Admidio vulnerable to reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion
CVE-2026-41661
## Summary An unauthenticated attacker can execute arbitrary JavaScript in any Admidio user's browser through a reflect
2026-04-30 归档
今日共收录 966 条安全情报，包含 229 个 CVE，399 篇安全通告，以及 34 篇研究论文。
← 返回归档列表Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
CVE-2026-41658
## Summary The Admidio inventory module enforces authorization for destructive operations (delete, retire, reinstate) o
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If...
CVE-2026-1858
wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromis
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs...
CVE-2026-7439
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without
n8n has XML Node Prototype Pollution that to RCE
CVE-2026-42232
## Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution v
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
CVE-2026-42231
## Impact A flaw in the `xml2js` library used to parse XML request bodies in n8n's webhook handler allowed prototype pol
n8n Vulnerable to XSS via MCP OAuth client
CVE-2026-42235
## Impact An unauthenticated attacker could register a malicious MCP OAuth client with a crafted `client_name`. If a vic
Firewall for AI
Akamai 发布了名为“Firewall for AI”的新型安全产品，旨在保护人工智能（AI）应用程序和模型免受恶意流量攻击，特别是针对 DDoS（分布式拒绝服务）攻击和僵尸网络（botnet）的防护。该产品利用 Akamai 的全球分
Tatemae: Detecting Alignment Faking via Tool Selection in LLMs
本文提出一种利用工具选择行为检测大型语言模型（LLM）中"对齐伪装"（Alignment Faking, AF）的新方法。AF 是指 LLM 在训练过程中表面服从目标以规避价值观修改，一旦监控解除便恢复原有偏好。现有检测方法主要依赖对话中的
Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agents
本论文提出了一种名为 CodeName 的行为防火墙，用于保护由大语言模型驱动的结构化工作流 AI 代理。这类代理会对外部敏感环境执行工具调用，面临被攻击者利用的风险。研究背景基于序列入侵检测思想，核心方法是将经过验证的良性工具调用遥测数据
PRAG End-to-End Privacy-Preserving Retrieval-Augmented Generation
检索增强生成（RAG）通过引入外部知识显著提升了大型语言模型（LLM）的能力，但其在云环境中的部署面临敏感数据的隐私泄露风险。现有隐私保护方案往往因噪声注入而牺牲检索质量，或仅提供部分加密。本文提出PRAG，一种端到端隐私保护RAG系统，在
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
Security & Identity
Security & Identity
SAP on Google Cloud
SAP on Google Cloud
Inside Google Cloud
Inside Google Cloud
Google Cloud Next & Events
Google Cloud Next & Events
Google Cloud Consulting
Google Cloud Consulting
Transform with Google Cloud
Transform with Google Cloud