v4","id":"GHSA-cxf3-9h37-7rr8","title":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls","url":"https://github.com/advisories/GHSA-cxf3-9h37-7rr8","summary":"## Impact\n\nEcho's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.\n\nThis can bypass authentication or authorization enforced only at Echo's routes. Exploitation ","severity":"CRITICAL","publishedAt":"2026-10-23T20:49:37Z","tags":[],"seenIn":["ghsa"],"priority":59,"reasons":["Critical"]},{"source":"ghsa","sourceName":"GitHub Advisory · go / github.com/labstack/echo/v4","id":"GHSA-f48p-c9v4-h7xv","title":"Echo: BodyDump captures request and response bodies without size limits in v4","url":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","summary":"## Impact\n\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.\n\nRepeated or concurrent requests can exhaust process memory and cause denial of se","severity":"HIGH","publishedAt":"2026-10-23T20:48:44Z","tags":[],"seenIn":["ghsa"],"priority":47,"reasons":[]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-114625","title":"CVE-2026-114625 — Arista VeloCloud Orchestrator SQL Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114625","summary":"Arista VeloCloud Orchestrator: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.","severity":"在野利用","publishedAt":"2026-10-23","tags":["arista"],"cve":"CVE-2026-114625","dueDate":"2026-10-26","ransomware":false,"seenIn":["kev"],"epss":0.01025,"epssPct":0.63335,"kevDueDays":0,"priority":91,"reasons":["在野利用"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-110447","title":"CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","summary":"Collabora Collabora Online – Built-in CODE Server: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","severity":"在野利用","publishedAt":"2026-10-23","tags":["collabora"],"cve":"CVE-2026-110447","dueDate":"2026-10-26","ransomware":false,"seenIn":["kev"],"epss":0.12328,"epssPct":0.96165,"poc":{"count":1,"stars":0,"top":[{"name":"adriyansyah-mf/cve-2026-110447","url":"https://github.com/adriyansyah-mf/cve-2026-110447","stars":0}]},"kevDueDays":0,"priority":111,"reasons":["在野利用","EPSS 12%","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-106931","title":"CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106931","summary":"EG Secure Solutions SiteGuard Server Edition: EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","severity":"在野利用","publishedAt":"2026-10-20","tags":["eg secure solutions"],"cve":"CVE-2026-106931","dueDate":"2026-10-23","ransomware":false,"seenIn":["kev"],"epss":0.02528,"epssPct":0.84783,"kevDueDays":-3,"priority":96,"reasons":["在野利用"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-96656","title":"CVE-2026-96656 — Plex Media Server External Control of File Name or Path Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96656","summary":"Plex Media Server: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","severity":"在野利用","publishedAt":"2026-10-20","tags":["plex"],"cve":"CVE-2026-96656","dueDate":"2026-10-23","ransomware":false,"seenIn":["kev"],"epss":0.01785,"epssPct":0.78151,"poc":{"count":1,"stars":0,"top":[{"name":"a3igner/plex-codec-cache-implant","url":"https://github.com/a3igner/plex-codec-cache-implant","stars":0}]},"kevDueDays":-3,"priority":107,"reasons":["在野利用","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-96655","title":"CVE-2026-96655 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96655","summary":"Plex Media Server: Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.","severity":"在野利用","publishedAt":"2026-10-20","tags":["plex"],"cve":"CVE-2026-96655","dueDate":"2026-11-03","ransomware":false,"seenIn":["kev"],"epss":0.01637,"epssPct":0.76169,"kevDueDays":8,"priority":94,"reasons":["在野利用"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-96654","title":"CVE-2026-96654 — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96654","summary":"Plex Media Server: Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.","severity":"在野利用","publishedAt":"2026-10-20","tags":["plex"],"cve":"CVE-2026-96654","dueDate":"2026-10-23","ransomware":false,"seenIn":["kev"],"epss":0.01949,"epssPct":0.80079,"kevDueDays":-3,"priority":95,"reasons":["在野利用"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-96652","title":"CVE-2026-96652 — Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96652","summary":"Plex Media Server: Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. ","severity":"在野利用","publishedAt":"2026-10-20","tags":["plex"],"cve":"CVE-2026-96652","dueDate":"2026-11-03","ransomware":false,"seenIn":["kev"],"epss":0.01821,"epssPct":0.78606,"poc":{"count":6,"stars":100,"top":[{"name":"code-zm/plex2shell","url":"https://github.com/code-zm/plex2shell","stars":100},{"name":"ChrisLPJones/plex2shell-check","url":"https://github.com/ChrisLPJones/plex2shell-check","stars":1},{"name":"gmh5225/plex2shell","url":"https://github.com/gmh5225/plex2shell","stars":0}]},"kevDueDays":8,"priority":107,"reasons":["在野利用","公开 PoC ×6"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-110936","title":"CVE-2026-110936 — Siemens Software Center Uncontrolled Search Path Element Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110936","summary":"Siemens Software Center: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.","severity":"在野利用","publishedAt":"2026-10-20","tags":["siemens"],"cve":"CVE-2026-110936","dueDate":"2026-11-03","ransomware":false,"seenIn":["kev"],"epss":0.00967,"epssPct":0.615,"poc":{"count":1,"stars":0,"top":[{"name":"DAS-Bodhi/CVE-2026-110936-Siemens-Attack","url":"https://github.com/DAS-Bodhi/CVE-2026-110936-Siemens-Attack","stars":0}]},"kevDueDays":8,"priority":102,"reasons":["在野利用","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-102764","title":"CVE-2026-102764 — BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102764","summary":"BeyondTrust Remote Support: BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.","severity":"在野利用","publishedAt":"2026-10-16","tags":["beyondtrust"],"cve":"CVE-2026-102764","dueDate":"2026-10-19","ransomware":false,"seenIn":["kev"],"epss":0.20341,"epssPct":0.97462,"poc":{"count":3,"stars":3,"top":[{"name":"Worthes/CVE-2026-102764-Proof-of-concept","url":"https://github.com/Worthes/CVE-2026-102764-Proof-of-concept","stars":3},{"name":"maxprog-svg/CVE-2026-102764","url":"https://github.com/maxprog-svg/CVE-2026-102764","stars":0},{"name":"CompleTetech-Security/beyondtrust-remote-support-cve-2026-102764-check","url":"https://github.com/CompleTetech-Security/beyondtrust-remote-support-cve-2026-102764-check","stars":0}]},"kevDueDays":-7,"priority":106,"reasons":["在野利用","EPSS 20%","公开 PoC ×3"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2025-61624","title":"CVE-2025-61624 — Fortinet Multiple Products Path