Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest
CVE-2026-41670
## Summary The SAML IdP implementation in Admidio's SSO module uses the `AssertionConsumerServiceURL` value directly fr
2026-05-01 归档
今日共收录 1019 条安全情报，包含 232 个 CVE，445 篇安全通告，以及 40 篇研究论文。
← 返回归档列表Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests
CVE-2026-41669
## Summary The Admidio SAML Identity Provider implementation discards the return value of its `validateSignature()` met
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
CVE-2026-41663
## Summary Several administrative operations in Admidio's preferences module (database backup, test email, htaccess gen
Firewall for AI
Firewall for AI
Post-quantum encryption for Cloudflare IPsec is generally available
Cloudflare IPsec now has generally available support for post-quantum encryption via hybrid ML-KEM. We’ve confirmed inte
SonicWall Urges Immediate Patching of Firewall Vulnerabilities
The bugs could be exploited to bypass security controls, access restricted services, and crash firewalls. The post Sonic
FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruption
本文提出了 FlashRT，首个针对长上下文大语言模型（LLM）在优化型提示注入和知识腐败攻击下，同时提升计算效率与内存效率的红队测试框架。背景：长上下文 LLM（如 Gemini-3.1-Pro、Qwen-3.5）广泛应用，但面临提示注入
REBENCH: A Procedural, Fair-by-Construction Benchmark for LLMs on Stripped-Binary Types and Names (Extended Version)
该论文提出了 REBENCH，一个用于评估大型语言模型（LLM）在二进制逆向工程任务中性能的标准化基准数据集。当前，LLM 在计算机安全领域，尤其是逆向工程中的函数名恢复、变量名恢复和类型推断等任务上取得了显著进展。然而，由于缺乏标准化的数
From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systems
该论文针对集成大语言模型（LLM）的自主机器人系统进行威胁建模。背景方面，虽然已有研究分别关注机器人网络安全、对抗性感知攻击和LLM安全性，但尚未有工作将这些威胁类别在一个统一架构中追踪其相互作用与传播。作者通过将基于边缘-云架构的LLM赋
SafeTune: Mitigating Data Poisoning in LLM Fine-Tuning for RTL Code Generation
随着大语言模型（LLM）越来越多地被微调用于硬件任务（如寄存器传输级（RTL）代码生成），高质量数据集的稀缺性常常导致使用快速组装或生成的数据。这些数据集缺乏安全验证，极易受到数据投毒攻击，使得模型生成语法正确但存在安全漏洞的硬件模块，绕过
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of the component lighttpd. Such manipulat...
CVE-2026-7546
Totolink NR1800X 路由器固件版本 9.1.0u.6279_B20210910 中存在一处栈缓冲区溢出漏洞，该漏洞位于 lighttpd 组件的 find_host_ip 函数中。攻击者无需身份认证，通过向受影响设备发送特制的
Contras Affected by CopyFile Policy Subversion via Symlinks
### Impact The [Kata agent policies](https://docs.edgeless.systems/contrast/architecture/components/policies) generated
Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation
# Summary The Hickory DNS project's experimental `hickory-recursor` crate's record cache (`DnsLru`) stores records from
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
Security & Identity
Security & Identity
SAP on Google Cloud
SAP on Google Cloud
Inside Google Cloud
Inside Google Cloud
Google Cloud Next & Events
Google Cloud Next & Events