Posts of last few hours
Currently trending CVE - Hype Score: 8 - Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious ...
https://cvemon.intruder.io/cves/CVE-2025-64756
Currently trending CVE - Hype Score: 9 - Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.
https://cvemon.intruder.io/cves/CVE-2026-75960
Currently trending CVE - Hype Score: 16 - In the Linux kernel, the following vulnerability has been resolved:
sctp: avoid auth_enable sysctl UAF during netns teardown
proc_sctp_do_auth() updates the SCTP control socket after changing
net.sctp.auth_enable. The handler gets the per-net SCTP state from
ctl->data, so an ...
https://cvemon.intruder.io/cves/CVE-2026-68162
Currently trending CVE - Hype Score: 17 - An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation ...
https://cvemon.intruder.io/cves/CVE-2026-81578
Currently trending CVE - Hype Score: 17 - An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an ...
https://cvemon.intruder.io/cves/CVE-2026-82078
Currently trending CVE - Hype Score: 1 - An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
https://cvemon.intruder.io/cves/CVE-2026-66384
Currently trending CVE - Hype Score: 1 - An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted ...
https://cvemon.intruder.io/cves/CVE-2023-49105
Currently trending CVE - Hype Score: 1 - In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed ...
https://cvemon.intruder.io/cves/CVE-2026-53362
Currently trending CVE - Hype Score: 1 - A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code ...
https://cvemon.intruder.io/cves/CVE-2025-55182
Currently trending CVE - Hype Score: 24 - A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time ...
https://cvemon.intruder.io/cves/CVE-2024-6387
Android 安全加固项目 GrapheneOS 发现，Google 新一代旗舰智能手机 Pixel 11 取消了对硬件 MTE（hardware memory tagging）的支持，导致该项目无法完成对 Pixel 11 的支持。MTE（Memory Tagging Extension）是 ARMv8.5-A 架构引入的安全特性，通过标记分配的内存去跟踪非法内存操作，改进内存安全性。Google 是从 2023 年发布的 Pixel 8 起开始支持硬件 MTE。但 Android 和 Pixel OS 从未默认启用 MTE，相比下苹果的 iPhone 17 默认启用了它的 MTE 实现 Memory Integrity Enforcement(MIE)。GrapheneOS 会自动为更多应用启用 MTE，为每个安装的应用提供一个开关供用户可选启用。对于不兼容的应用则提供开关可选禁用。GrapheneOS 正与摩托罗拉合作推出支持 GrapheneOS 的手机，新手机将使用高通的骁龙 8 Elite Gen 5，该 SoC 支持硬件 MTE。GrapheneOS 项目不推荐用户购买 Pixel 11，建议购买更便宜的 Pixel 8、9 和 10。
https://www.solidot.org/story?sid=85233
我用 NocoDB 2026.07.0 默认部署版本做了一次完整的攻击面分析。注册、上传、下载、邮箱验证、JWT 这 5 个环节都有可利用的缺陷。其中最关键的发现是 JWT 密钥明文存储在 SQLite 的 nc_store 表里，配合 is_api_token 旁路可以绕过 token_version 校验，伪造任意角色的 Token。配套附 nocodb-audit.sh 一键检测脚本。
https://xz.aliyun.com/news/92591
当文件名沦为能力路由器：CFITSIO因I/O副作用优先于校验且无回滚，致使攻击者串联功能达成文件复制、SSRF与敏感外传。
https://xz.aliyun.com/news/92692
`CVE-2026-73653` 的核心不是单个路径遍历点，而是 Vitest Browser Mode 里多条 `browser -> RPC -> provider -> filesystem` 链路同时缺失统一的权限检查。
https://xz.aliyun.com/news/92704
Directus 默认 SSRF 黑名单只防了 AWS 那个 metadata 地址——国产云（腾讯云 169.254.0.23、阿里云 100.100.100.200）一个都没拦。链 A 用 editor 账号打 import 端点直接拉回实例指纹；链 B 用 Webhook Flow 零账号匿名触发。配套 import-ssrf-audit.py 加 --metadata-check 模式，3
https://xz.aliyun.com/news/92720
FastGPT v4.14.8 沙箱四层防护（模块黑名单/AST 检查/open 守卫/import 守卫）全被一条 inspect 四步链穿透：currentframe().f_back.f_globals 拿到 worker 模块全局字典，直接调出 _original_open 读 /etc/passwd、_original_import 绕过黑名单。配套 fastgpt-sandbox-au
https://xz.aliyun.com/news/92724
对照DeepAudit与AutoCVE，归纳白盒审计Agent在角色拆分、工具边界、状态机与容错上的设计要点，并介绍VulnHunter-White如何用文件定权做全覆盖，结合三种挖掘模式、Docker/局部验证、互联网复测与攻击链串联完成挖洞。
https://xz.aliyun.com/news/92732
一次攻防对抗项目中对某医院 HIS 系统的渗透，目标是验证登录用户权限边界并扩大战果。整个链路走下来很有意思：看似处处有鉴权，实则令牌签名可逆向，最终用一个低权限账号拿到了全量用户数据。
https://xz.aliyun.com/news/92669
本文复盘某APP昵称存储型XSS挖掘全过程，通过抓包突破前端限制，FUZZ冷门事件、利用逗号表达式绕过WAF，绕过字符截断限制成功拿下漏洞赏金。
https://xz.aliyun.com/news/92642
本文记录了 Hack The Box 靶机 Vintage 的完整攻防渗透过程。目标处于禁用 NTLM 的纯 Kerberos 环境下，作者从初始凭据出发，利用 Pre-Windows 2000 机器账户弱口令获取域计算机权限；随后通过 LDAP 提取并解析 gMSA 托管服务账号凭据，结合 ACL 权限为无 SPN 的服务账号手工赋予 SPN 并成功实施 Targeted Kerberoasti
https://xz.aliyun.com/news/92703
Latest Blog Posts
- 1 week ago
- 2 months 1 week ago
- 2 months 1 week ago
- 2 months 1 week ago
- 2 months 1 week ago
- 7 months ago
- 1 year ago
- 1 year ago
- 1 year 1 month ago
- 1 year 5 months ago