Traversal Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61624","summary":"Fortinet Multiple Products: FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","severity":"在野利用","publishedAt":"2026-10-16","tags":["fortinet"],"cve":"CVE-2025-61624","dueDate":"2026-10-19","ransomware":false,"seenIn":["kev"],"epss":0.01343,"epssPct":0.71162,"kevDueDays":-7,"priority":88,"reasons":["在野利用"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-21589","title":"CVE-2026-21589 — Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21589","summary":"Atlassian Multiple Products: Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.","severity":"在野利用","publishedAt":"2026-10-15","tags":["atlassian"],"cve":"CVE-2026-21589","dueDate":"2026-10-18","ransomware":false,"seenIn":["kev"],"epss":0.99477,"epssPct":0.99943,"poc":{"count":13,"stars":15,"top":[{"name":"watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","url":"https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","stars":15},{"name":"tc4dy/CVE-2026-21589-PoC-Exploit","url":"https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit","stars":11},{"name":"MarcusProgram/CVE-2026-21589","url":"https://github.com/MarcusProgram/CVE-2026-21589","stars":9}]},"kevDueDays":-8,"priority":107,"reasons":["在野利用","EPSS 99%","公开 PoC ×13"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-105134","title":"CVE-2026-105134 — Ahsay AhsayCBS Command Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105134","summary":"Ahsay AhsayCBS: Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.","severity":"在野利用","publishedAt":"2026-10-14","tags":["ahsay"],"cve":"CVE-2026-105134","dueDate":"2026-10-17","ransomware":false,"seenIn":["kev"],"epss":0.86266,"epssPct":0.99731,"poc":{"count":1,"stars":0,"top":[{"name":"RayanAlmulhim/CVE-2026-105134-lab","url":"https://github.com/RayanAlmulhim/CVE-2026-105134-lab","stars":0}]},"kevDueDays":-9,"priority":107,"reasons":["在野利用","EPSS 86%","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-76519","title":"CVE-2026-76519 — Cisco Secure Email Gateway Relative Path Traversal Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76519","summary":"Cisco Secure Email Gateway: Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.","severity":"在野利用","publishedAt":"2026-10-14","tags":["cisco"],"cve":"CVE-2026-76519","dueDate":"2026-10-17","ransomware":false,"seenIn":["kev"],"epss":0.02152,"epssPct":0.82022,"poc":{"count":1,"stars":0,"top":[{"name":"Mickysalivan/CVE-2026-76519-Proof-of-concept","url":"https://github.com/Mickysalivan/CVE-2026-76519-Proof-of-concept","stars":0}]},"kevDueDays":-9,"priority":103,"reasons":["在野利用","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-105133","title":"CVE-2026-105133 — Ahsay AhsayCBS Improper Authentication Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105133","summary":"Ahsay AhsayCBS: Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.","severity":"在野利用","publishedAt":"2026-10-14","tags":["ahsay"],"cve":"CVE-2026-105133","dueDate":"2026-10-17","ransomware":false,"seenIn":["kev"],"epss":0.79236,"epssPct":0.99596,"poc":{"count":1,"stars":4,"top":[{"name":"horizon3ai/AhsayCBS-Auth-Bypass-RCE","url":"https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE","stars":4}]},"kevDueDays":-9,"priority":107,"reasons":["在野利用","EPSS 79%","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-0322","title":"CVE-2026-0322 — Palo Alto Networks PAN-OS Code Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0322","summary":"Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","severity":"在野利用","publishedAt":"2026-10-14","tags":["palo alto networks"],"cve":"CVE-2026-0322","dueDate":"2026-10-17","ransomware":false,"seenIn":["kev"],"epss":0.0174,"epssPct":0.77566,"poc":{"count":1,"stars":0,"top":[{"name":"Ife-ella/CVE-vulnerability","url":"https://github.com/Ife-ella/CVE-vulnerability","stars":0}]},"kevDueDays":-9,"priority":101,"reasons":["在野利用","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-104935","title":"CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","summary":"Ivanti Connect Secure: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","severity":"在野利用","publishedAt":"2026-10-13","tags":["ivanti"],"cve":"CVE-2026-104935","dueDate":"2026-10-16","ransomware":false,"seenIn":["kev","cn"],"epss":0.86766,"epssPct":0.9974,"poc":{"count":5,"stars":1,"top":[{"name":"ApexBreach/CVE-2026-104935-Proof-of-concept","url":"https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept","stars":1},{"name":"0x45dd/ivanti-cve-2026-104935-check","url":"https://github.com/0x45dd/ivanti-cve-2026-104935-check","stars":1},{"name":"maxprog-svg/CVE-2026-104935","url":"https://github.com/maxprog-svg/CVE-2026-104935","stars":0}]},"kevDueDays":-10,"priority":119,"reasons":["在野利用","EPSS 87%","公开 PoC ×5","多源印证（长亭）"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-96951","title":"CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96951","summary":"Microsoft Windows: Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","severity":"在野利用","publishedAt":"2026-10-13","tags":["microsoft"],"cve":"CVE-2026-96951","dueDate":"2026-10-16","ransomware":false,"seenIn":["kev"],"epss":0.09813,"epssPct":0.95516,"kevDueDays":-10,"priority":94,"reasons":["在野利用","EPSS 前 4.5%"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2015-5477","title":"CVE-2015-5477 —  ISC BIND Data Processing Errors Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5477","summary":"ISC BIND: ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","severity":"在野利用","publishedAt":"2026-10-08","tags":["isc"],"cve":"CVE-2015-5477","dueDate":"2026-10-11","ransomware":false,"seenIn":["kev"],"epss":0.99584,"epssPct":0.99946,"poc":{"count":7,"stars":64,"top":[{"name":"robertdavidgraham/cve-2015-5477","url":"https://github.com/robertdavidgraham/cve-2015-5477","stars":64},{"name":"elceef/tkeypoc","url":"https://github.com/elceef/tkeypoc","stars":14},{"name":"hmlio/vaas-cve-2015-5477","url":"https://github.com/hmlio/vaas-cve-2015-5477","stars":1}]},"kevDueDays":-15,"priority":107,"reasons":["在野利用","EPSS 100%","公开 PoC ×7"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2016-3081","title":"CVE-2016-3081 — Apache Struts Command Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3081","summary":"Apache Struts: Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","severity":"在野利用","publishedAt":"2026-10-08","tags":["apache"],"cve":"CVE-2016-3081","dueDate":"2026-10-11","ransomware":false,"seenIn":["kev"],"epss":0.96525,"epssPct":0.99881,"kevDueDays":-15,"priority":95,"reasons":["在野利用","EPSS 97%"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2023-22894","title":"CVE-2023-22894 — Strapi Cleartext Storage of Sensitive Information Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22894","summary":"Strapi Strapi: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution. ","severity":"在野利用","publishedAt":"2026-10-08","tags":["strapi"],"cve":"CVE-2023-22894","dueDate":"2026-10-11","ransomware":false,"seenIn":["kev"],"epss":0.04114,"epssPct":0.90709,"poc":{"count":2,"stars":13,"top":[{"name":"Saboor-Hakimi/CVE-2023-22894","url":"https://github.com/Saboor-Hakimi/CVE-2023-22894","stars":13},{"name":"maxntv/CVE-2023-22894-PoC","url":"https://github.com/maxntv/CVE-2023-22894-PoC","stars":0}]},"kevDueDays":-15,"priority":105,"reasons":["在野利用","公开 PoC ×2"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-6017798","title":"PHP 远程代码执行漏洞（php2shell，CVE-2026-109618/CVE-2026-109619）","url":"https://stack.chaitin.com/vuldb/detail/f2ae35f3-30ef-4b87-8000-3f437652f8d2","summary":"PHP 是一种广泛使用的开源服务器端脚本语言，通常以 PHP-FPM、CGI 或 Apache 模块（mod_php）方式部署，是 WordPress、Drupal、Laravel、Symfony、Magento 等主流框架与建站系统，以及大量 Web 应用、共享主机和控制面板的常见运行环境。