安全指南
从真实事故中学习，守护你自己的网站。
不讲如何攻击，只讲如何防御，全部源自真实发生过的入侵事件。即便没有安全背景，也能从今天就开始实践这些防御措施。
从哪里开始
01最新 / 安全新闻
现在需要确认的信息。
关于事件和漏洞的突发报道、正在被积极利用的缺陷，以及近期披露的严重漏洞。漏洞信息源最后更新时间 2026-11-14 02:01 JST列表获取时间 2026-11-15 13:36 JST
突发报道附来源
- First report英文Dexcom Data Breach (November 2026): Notices Cover Name, Social Security Number and ID, or Pharmacy, Provider and Prescription Details. What to Do
- First report英文Unauthorized access to a company that handles e-commerce logistics (warehousing and shipping) may have leaked delivery data from several online shops: names, addresses, phone numbers and more — what buyers should do
- First report英文Fandango Checkout Page Card Data Breach (October 2026): Unauthorized Access Possible; Card Number, CVV, Expiration Date, Billing ZIP and Email May Be Impacted. What to Do
- First report英文Unauthorized access to GFS Education's GFS member site (about 110,000 people, My Number Card back images for 84): ID document images and password-related data leaked or may have leaked — what affected people should do
- First report英文Unauthorized access to Keisei Electric Railway's Skyliner seat reservation system (up to about 3.37 million records): user IDs, encrypted passwords, names, phone numbers and email addresses may have been obtained — what users should do
突发报道以英语和日语发布。
查看全部突发报道正在被积极利用CISA KEV 新增
- CVE-2026-114713UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
- CVE-2026-123039CVSS 7.8有解析The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
- CVE-2026-116606CVSS 9.3有解析Barracuda Email Security Gateway 9.4.0.030 之前的版本存在一个身份验证绕过漏洞，未经身份验证的远程攻击者可调用配置导入功能，并还原经过精心构造的兼容备份归档文件，从而未经授权修改设备的全局配置。
- CVE-2026-125350CVSS 8.8有解析Google Chrome在 Google Chrome 157.0.8103.50 之前的版本中，XML 组件存在释放后重用（Use after free）漏洞。远程攻击者可通过精心构造的 HTML 页面，在沙箱内执行任意代码。（Chromium 安全严重程度：高）
- CVE-2026-111560CVSS 8.6在特定 Barracuda 设备产品中，时区配置字段对 shell 元字符的处理不当（未正确转义或过滤），且该问题存在于其通用 Barracuda 代码中。已通过身份验证的管理员可注入操作系统命令；当构造的时区值随后被处理时，这些命令将以 root 权限执行。
近期披露的严重缺陷CVSS 8.8+
- CVE-2026-125055CVSS 9.8The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in cbforms_check_form_submissions(), where the allowed-type check defaults to the uploaded file's own extension when no field restriction is configured, trivially allowing any extension including .php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The submission nonce printed inline on every public page containing a Chatterbug form is freely obtainable by unauthenticated visitors and therefore does not constitute an effective access control barrier.
- CVE-2026-119077CVSS 9.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.
- CVE-2026-107360CVSS 9.6A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
- CVE-2026-76954CVSS 9.8有解析An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-110697CVSS 9.9A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations.
利用状态来自 CISA KEV，严重程度来自 NVD。请始终在各厂商公告中确认修复版本和受影响范围。
01 — Sections
从哪里开始
按目标选择入口。全部免费，无需注册。
02 — Field notes
重大安全事故与漏洞
Capital One、Log4Shell、MOVEit 等等——把公开披露的入侵与漏洞，转化为你可用的防御方法。
03 — Our stance
本站的立场
一个安全产品，首先得管好自己的一亩三分地。
We don't hold secrets
We never store your real API keys — only metadata. The safest secret is the one we can't leak.
Scan only what you own
Diagnostics run on verified domains only. Internal IPs and metadata endpoints are blocked — SSRF defense is built in.
Minimal blast radius
Isolation so one breach can't cascade. This site itself runs on a dedicated, isolated host.
We test on ourselves
This site watches its own dependencies for CVEs. The incident that started this never gets missed by a human again.