\n\n2026 年 10 月，长亭安全应急响应中心监测到 PHP Core 的 session 上传进度（session.upload_progress，rfc1867 回调）处理机制存在内存破坏缺陷，公开讨论中以 php2shell 指代该组漏洞，对应 CVE-2026-109618 与 CVE-2026-109619，官方评级均为 CVSS v4.0 9.2（严重）。攻击者可通过构造特制的 multipart/form-data 请求破坏 PHP 进程内存，进而可能导致远程代码执行。\n\n长亭已在实验","severity":"CRITICAL","publishedAt":"2026-10-21","cve":"CVE-2026-109618","fixSteps":"一、升级修复方案\nPHP 官方计划于 2026 年 10 月 21 日 14:00 UTC 发布安全更新，修复版本以官方发布为准（https://www.php.net/archive/2026.php）。补丁发布后应优先升级互联网暴露的 Web 服务器、共享主机及控制面板/CMS 环境，并同步确认 Linux 发行版与主机商提供的回溯更新；PHP 8.1 及更早版本已停止支持，应尽快迁移或下线隔离。\n\n二、临时缓解方案\n以下措施为应急临时方案，可能影响业务功能，升级完成后应及时评估是否保留：\n1、若业务不使用上传进度条，在 php.ini、.user.ini 或 .htaccess 中设置 session.upload_progress.enabled = Off，并重载 PHP-FPM 或 Web 服务器，切断已确认的中途会话生命周期路径；\n2、在 WAF、反向代理或网关层收紧对 multipart/form-data 请求的检查与速率限制，重点保护不需要文件上传的业务端点；\n3、启用 session.use_strict_mode = 1，避免接受攻击者指定的任意会话 ID；审计会话包装类与自定义 save handler 的重入风险；\n4、审计应用代码，避免在 __destruct、__wakeup 等析构路径中调用 session_destroy()、session_write_close() 等会话 API；\n5、对 PHP 8.1 及更早的停止支持版本，采取下线、网络隔离、VPN 或白名单访问等措施，直至完成迁移。\n\n三、资产排查与失陷排查\n1、清点互联网与内网暴露的 PHP 服务，记录 PHP 版本、运行方式（mod_php / PHP-FPM / CGI）、session.upload_progress 与 session.use_strict_mode ","tags":["apache"],"lang":"zh","seenIn":["cn","news"],"epss":0.99981,"epssPct":0.99981,"poc":{"count":682,"stars":1822,"top":[{"name":"ikow/php2shell-poc","url":"https://github.com/ikow/php2shell-poc","stars":1822},{"name":"eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","stars":1017},{"name":"assetnote/php2shell-scanner","url":"https://github.com/assetnote/php2shell-scanner","stars":923}]},"priority":116,"reasons":["Critical","EPSS 100%","公开 PoC ×682","多源印证（资讯）","关注厂商：apache"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5875684","title":"GitLab 未认证远程代码执行漏洞（CVE-2026-97229）","url":"https://stack.chaitin.com/vuldb/detail/430cb323-5614-454f-b264-417ba1a9f3f3","summary":"GitLab 是一体化 DevOps 平台，提供代码托管、代码审查、持续集成与持续交付（CI/CD）、制品管理等能力，广泛用于企业内部的软件研发与交付流程，支持自建部署（CE/EE）与云端托管（GitLab.com）等多种形态。\n\n2026 年 10 月，长亭安全应急响应中心监测到 GitLab CE/EE 的 CI/CD 正则表达式编译器存在整数溢出风险（CVE-2026-97229）。攻击者可借助公开可访问的 CI/CD 配置校验入口，以不携带任何凭据的网络请求触发该缺陷，导致 GitLab 服务端进程以 git 账号身份执行任意命令，可能造成服务器被完全控制以及源码、CI/CD 凭据泄露。\n\n长亭安全应急响应中心已完成复现验证。截至通告发布，官方已发布修复版本，GitLab.com 已完成修复；建议自建 GitLab CE/EE 用户尽快确认版本并按官方指引升级。","severity":"CRITICAL","publishedAt":"2026-10-13","cve":"CVE-2026-97229","fixSteps":"一、升级修复方案\n官方已发布修复版本，建议受影响用户尽快升级至 GitLab CE/EE 19.2.8、19.3.5、19.4.2 或更高版本。GitLab.com 已完成修复，GitLab Dedicated 用户无需操作。自建实例请按官方补丁发布说明执行升级，并确认随包 Ruby 组件已同步更新；升级前建议做好数据备份与变更窗口安排。\n官方补丁公告：https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/\n\n二、临时缓解方案\n以下方案为应急临时措施，可能影响业务功能，升级完成后应及时移除：\n1、限制匿名用户访问公开项目；\n2、禁止不受信任的用户创建或写入公开项目，以降低已公开利用路径的暴露面。\n上述措施仅针对当前已知的投递路径，不能替代版本升级，也无法修复存在缺陷的正则编译器。","tags":[],"lang":"zh","seenIn":["cn"],"epss":0.18427,"epssPct":0.97216,"poc":{"count":2,"stars":0,"top":[{"name":"AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE","url":"https://github.com/AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE","stars":0},{"name":"gandli/cve-2026-97229-lab","url":"https://github.com/gandli/cve-2026-97229-lab","stars":0}]},"priority":90,"reasons":["Critical","EPSS 18%","公开 PoC ×2"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5882549","title":"Ivanti Connect Secure 未认证远程代码执行与提权漏洞链（CVE-2026-104935）","url":"https://stack.chaitin.com/vuldb/detail/deefeedd-b351-4ac2-87c3-6a3e91d4b1f4","summary":"Ivanti Connect Secure 是一款远程接入（VPN）安全网关产品，用于为员工与外部用户提供加密的远程访问通道，并承担接入侧的身份认证职责，广泛部署在企业内网边界，作为访问内部业务系统的统一入口。\n\n2026 年 10 月，长亭安全应急响应中心监测到 Ivanti Connect Secure 存在认证绕过与远程代码执行风险（CVE-2026-104935）。攻击者无需有效账号即可绕过身份认证，在设备上执行任意代码，并可进一步将权限提升至 root；公开信息显示相关漏洞链已被用于在野攻击，攻击活动主要围绕凭据窃取、目录服务信息收集、流量嗅探与日志清理展开。\n\n长亭安全应急响应中心已完成复现验证。截至通告发布，Ivanti 已针对 CVE-2026-104935 发布修复版本，权限提升组件将在后续版本中修复；建议使用受影响版本的用户尽快确认资产暴露面并完成升级。","severity":"HIGH","publishedAt":"2026-10-13","cve":"CVE-2026-104935","fixSteps":"一、升级修复方案\n截至通告发布，Ivanti 已发布针对 CVE-2026-104935 的修复版本，建议受影响用户升级至对应分支的安全版本或更高版本：\n22.8.X 分支：升级至 22.8R2.5；\n25.1.1.1（ISA6000、ISA8000 硬件平台）：升级至 25.1.1.2；\n25.1.2.2 及更早版本：升级至 25.1.3.0 或 25.1.3.1。\n运行 22.7.X 及更早版本的用户不受该漏洞影响。升级至 25.1.3.0 需要配套的 ISA4500、ISA6500 或 ISA8500 硬件，或使用新模板重建虚拟化、云环境设备；暂不具备迁移条件的用户，可先升级至 22.8R2.5 或 25.1.1.2 作为过渡。\n需要说明的是，利用链中的权限提升组件为独立漏洞，截至通告发布官方仍在修复中，将在后续版本中提供修复。\n官方安全公告与升级指引：https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US\n\n二、临时缓解方案\n以下措施为应急临时方案，可能影响业务功能，升级完成后应及时移除：\n1、尽可能收敛网络暴露面，限制对设备管理接口与网关接口的访问，仅放通必要的可信来源；\n2、在实施变更前保留设备日志与系统镜像，避免证据丢失；\n3、加强对设备异常行为的监测，重点关注源自 VPN 设备的横向移动迹象与异常认证请求；\n4、由于本次利用以内存操作为主，设备自带完整性检查工具可能无法发现痕迹；怀疑设备已被入侵时，应开展网络与内存取证，并按官方恢复指引处置。","tags":[],"lang":"zh","seenIn":["cn","kev"],"epss":0.86766,"epssPct":0.9974,"poc":{"count":5,"stars":1,"top":[{"name":"ApexBreach/CVE-2026-104935-Proof-of-concept","url":"https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept","stars":1},{"name":"0x45dd/ivanti-cve-2026-104935-check","url":"https://github.com/0x45dd/ivanti-cve-2026-104935-check","stars":1},{"name":"maxprog-svg/CVE-2026-104935","url":"https://github.com/maxprog-svg/CVE-2026-104935","stars":0}]},"priority":91,"reasons":["EPSS 87%","公开 PoC ×5","多源印证（CISA KEV）"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5747283","title":"Citrix NetScaler 命令注入漏洞（CVE-2026-88771）","url":"https://stack.chaitin.com/vuldb/detail/1d7327ec-b8ef-4f81-bd97-3910f27fbf15","summary":"Citrix NetScaler ADC 与 Citrix NetScaler Gateway 是面向企业网络的应用交付控制器和远程接入网关，主要用于负载均衡、SSL 卸载、身份认证和 VPN 远程访问，广泛部署于大型政企网络边缘，作为内部应用与远程办公的入口。2026 年 9 月，长亭安全应急响应中心监测到 Citrix NetScaler ADC 与 NetScaler Gateway 未授权命令注入漏洞（CVE-2026-88771）。攻击者无需登录即可通过网络请求触发该漏洞，可在设备上执行任意命令。截至通告发布，官方已发布修复版本，公开信息显示该漏洞已被在野利用，且相关利用代码已经公开。建议受影响用户立即升级至官方安全版本，并在升级前评估设备是否已被入侵。受影响版本：NetScaler ADC / NetScaler Gateway 14.1 低于 14.1-73.37、13.1 ","severity":"CRITICAL","publishedAt":"2026-09-27","cve":"CVE-2026-88771","fixSteps":"一、升级修复方案\n建议尽快将 Citrix NetScaler ADC 与 Citrix NetScaler Gateway 升级至以下官方安全版本或更高版本：\nCitrix NetScaler ADC 与 Citrix NetScaler Gateway 14.1：升级至 14.1-73.37 及后续版本；\nCitrix NetScaler ADC 与 Citrix NetScaler Gateway 13.1：升级至 13.1-64.23 及后续 13.1 版本；\nCitrix NetScaler ADC 14.1-FIPS：升级至 14.1-73.37 FIPS 及后续 14.1-FIPS 版本；\nCitrix NetScaler ADC 13.1-FIPS 与 13.1-NDcPP：升级至 13.1-37.279 及后续版本。\n下载链接：https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n采用 NetScaler 实例的 Secure Private Access 混合部署同样需要升级至上述安全版本。本修复适用于客户自管设备；Citrix 托管云服务由厂商自行更新。官方建议在升级前检查设备是否已被入侵，并保存日志、快照等取证材料。\n\n二、临时缓解方案\n截至通告发布，官方未针对 CVE-2026-88771 提供可替代升级的临时缓解方案。无法立即完成升级的用户，应尽快限制相关设备的互联网暴露与管理面访问，并按官方指引评估失陷风险、保存取证材料。上述措施可能影响远程接入等业务功能，升级完成后应及时恢复必要访问。该措施不能替代升级。\n\n三、资产排查与失陷排查\n排查互联网及内网中暴露的 Citrix NetScaler ADC / NetScaler Gateway","tags":[],"lang":"zh","seenIn":["cn"],"epss":0.8216,"epssPct":0.99652,"poc":{"count":12,"stars":22,"top":[{"name":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","stars":22},{"name":"ThomasPoppelgaard/netscaler-ctx697096-checker","url":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker","stars":20},{"name":"technion/netscaler_scanner","url":"https://github.com/technion/netscaler_scanner","stars":1}]},"priority":91,"reasons":["Critical","EPSS 82%","公开 PoC ×12"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5579466","title":"GitLab 路径遍历漏洞（CVE-2026-85706）","url":"https://stack.chaitin.com/vuldb/detail/f0f63289-4a64-41e6-bd33-51d59447ab68","summary":"GitLab 是开源的 DevOps 平台，提供代码托管、持续集成与交付、缺陷跟踪等能力，广泛应用于企业自建代码仓库与软件交付流水线。2026 年 9 月 10 日，长亭安全应急响应中心监测到 GitLab 仓库提交记录 API 路径遍历漏洞（CVE-2026-85706）风险。攻击者无需登录，在目标实例存在可匿名访问的公开项目时，即可读取 GitLab 服务器上的任意文件，可能造成源代码、配置文件与凭证等敏感信息泄露。长亭安全应急响应中心已完成复现验证。截至通告发布，官方已发布修复版本，暂未发现公开利用代码。建议所有受影响的自建 GitLab 实例立即升级。","severity":"HIGH","publishedAt":"2026-09-12","cve":"CVE-2026-85706","fixSteps":"升级修复方案：\n建议将 GitLab CE/EE 升级至 19.1.8、19.2.6 或 19.3.2 及对应更高修复版本。GitLab.com 已运行修复版本，GitLab Dedicated 用户无需操作。自建实例请参考官方升级文档完成升级：\nhttps://docs.gitlab.com/update/\n官方补丁公告：\nhttps://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/\n\n临时缓解方案：\n截至通告发布，官方未提供除升级外的临时缓解方案。以下方案为应急临时措施，可能影响业务功能，升级完成后应及时移除。\n方案一：限制公网暴露\n将自建 GitLab 实例限制在可信网络内访问，避免对公网暴露管理入口与 API。\n方案二：限制匿名读取\n限制匿名用户对代码仓库的读取权限，降低未授权访问触发该漏洞的风险。","tags":[],"lang":"zh","seenIn":["cn"],"epss":0.97355,"epssPct":0.99897,"poc":{"count":13,"stars":44,"top":[{"name":"guneykabel/cve-2026-85706","url":"https://github.com/guneykabel/cve-2026-85706","stars":44},{"name":"EQSTLab/CVE-2026-85706","url":"https://github.com/EQSTLab/CVE-2026-85706","stars":29},{"name":"ynsmroztas/GitLabSniper","url":"https://github.com/ynsmroztas/GitLabSniper","stars":9}]},"priority":79,"reasons":["EPSS 97%","公开 PoC ×13"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5519106","title":"积木报表 H2 JDBC 黑名单绕过致命令执行漏洞","url":"https://stack.chaitin.com/vuldb/detail/9a847a87-f7ad-4f5a-b514-2756195d7b40","summary":"JimuReport 是一款开源低代码报表工具。最新版v2.5.2及之前版本在处理用户可控的 H2 JDBC URL 时存在远程代码执行漏洞：其 JDBC URL 安全过滤函数使用 `String.toLowerCase()`（Unicode 感知）将整个 URL 转小写后，再匹配黑名单关键字 `init=`、`runscript`。 由于H2 驱动解析 JDBC URL 中的设置项与与 SQL 命令时，，使用 `org.h2.util.StringUtils.toUpperEnglish()`，其内部实际调用的是 `String.toUpperCase(Locale.ENGLISH)`（Unicode 感知的英文大写归一化），而非 ASCII-only 处理。二者对 Unicode 字符 `ı`（U+0131，LATIN SMALL LETTER DOTLESS I）的大小写映射不对称，","severity":"HIGH","publishedAt":"2026-09-05","fixSteps":"1、官方目前暂未发布安全补丁，发布后升级到官方修复版本。\n2、立即更改默认 PRINT_PLUGIN_SIGN_SECRET，避免攻击者伪造 X-Sign。","tags":[],"lang":"zh","seenIn":["cn"],"priority":42,"reasons":[]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5498838","title":"Proxmox VE身份认证绕过漏洞","url":"https://stack.chaitin.com/vuldb/detail/7a5ace07-85aa-4720-967b-8db1e476c281","summary":"Proxmox VE 的 libpve-access-control 组件存在身份认证绕过漏洞。攻击者向 API 登录接口提交特制的 tfa-challenge 参数，可绕过密码验证，直接以未启用双因素认证（2FA）的现有用户身份登录，默认影响高权限的 root@pam 账户。","severity":"HIGH","publishedAt":"2026-09-03","fixSteps":"临时解决方案：\n在确保业务不受影响的前提下，通过防火墙或反向代理规则，暂时拦截对 Proxmox VE 管理端口（默认 8006）上 /api2/json/access/ticket 接口的访问请求，仅允许可信管理 IP 访问。\n\n正式解决方案：\n将 libpve-access-control 软件包升级至 8.0.4 或更高版本。对于整体环境，建议将 Proxmox VE 7.x 及初始 8.0 版本升级至当前受支持的 8.x 或 9.x 最新版本。\n\n软件包下载与升级指导：https://www.proxmox.com/en/downloads/proxmox-virtual-environment/\n官方安全公告：https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929","tags":[],"lang":"zh","seenIn":["cn"],"priority":42,"reasons":[]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5484253","title":"YonBIP产品的cas未授权访问漏洞","url":"https://stack.chaitin.com/vuldb/detail/2d39959b-1e50-4193-8f58-6867b2e0a9f9","summary":"用友YonBIP旗舰版友户通CAS接口存在用户认证逻辑绕过漏洞。攻击者可利用该漏洞绕过认证机制，直接登录任意账户，导致系统权限失控，存在数据泄露、篡改及业务中断等严重风险。","severity":"HIGH","publishedAt":"2026-09-01","fixSteps":"临时缓解措施：\n在确保业务不受影响的前提下，暂时拦截对 /cas/exclusive/genLoginTokenByUserCodeLimitIp 接口的访问请求。\n限制访问来源地址，如非必要，不要将系统开放在互联网上。\n\n升级修复方案：\n升级补丁至最新版本，下载地址：https://security.yonyou.com/#/noticeInfo?id=814","tags":[],"lang":"zh","seenIn":["cn"],"priority":42,"reasons":[]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5462669","title":"Nacos 3.0.0至3.2.3 管理接口鉴权作用域错误致未授权访问漏洞","url":"https://stack.chaitin.com/vuldb/detail/a606f78c-b075-48fd-9ac8-aa33413bca0c","summary":"Nacos 是开源的动态服务发现、服务配置和服务管理平台，常用于微服务与云原生应用的注册发现、配置管理和流量治理。2026年8月28日，长亭安全应急响应中心监测到 Nacos 3.x 存在管理接口权限绕过漏洞。Nacos 3.x 对不同类型接口采用分层鉴权，部分管理接口的鉴权范围配置不一致，在特定默认配置下未能进入预期的管理权限校验流程，形成管理接口权限绕过。未携带有效凭证的请求可能访问部分账户、角色及资源权限管理功能；验证中观察到，相关功能可被用于创建账户、调整角色及授予资源权限。攻击者无需有效凭证即可访问部分管理功能，未授权执行账户、角色及资源权限相关操作，可能形成持久化后门并影响配置与服务管理。官方已发布 Nacos 3.2.4 修复版本。","severity":"HIGH","publishedAt":"2026-08-28","fixSteps":"升级修复方案：\n建议升级至 Nacos 3.2.4 及以上版本进行修复。升级完成后应复核用户、角色、资源权限、管理员账户及访问令牌；如暂时无法升级，应先采取下方临时缓解措施。\n临时缓解方案：\n1. 在安全组或防火墙中，将 8848、9848、9849 及控制台端口限制为可信网段访问，关闭公网暴露。\n2. 暂不能升级时，将 nacos.core.auth.enabled 设置为 true，并配置长度不少于 32 字节的随机 nacos.core.auth.plugin.nacos.token.secret.key；集群节点保持一致，重启后灰度验证客户端。\n3. 排查用户、角色和资源权限记录，删除异常账户、回收异常授权，并轮换管理员密码和访问令牌。\n上述措施可能影响配置拉取和服务发现，请先验证业务兼容性；临时措施不能替代升级。","tags":[],"lang":"zh","seenIn":["cn"],"priority":42,"reasons":[]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5470101","title":"JFrog 权限绕过漏洞","url":"https://stack.chaitin.com/vuldb/detail/26065ec7-d174-4899-a3f3-71abb9923595","summary":"JFrog 在默认配置下存在认证绕过漏洞（CVE-2026-82329，CVSS 9.8）。Access 组件将空白 join key 纳入可信集合，未认证攻击者可伪造 HS256 JWT，向无需登录的集群加入接口 POST /access/api/v1/registry/join 换取 scp=admin 的 SERVICE token，并进一步兑换 applied-permissions/admin 平台管理员令牌，从而完全接管 应用。","severity":"HIGH","publishedAt":"2026-08-28","cve":"CVE-2026-82329","fixSteps":"临时解决方案：\n在确保业务不受影响的前提下，暂时拦截对 /access/api/v1/registry/join 接口的访问请求。\n\n正式解决方案：升级 JFrog Artifactory 至对应修复版本：7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20（Access 7.191.14）。厂商公告：https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories","tags":[],"lang":"zh","seenIn":["cn"],"epss":0.14372,"epssPct":0.96592,"poc":{"count":8,"stars":12,"top":[{"name":"dinosn/cve-2026-82329-jfrog-artifactory","url":"https://github.com/dinosn/cve-2026-82329-jfrog-artifactory","stars":12},{"name":"ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass","url":"https://github.com/ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass","stars":6},{"name":"tc4dy/CVE-2026-82329-PoC-Exploit","url":"https://github.com/tc4dy/CVE-2026-82329-PoC-Exploit","stars":4}]},"priority":78,"reasons":["EPSS 14%","公开 PoC ×8"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5453544","title":"KubePi SSO 管理接口未授权致配置泄露与账户接管漏洞","url":"https://stack.chaitin.com/vuldb/detail/3a5edea6-63fd-40b1-8e95-262d1a5fb090","summary":"KubePi 是流行的 Kubernetes 多集群管理面板。在 v2.0.0 之前的版本中，SSO（单点登录）管理模块被错误地挂载在公开路由上，导致未经认证的远程攻击者可直接访问配置读写及连通性测试接口。可能导致敏感信息泄露、数据篡改等严重后果，给系统安全性带来较大威胁。","severity":"HIGH","publishedAt":"2026-08-26","cve":"CVE-2026-65956","fixSteps":"一、升级修复方案\n\n建议立即升级至 KubePi v2.0.0 或更高版本，以规避 v1.x 系列存在的未授权 SSO 管理接口安全漏洞。官方已在 v2.0.0 完成修复，核心改动包括路由权限重构、管理员权限校验及敏感信息脱敏。升级时请按官方迁移指南完成数据备份、测试环境验证及业务回归测试，确保业务无损。\n参考链接：https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-wjrh-4j52-c664\n\n二、临时缓解方案\n\n在无法升级的情况下，可通过反向代理层访问控制临时规避风险。对 /kubepi/api/v1/sso 管理接口配置认证前置校验，仅允许携带有效会话凭证的请求访问；同时限制该路径仅允许可信管理网段访问，阻断外部未授权请求。","tags":["kubernetes"],"lang":"zh","seenIn":["cn"],"epss":0.00643,"epssPct":0.50531,"priority":63,"reasons":["关注厂商：kubernetes"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5212323","title":"Gitea diffpatch API 远程代码执行漏洞","url":"https://stack.chaitin.com/vuldb/detail/be8f6908-a3ae-4782-be3d-e39ee0f32413","summary":"Gitea 是一个开源、轻量级的自托管 Git 服务程序，通常用于企业或团队搭建代码托管、版本控制、代码评审与 CI/CD 协同平台，常见部署形态包括二进制服务、容器镜像、Bitnami 镜像和 MinimOS 等发行版包。该漏洞影响 1.17.0 至 1.27.0 之间的 Gitea 版本。根据 NVD 描述和 Gitea 官方安全公告，漏洞位于 diffpatch API 的补丁应用流程中：Gitea 在临时裸仓库中通过 git apply 处理攻击者可控的补丁内容，当同一个可执行补丁被重复提交时触发 add/add 冲突，Git 的三方合并回退逻辑会把受控文件检出到仓库的 hooks 目录，使 hooks/post-index-change 成为可执行 Git 钩子，并在后续写索引时被自动调用，从而以 Gitea 服务账户权限执行任意 shell 命令。攻击者只需具备普通仓库写权限即","severity":"CRITICAL","publishedAt":"2026-08-26","cve":"CVE-2026-60004","fixSteps":"一、官方修复方案\nGitea 官方已在 1.27.1 版本修复该漏洞，公告对应修复提交为 #38637 与 #38638。所有受影响实例应尽快升级到 1.27.1 或包含该修复的更高版本。\n\n- 修复版本/补丁编号：Gitea 1.27.1；MinimOS 发行版对应修复版本为 gitea 1.27.1-r0；Bitnami 镜像对应 1.27.1。\n- 二进制部署升级：\n```bash\n# 确认当前版本\ngitea --version\n# 停止 Gitea 服务\nsudo systemctl stop gitea\n# 备份 app.ini、数据目录和数据库后，用官方 1.27.1 二进制替换原安装文件\n# 启动服务并再次确认版本\nsudo systemctl start gitea\ngitea --version\n```\n- Docker 部署升级：\n```bash\ndocker pull gitea/gitea:1.27.1\ndocker stop <容器名>\ndocker rm <容器名>\ndocker run -d --name gitea -p 3000:3000 -v /var/lib/gitea:/data gitea/gitea:1.27.1\n```\n- Bitnami 部署请使用 Bitnami 渠道提供的 1.27.1 镜像或更新包；MinimOS 请将 gitea/gitea-compat 包升级到 1.27.1-r0。\n- 升级优先级：该漏洞已有公开 PoC 并被 CISA 列入已知被利用漏洞目录，建议立即升级，并同步开展入侵痕迹排查。\n\n二、临时缓解措施\n若无法立即升级，可先采取以下降风险措施：\n1. 关闭或收紧用户注册：如业务不需要开放注册，在管理后台关闭注册，或改为邀请/审核制，降低未认证攻击者获取仓库写权限的可能。\n2. 限制仓库创建和写权限","tags":[],"lang":"zh","seenIn":["cn"],"epss":0.23988,"epssPct":0.97825,"poc":{"count":11,"stars":17,"top":[{"name":"imbas007/CVE-2026-60004-POC","url":"https://github.com/imbas007/CVE-2026-60004-POC","stars":17},{"name":"0xBlackash/CVE-2026-60004","url":"https://github.com/0xBlackash/CVE-2026-60004","stars":6},{"name":"HORKimhab/CVE-2026-60004","url":"https://github.com/HORKimhab/CVE-2026-60004","stars":5}]},"priority":90,"reasons":["Critical","EPSS 24%","公开 PoC ×11"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5432124","title":"JeecgBoot 积木报表 auto/export 未授权远程代码执行漏洞","url":"https://stack.chaitin.com/vuldb/detail/185c5041-4a84-4973-8db2-d700600704d2","summary":"JeecgBoot 3.9.3 及之前版本的积木报表导出接口 /jmreport/auto/export 存在未授权远程代码执行漏洞。该接口标注 @JimuNoLoginRequired 且 Shiro 将 /jmreport/** 配为 anon，未登录即可进入导出流程。导出 PDF 时，攻击者传入的 reportParams[].params 值以 = 开头时进入 Aviator 表达式引擎执行，可结合 groovy.util.Eval.me 拉起操作系统命令，实现未授权 RCE。","severity":"HIGH","publishedAt":"2026-08-25","fixSteps":"升级修复方案：\n建议将 JimuReport 升级至 2.5.1 或更高版本；使用 JeecgBoot 的用户建议升级至 3.9.5 或更高版本，并确认报表 starter 已同步升级。升级前请备份配置和报表数据，并在测试环境验证导出、插件调用等相关功能。\n临时缓解方案：\n在确保业务不受影响的前提下，暂时拦截对 /jmreport/auto/export 或 /jeecg-boot/jmreport/auto/export 接口的访问请求。\n限制访问来源地址，如非必要，不要将系统开放在互联网上。","tags":[],"lang":"zh","seenIn":["cn"],"priority":42,"reasons":[]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5505993","title":"ShowDoc registerByVerify 未授权 PHP 代码注入漏洞","url":"https://stack.chaitin.com/vuldb/detail/02c546e6-0b10-4936-b1dc-84c07399f35d","summary":"ShowDoc <= 3.9.2 在旧版 API 注册接口 registerByVerify 中对 username 仅执行 trim，未限制 PHP 标签。采用 SQLite 部署时，用户名由注册流程写入 Web 根目录下的 Sqlite/showdoc.db.php；该文件扩展名为 .php，若 Web 服务器将其交由 PHP 解释器处理，攻击者可在无需账号权限的情况下写入 PHP 片段并在访问该数据库文件时触发执行。\n\n漏洞影响范围：ShowDoc version <= 3.9.2（SQLite 部署场景）。官方在 3.9.3 为 username 增加字符白名单校验。本文提交仅用于授权测试与防护验证。","severity":"HIGH","publishedAt":"2026-08-25","fixSteps":"1. 升级至 ShowDoc 3.9.3 或更高版本（官方修复版本）：https://github.com/star7th/showdoc/releases/tag/v3.9.3 。升级前请备份数据库，并在测试环境验证文档访问、用户注册及既有集成；升级后应复核注册配置、异常用户和 Web 访问日志。\n2. 在完成升级前，可采取临时缓解措施：关闭公开注册功能，限制注册入口仅对可信管理网段开放；通过网关或防火墙限制对 ShowDoc 管理端及数据库文件路径的外部访问。\n3. 将 SQLite 数据库文件移出 Web 可访问目录，或在 Web 服务器上禁止直接访问 /Sqlite/ 目录及 *.db.php 文件。\n4. 排查用户表中的异常用户名、Web 根目录中的新增脚本及相关访问日志；如发现异常，及时隔离实例、保留证据并轮换可能暴露的凭据。修复前可拦截 registerByVerify 的 username 参数中的 PHP 标签等特征。","tags":[],"lang":"zh","seenIn":["cn"],"priority":42,"reasons":[]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5401297","title":"大华智慧园区综合管理平台 backStoragePlan_deleteAll SQL注入漏洞","url":"https://stack.chaitin.com/vuldb/detail/79f5deda-547c-4231-b413-285548d5fd04","summary":"大华智慧园区综合管理平台 backStoragePlan_deleteAll 接口存在SQL注入漏洞。该接口未对用户输入的参数进行充分过滤与参数化处理，攻击者可通过构造恶意SQL语句，利用该接口实现数据库的越权查询、数据篡改甚至拖库，进而获取系统敏感信息或控制数据库服务，对业务数据安全构成严重威胁。","severity":"HIGH","publishedAt":"2026-08-20","fixSteps":"临时缓解措施：\n在确保业务不受影响的前提下，暂时拦截对 /admin/ztree.action/.;/storagePlan/backStoragePlan_deleteAll.action 接口的访问请求。","tags":[],"lang":"zh","seenIn":["cn"],"priority":42,"reasons":[]},{"source":"news","sourceName":"安全客","id":"安全客-0-","title":"Node.js、Python、Bun全中招：一个压缩库的内存漏洞，让半个互联网\"裸奔\"","url":"","summary":"","publishedAt":"2026-10-26 14:54:01","lang":"zh","seenIn":["news"],"priority":10,"reasons":[]},{"source":"news","sourceName":"安全客","id":"安全客-1-","title":"凌晨收到GitLab安全公告，CVSS满分，我看了看自家版本号","url":"","summary":"","publishedAt":"2026-10-26 14:47:16","lang":"zh","seenIn":["news"],"priority":10,"reasons":[]},{"source":"news","sourceName":"安全客","id":"安全客-2-","title":"AI自己写勒索脚本、自己挑目标、自己搞钱：俄罗斯黑客的Phantom框架，把勒索软件玩成了自动化流水线","url":"","summary":"","publishedAt":"2026-10-26 12:02:03","lang":"zh","seenIn":["news"],"priority":10,"reasons":[]},{"source":"news","sourceName":"Schneier on Security","id":"Schneier on Security-0-https://www.schneier.com/blog/archives/2026/10/bias-in-qwen3-coder-model.html","title":"Bias in Qwen3-Coder Model","url":"https://www.schneier.com/blog/archives/2026/10/bias-in-qwen3-coder-model.html","summary":"Interesting research : TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model&#8217;s weights, and that removing the model&#8217;s CCP alignment removes it. One word tilts the code against Americans. Ask fo","publishedAt":"2026-10-26T11:03:31Z","lang":"en","seenIn":["news"],"priority":10,"reasons":[]},{"source":"news","sourceName":"Schneier on Security","id":"Schneier on Security-1-https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-increasing-squid-populations","title":"Friday Squid Blogging: Increasing Squid Populations","url":"https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-increasing-squid-populations.html","summary":"This article in Nature argues that it&#8217;s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to talk about the security stories in the news that I haven&#8217;t covered. Blog moderation policy.","publishedAt":"2026-10-23T21:00:09Z","lang":"en","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Schneier on Security","id":"Schneier on Security-2-https://www.schneier.com/blog/archives/2026/10/compromised-tls-certificates.html","title":"Compromised TLS Certificates","url":"https://www.schneier.com/blog/archives/2026/10/compromised-tls-certificates.html","summary":"The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys : The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2 384 , or a number with 116 digits, d","publishedAt":"2026-10-23T11:04:22Z","lang":"en","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Seebug Paper","id":"Seebug Paper-0-https://paper.seebug.org/3529","title":"基于小语言模型的 RAG 流水线上下文感知提示注入检测：nokast-secureRAG","url":"https://paper.seebug.org/3529","summary":"作者：Abhishek Rai 原文链接：https://arxiv.org/html/2610.28364v1 摘要 本地检索增强生成（Retrieval-Augmented Generation, RAG）系统让强大的智能助手能够在私有数据上运行，但也继承了一类日益增长的安全风险——尤其是间接提示注入（Indirect Prompt Injection, IPI）与检索投毒，即隐藏在检索内容中...","publishedAt":"Fri, 23 Oct 2026 16:33:28 +0800","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Seebug Paper","id":"Seebug Paper-1-https://paper.seebug.org/3528","title":"讲解一下这次PHP核弹级别漏洞的原理","url":"https://paper.seebug.org/3528","summary":"作者：Laruence 原文链接：https://mp.weixin.qq.com/s/bB2EqImUlslJGCs7melQGw 这几天PHP圈很热闹，AI发现了一个核弹级别，隐藏了十几年的PHP的RCE漏洞，连日本首相都发X提醒大家注意。哈哈哈 本来昨天就想写一个分析的，不过考虑到可能被攻击者利用，就等到Patch出来以后，今天再发吧，本文以已经公开的攻击脚本POC为例，来解释，具体链接我就...","publishedAt":"Fri, 23 Oct 2026 15:22:21 +0800","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"安全客","id":"安全客-3-","title":"你的对手不是人了：Claude+Grok组队，400家金融机构被AI全自动攻破","url":"","summary":"","publishedAt":"2026-10-22 15:57:59","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Schneier on Security","id":"Schneier on Security-3-https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patch","title":"New Serious PHP Vulnerabilities Released and Patched","url":"https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html","summary":"PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consid","publishedAt":"2026-10-22T13:26:51Z","lang":"en","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"先知社区","id":"先知社区-0-https://xz.aliyun.com/news/93027","title":"CVE-2026-109618 (PHP2Shell) 漏洞深度复现与修复验证","url":"https://xz.aliyun.com/news/93027","summary":"本文复现 CVE-2026-109618 PHP2Shell OOM 堆破坏 RCE 漏洞，基于 Docker 靶场验证绕过 ASLR 的完整利用链，并对照官方补丁验证修复效果，总结复现坑点与安全加固方案。","publishedAt":"2026-10-22 09:40:10","lang":"zh","cve":"CVE-2026-109618","seenIn":["news","cn"],"epss":0.99981,"epssPct":0.99981,"poc":{"count":682,"stars":1822,"top":[{"name":"ikow/php2shell-poc","url":"https://github.com/ikow/php2shell-poc","stars":1822},{"name":"eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","stars":1017},{"name":"assetnote/php2shell-scanner","url":"https://github.com/assetnote/php2shell-scanner","stars":923}]},"priority":37,"reasons":["多源印证（长亭）"]},{"source":"news","sourceName":"Seebug Paper","id":"Seebug Paper-2-https://paper.seebug.org/3527","title":"MAS-Guard：从单体智能体到多智能体 LLM 系统的统一防护栏","url":"https://paper.seebug.org/3527","summary":"作者：Mohammad Kachuee, Phu Mon Htut, Sheng Li, Nikolaos Pappas, Miguel Ballesteros Martinez, Yassine Benajiba, Sujith Ravi, Dan Roth 原文链接：https://arxiv.org/pdf/2610.28397v1 摘要 智能体 AI（Agentic AI）将大语言模型（L...","publishedAt":"Thu, 22 Oct 2026 16:25:37 +0800","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Krebs on Security","id":"Krebs on Security-0-https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/","title":"Widespread PHP Flaw May Cause Many Site Outages Today","url":"https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/","summary":"Expect to see quite a few websites serving \"404\" or \"Page Not Found\" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.","publishedAt":"Wed, 21 Oct 2026 15:26:07 +0000","lang":"en","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Schneier on Security","id":"Schneier on Security-4-https://www.schneier.com/blog/archives/2026/10/workshop-on-economics-and-information-security-wei","title":"Workshop on Economics and Information Security (WEIS) Archive","url":"https://www.schneier.com/blog/archives/2026/10/workshop-on-economics-and-information-security-weis-archive.html","summary":"There&#8217;s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It&#8217;s fun to reread my 2002 essay on the economics of information security.","publishedAt":"2026-10-21T11:02:22Z","lang":"en","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"先知社区","id":"先知社区-1-https://xz.aliyun.com/news/93020","title":"Mercury 框架未授权远程代码执行漏洞 (RCE) 深度剖析","url":"https://xz.aliyun.com/news/93020","summary":"Mercury 是一个基于 Python 的框架，主要用于将 Jupyter Notebook 快速转换为交互式的 Web 应用程序。在早期的版本中，其内核管理接口存在严重的访问控制缺陷。","publishedAt":"2026-10-21 10:11:57","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"安全客","id":"安全客-4-","title":"月下载9000万次的AI网关LiteLLM曝双漏洞：低权限账号就能偷走你所有API密钥","url":"","summary":"","publishedAt":"2026-10-20 19:06:20","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Schneier on Security","id":"Schneier on Security-5-https://www.schneier.com/blog/archives/2026/10/possible-new-cellebrite-iphone-radio-zero-day.html","title":"Possible new Cellebrite iPhone Radio Zero-Day","url":"https://www.schneier.com/blog/archives/2026/10/possible-new-cellebrite-iphone-radio-zero-day.html","summary":"Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the &#8220;advanced unlocking services&#8221; they&#8217;ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026. [&#8230;] According to Cellebrite, AU: is a &#8220;next-generation AFU v","publishedAt":"2026-10-20T11:03:13Z","lang":"en","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"先知社区","id":"先知社区-2-https://xz.aliyun.com/news/93007","title":"非首发-Whitechain 跨链桥漏洞挖掘复盘：从源码分析到 PoC 复现，以及被判定 N/A 的反思","url":"https://xz.aliyun.com/news/93007","summary":"(本文首发于个人博客：https://23w-8h.github.io/2026/10/20/Whitechain-%E8%B7%A8%E9%93%BE%E6%A1%A5%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E5%A4%8D%E7%9B%98%EF%BC%9A%E4%BB%8E%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E5%88%","publishedAt":"2026-10-20 08:42:35","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"先知社区","id":"先知社区-3-https://xz.aliyun.com/news/92998","title":"【勒索预警】快转发给身边同事，Sorry勒索病毒再度来袭，改名ths（附防护建议）","url":"https://xz.aliyun.com/news/92998","summary":"这是一篇快报，长话短说。 近日我们收到一起企业应急求助，上机排查后发现，受害服务器上的文件被批量加密，扩展名被追加为一个此前从未见过的新后缀 .ths，每个目录下均留有名为hello.txt 的勒索信。经过比对分析，我们确认这不是新家族，而是我们长期跟踪的 Sorry 勒索病毒（TellYouThePass 勒索家族）卷土重来，换了一个新名字继续作案。 考虑到该家族惯用 0day 发起攻击，传播速","publishedAt":"2026-10-20 01:53:50","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"先知社区","id":"先知社区-4-https://xz.aliyun.com/news/92997","title":"【勒索预警】首发，weax勒索病毒针对用友畅捷通T+应用0day攻击溯源全流程（附IOC）","url":"https://xz.aliyun.com/news/92997","summary":"自weax勒索病毒开始使用0day攻击国内应用系统以来，我们一直在持续跟进。","publishedAt":"2026-10-20 01:46:58","lang":"zh","seenIn":["news"],"priority":5,"reasons":[]},{"source":"news","sourceName":"Krebs on Security","id":"Krebs on Security-1-https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/","title":"Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site","url":"https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/","summary":"U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters op","publishedAt":"Mon, 19 Oct 2026 13:48:56 +0000","lang":"en","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"先知社区","id":"先知社区-5-https://xz.aliyun.com/news/92996","title":"精武杯计算机取证","url":"https://xz.aliyun.com/news/92996","summary":"vmx，vc，vhd，挂载方式考察的挺全面的","publishedAt":"2026-10-19 13:22:56","lang":"zh","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"安全客","id":"安全客-5-","title":"3.5万次请求、翻找泄露密钥：失控AI智能体围猎高德地图，运营者却毫不知情","url":"","summary":"","publishedAt":"2026-10-19 12:05:07","lang":"zh","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"Seebug Paper","id":"Seebug Paper-3-https://paper.seebug.org/3526","title":"BARE-AI：通过内置性能监视器实现 AI 硬件的比特翻转攻击韧性","url":"https://paper.seebug.org/3526","summary":"作者：Habibur Rahaman, Swastik Bhattacharya, Sanjay Das, Kanad Basu, Swarup Bhunia 原文链接：https://arxiv.org/pdf/2610.08739v2 摘要 深度神经网络（DNN）如今已成为众多安全关键系统不可或缺的组成部分，但它们仍然极易受到比特翻转攻击（BFA）的威胁——在这种攻击中，少量的内存级扰动即可使...","publishedAt":"Thu, 15 Oct 2026 17:08:10 +0800","lang":"zh","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"Krebs on Security","id":"Krebs on Security-2-https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/","title":"U.K. Sanctions Cryptomus for RU Money Laundering","url":"https://krebsonsecurity.com/2026/10/u-k-sanctions-cryptomus-for-ru-money-laundering/","summary":"The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions.","publishedAt":"Wed, 14 Oct 2026 14:22:49 +0000","lang":"en","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"Krebs on Security","id":"Krebs on Security-3-https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/","title":"Microsoft Patches More Than 1,400 Security Flaws","url":"https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/","summary":"Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.","publishedAt":"Tue, 13 Oct 2026 23:24:53 +0000","lang":"en","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"Seebug Paper","id":"Seebug Paper-4-https://paper.seebug.org/3525","title":"基于信息论安全密钥分发的高效安全联邦学习：一个医学影像案例研究","url":"https://paper.seebug.org/3525","summary":"作者：Ivan Donà, Hans H. Brunner, Álvaro Troyano Olivas, Chi-Hang Fred Fung, Momtchil Peev, Giovanni Iacca 原文链接：https://arxiv.org/pdf/2610.06420v1 摘要 联邦学习（Federated Learning, FL）能够在不集中敏感数据的前提下，实现跨机构的模型协同...","publishedAt":"Mon, 12 Oct 2026 16:56:54 +0800","lang":"zh","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"Krebs on Security","id":"Krebs on Security-4-https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/","title":"FBI Arrests Executive at Ransomware Negotiation Firm","url":"https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/","summary":"Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity.","publishedAt":"Sat, 10 Oct 2026 00:17:42 +0000","lang":"en","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"Seebug Paper","id":"Seebug Paper-5-https://paper.seebug.org/3524","title":"TWINGUARD-LITE：面向生成式患者数字孪生的基于规则的状态准入网关","url":"https://paper.seebug.org/3524","summary":"作者：Wenhui Chu 与 Sheikh Rabiul Islam 原文链接：https://arxiv.org/pdf/2610.09012v1 摘要 未来的生成式患者数字孪生可能将纵向健康档案与语言模型智能体相结合，并跨会话保存信息。一项拟议更新的措辞并不能揭示它是否来自被允许的来源、是否与患者的记录相冲突，或者是否属于他人。我们提出 TWINGUARD-LITE，一个基于规则的网关，只有...","publishedAt":"Thu, 08 Oct 2026 16:23:17 +0800","lang":"zh","seenIn":["news"],"priority":0,"reasons":[]},{"source":"news","sourceName":"Krebs on Security","id":"Krebs on Security-5-https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/","title":"ShinyHunters Extorted Boeing Spin-off Prior to Arrests","url":"https://krebsonsecurity.com/2026/10/shinyhunters-extorted-boeing-spin-off-prior-to-arrests/","summary":"A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle \"Rey,\" was detained as ShinyHunters was in the process of extorting a business unit recently divested by the gl","publishedAt":"Wed, 07 Oct 2026 13:48:45 +0000","lang":"en","seenIn":["news"],"priority":0,"reasons":[]}],"top":[{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-104935","title":"CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104935","summary":"Ivanti Connect Secure: Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","severity":"在野利用","publishedAt":"2026-10-13","tags":["ivanti"],"cve":"CVE-2026-104935","dueDate":"2026-10-16","ransomware":false,"seenIn":["kev","cn"],"epss":0.86766,"epssPct":0.9974,"poc":{"count":5,"stars":1,"top":[{"name":"ApexBreach/CVE-2026-104935-Proof-of-concept","url":"https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept","stars":1},{"name":"0x45dd/ivanti-cve-2026-104935-check","url":"https://github.com/0x45dd/ivanti-cve-2026-104935-check","stars":1},{"name":"maxprog-svg/CVE-2026-104935","url":"https://github.com/maxprog-svg/CVE-2026-104935","stars":0}]},"kevDueDays":-10,"priority":119,"reasons":["在野利用","EPSS 87%","公开 PoC ×5","多源印证（长亭）"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-6017798","title":"PHP 远程代码执行漏洞（php2shell，CVE-2026-109618/CVE-2026-109619）","url":"https://stack.chaitin.com/vuldb/detail/f2ae35f3-30ef-4b87-8000-3f437652f8d2","summary":"PHP 是一种广泛使用的开源服务器端脚本语言，通常以 PHP-FPM、CGI 或 Apache 模块（mod_php）方式部署，是 WordPress、Drupal、Laravel、Symfony、Magento 等主流框架与建站系统，以及大量 Web 应用、共享主机和控制面板的常见运行环境。\n\n2026 年 10 月，长亭安全应急响应中心监测到 PHP Core 的 session 上传进度（session.upload_progress，rfc1867 回调）处理机制存在内存破坏缺陷，公开讨论中以 php2shell 指代该组漏洞，对应 CVE-2026-109618 与 CVE-2026-109619，官方评级均为 CVSS v4.0 9.2（严重）。攻击者可通过构造特制的 multipart/form-data 请求破坏 PHP 进程内存，进而可能导致远程代码执行。\n\n长亭已在实验","severity":"CRITICAL","publishedAt":"2026-10-21","cve":"CVE-2026-109618","fixSteps":"一、升级修复方案\nPHP 官方计划于 2026 年 10 月 21 日 14:00 UTC 发布安全更新，修复版本以官方发布为准（https://www.php.net/archive/2026.php）。补丁发布后应优先升级互联网暴露的 Web 服务器、共享主机及控制面板/CMS 环境，并同步确认 Linux 发行版与主机商提供的回溯更新；PHP 8.1 及更早版本已停止支持，应尽快迁移或下线隔离。\n\n二、临时缓解方案\n以下措施为应急临时方案，可能影响业务功能，升级完成后应及时评估是否保留：\n1、若业务不使用上传进度条，在 php.ini、.user.ini 或 .htaccess 中设置 session.upload_progress.enabled = Off，并重载 PHP-FPM 或 Web 服务器，切断已确认的中途会话生命周期路径；\n2、在 WAF、反向代理或网关层收紧对 multipart/form-data 请求的检查与速率限制，重点保护不需要文件上传的业务端点；\n3、启用 session.use_strict_mode = 1，避免接受攻击者指定的任意会话 ID；审计会话包装类与自定义 save handler 的重入风险；\n4、审计应用代码，避免在 __destruct、__wakeup 等析构路径中调用 session_destroy()、session_write_close() 等会话 API；\n5、对 PHP 8.1 及更早的停止支持版本，采取下线、网络隔离、VPN 或白名单访问等措施，直至完成迁移。\n\n三、资产排查与失陷排查\n1、清点互联网与内网暴露的 PHP 服务，记录 PHP 版本、运行方式（mod_php / PHP-FPM / CGI）、session.upload_progress 与 session.use_strict_mode ","tags":["apache"],"lang":"zh","seenIn":["cn","news"],"epss":0.99981,"epssPct":0.99981,"poc":{"count":682,"stars":1822,"top":[{"name":"ikow/php2shell-poc","url":"https://github.com/ikow/php2shell-poc","stars":1822},{"name":"eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","url":"https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC","stars":1017},{"name":"assetnote/php2shell-scanner","url":"https://github.com/assetnote/php2shell-scanner","stars":923}]},"priority":116,"reasons":["Critical","EPSS 100%","公开 PoC ×682","多源印证（资讯）","关注厂商：apache"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-110447","title":"CVE-2026-110447 — Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110447","summary":"Collabora Collabora Online – Built-in CODE Server: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.","severity":"在野利用","publishedAt":"2026-10-23","tags":["collabora"],"cve":"CVE-2026-110447","dueDate":"2026-10-26","ransomware":false,"seenIn":["kev"],"epss":0.12328,"epssPct":0.96165,"poc":{"count":1,"stars":0,"top":[{"name":"adriyansyah-mf/cve-2026-110447","url":"https://github.com/adriyansyah-mf/cve-2026-110447","stars":0}]},"kevDueDays":0,"priority":111,"reasons":["在野利用","EPSS 12%","公开 PoC ×1"]},{"source":"kev","sourceName":"CISA KEV","id":"CVE-2026-96656","title":"CVE-2026-96656 — Plex Media Server External Control of File Name or Path Vulnerability","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96656","summary":"Plex Media Server: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.","severity":"在野利用","publishedAt":"2026-10-20","tags":["plex"],"cve":"CVE-2026-96656","dueDate":"2026-10-23","ransomware":false,"seenIn":["kev"],"epss":0.01785,"epssPct":0.78151,"poc":{"count":1,"stars":0,"top":[{"name":"a3igner/plex-codec-cache-implant","url":"https://github.com/a3igner/plex-codec-cache-implant","stars":0}]},"kevDueDays":-3,"priority":107,"reasons":["在野利用","公开 PoC ×1"]},{"source":"ghsa","sourceName":"GitHub Advisory · pip / pillow","id":"GHSA-5x8w-8jj5-q52h","title":"CVE-2026-112398 — Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","url":"https://github.com/advisories/GHSA-5x8w-8jj5-q52h","summary":"### Credits\n\n**Researcher**: Alex Bouffard (mixbo@pebwalker.com)\n\n### Summary\n\nA heap buffer overflow in Pillow's FlashPix (FPX) JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with `Image.open()`. The file is recognized by content (the OLE2 magic), not by extension, so any service that opens or thumbnails untrusted uploads with the optional `olefile` dependency installed is reachable with no user interaction. In the PoC","severity":"CRITICAL","publishedAt":"2026-10-23T21:55:21Z","tags":["linux","docker"],"cve":"CVE-2026-112398","seenIn":["ghsa"],"epss":0.0057,"epssPct":0.46943,"poc":{"count":1,"stars":0,"top":[{"name":"mcpmark-eval-liuhezi/security-advisory-research","url":"https://github.com/mcpmark-eval-liuhezi/security-advisory-research","stars":0}]},"priority":91,"reasons":["Critical","公开 PoC ×1","关注厂商：linux、docker"]},{"source":"cn","sourceName":"长亭漏洞库","id":"CT-5747283","title":"Citrix NetScaler 命令注入漏洞（CVE-2026-88771）","url":"https://stack.chaitin.com/vuldb/detail/1d7327ec-b8ef-4f81-bd97-3910f27fbf15","summary":"Citrix NetScaler ADC 与 Citrix NetScaler Gateway 是面向企业网络的应用交付控制器和远程接入网关，主要用于负载均衡、SSL 卸载、身份认证和 VPN 远程访问，广泛部署于大型政企网络边缘，作为内部应用与远程办公的入口。2026 年 9 月，长亭安全应急响应中心监测到 Citrix NetScaler ADC 与 NetScaler Gateway 未授权命令注入漏洞（CVE-2026-88771）。攻击者无需登录即可通过网络请求触发该漏洞，可在设备上执行任意命令。截至通告发布，官方已发布修复版本，公开信息显示该漏洞已被在野利用，且相关利用代码已经公开。建议受影响用户立即升级至官方安全版本，并在升级前评估设备是否已被入侵。受影响版本：NetScaler ADC / NetScaler Gateway 14.1 低于 14.1-73.37、13.1 ","severity":"CRITICAL","publishedAt":"2026-09-27","cve":"CVE-2026-88771","fixSteps":"一、升级修复方案\n建议尽快将 Citrix NetScaler ADC 与 Citrix NetScaler Gateway 升级至以下官方安全版本或更高版本：\nCitrix NetScaler ADC 与 Citrix NetScaler Gateway 14.1：升级至 14.1-73.37 及后续版本；\nCitrix NetScaler ADC 与 Citrix NetScaler Gateway 13.1：升级至 13.1-64.23 及后续 13.1 版本；\nCitrix NetScaler ADC 14.1-FIPS：升级至 14.1-73.37 FIPS 及后续 14.1-FIPS 版本；\nCitrix NetScaler ADC 13.1-FIPS 与 13.1-NDcPP：升级至 13.1-37.279 及后续版本。\n下载链接：https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n采用 NetScaler 实例的 Secure Private Access 混合部署同样需要升级至上述安全版本。本修复适用于客户自管设备；Citrix 托管云服务由厂商自行更新。官方建议在升级前检查设备是否已被入侵，并保存日志、快照等取证材料。\n\n二、临时缓解方案\n截至通告发布，官方未针对 CVE-2026-88771 提供可替代升级的临时缓解方案。无法立即完成升级的用户，应尽快限制相关设备的互联网暴露与管理面访问，并按官方指引评估失陷风险、保存取证材料。上述措施可能影响远程接入等业务功能，升级完成后应及时恢复必要访问。该措施不能替代升级。\n\n三、资产排查与失陷排查\n排查互联网及内网中暴露的 Citrix NetScaler ADC / NetScaler Gateway","tags":[],"lang":"zh","seenIn":["cn"],"epss":0.8216,"epssPct":0.99652,"poc":{"count":12,"stars":22,"top":[{"name":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","stars":22},{"name":"ThomasPoppelgaard/netscaler-ctx697096-checker","url":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker","stars":20},{"name":"technion/netscaler_scanner","url":"https://github.com/technion/netscaler_scanner","stars":1}]},"priority":91,"reasons":["Critical","EPSS 82%","公开 PoC ×12"]}],"briefing":[{"level":"critical","text":"CISA KEV 近 7 天新增 8 个在野利用漏洞：CVE-2026-114625、CVE-2026-110447、CVE-2026-106931 等，应优先排查补丁。"},{"level":"critical","text":"KEV 修复截止：2 个将在 7 天内到期（CVE-2026-114625、CVE-2026-110447），15 个已过截止日；CISA 近期给新收录漏洞的修复期中位数仅 3 天，需要更快的补丁节奏。"},{"level":"high","text":"22 个漏洞已有公开 PoC，武器化风险高；关注度最高的是 CVE-2026-109618（682 个 PoC 仓库，最高 1822★）。"},{"level":"high","text":"9 个漏洞的 EPSS 位于全部 CVE 的前 1%（未来 30 天被利用概率最高）：CVE-2026-109618（100%）、CVE-2015-5477（100%）、CVE-2026-21589（99%）。"},{"level":"info","text":"长亭漏洞库最新收录：PHP 远程代码执行漏洞（php2shell，CVE-2026-109618/CVE-2026-109619）（已附中文修复建议）。"},{"level":"info","text":"涉及最多的厂商/组件：plex（4）、windows（3）、microsoft（2）、docker（2）。"},{"level":"high","text":"2 个漏洞被多个情报源同时报道（CVE-2026-104935、CVE-2026-109618），可信度与关注度更高。"},{"level":"info","text":"安全资讯头条：Node.js、Python、Bun全中招：一个压缩库的内存漏洞，让半个互联网\"裸奔\"（安全客）。"}]}