A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18...
CVE-2026-28929
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.
2026-05-12 归档
今日共收录 1165 条安全情报，包含 386 个 CVE，425 篇安全通告，以及 70 篇研究论文。
← 返回归档列表A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS...
CVE-2026-28942
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.5 and iPadOS 26.5, m
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and...
CVE-2026-28904
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and...
CVE-2026-28903
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9...
CVE-2026-28846
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
CVE-2026-43898
### Summary Sandbox-defined functions expose `Function.caller`, allowing sandboxed code to recover the internal `LispTyp
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
CVE-2026-40598
Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject H
MantisBT has a Content Security Policy bypass via attachments
CVE-2026-40597
Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-
Firewall for AI
Akamai 发布了一款名为“Firewall for AI”的新产品，旨在保护人工智能（AI）模型和应用免受分布式拒绝服务（DDoS）攻击、僵尸网络和其他网络威胁。该产品利用 Akamai 的全球边缘网络和安全智能，提供针对 AI 工作负
DP-LAC: Lightweight Adaptive Clipping for Differentially Private Federated Fine-tuning of Language Models
本文提出一种名为 DP-LAC 的轻量级自适应裁剪方法，用于解决联邦学习（FL）中差分隐私（DP）随机梯度下降（DP-SGD）的裁剪阈值自调整问题。在联邦微调大规模语言模型（LLM）时，DP-SGD 通过裁剪每个客户端贡献的梯度范数至阈值
Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation
本文研究了多模态检索增强生成（RAG）系统在医疗应用中的安全性，重点关注知识投毒攻击。现有攻击大多假设攻击者掌握用户查询的先验知识，这在真实场景中难以实现。为此，作者提出了M³Att攻击框架，仅需了解数据库的有限分布知识。核心思路是：向文本
Benchmarking Safety Risks of Knowledge-Intensive Reasoning under Malicious Knowledge Editing
大型语言模型（LLM）越来越依赖知识编辑来支持知识密集型推理，但这种灵活性也引入了关键的安全风险：攻击者可以注入恶意或误导性知识，破坏下游推理并导致有害结果。现有的知识编辑基准主要关注编辑效果，缺乏一个统一的框架来系统评估编辑知识对推理行为
Nautilus Compass: Black-box Persona Drift Detection for Production LLM Agents
本文提出Nautilus Compass，一个面向生产环境LLM coding agent的黑盒人格漂移检测与记忆层系统。研究背景：LLM agent在长时间会话中会出现人格漂移，例如遗忘用户指定的约束、重复已被用户指出的错误、虚构先前的协
Evaluating Tool Cloning in Agentic-AI Ecosystems
本文首次对智能体AI生态系统中的工具克隆现象进行了大规模测量研究。随着大型语言模型（LLM）智能体通过公共市场获取外部工具（如模型上下文协议(MCP)工具和Skills工具），工具数量激增，但其中大量工具可能源自克隆、轻度修改或共享模板，导
Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbit...
CVE-2026-34263
该漏洞存在于 SAP Commerce Cloud 中，由于 Spring Security 配置不当，导致未经身份验证的攻击者能够上传恶意配置并进行代码注入，最终实现任意服务器端代码执行。攻击者无需任何权限即可通过网络远程触发漏洞（CVS
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-control...
CVE-2026-34260
CVE-2026-34260 是 SAP S/4HANA 中 SAP Enterprise Search for ABAP 组件存在的一个严重 SQL 注入漏洞。该漏洞源于应用程序在处理用户可控输入时，未进行充分的验证和净化，直接将其拼接进
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
2026年5月12日，CrowdStrike发布博客称，其被Frost & Sullivan在《2026雷达：云原生应用保护平台》报告中评为领导者。该报告评估了CNAPP市场的主要厂商，CrowdStrike凭借Falcon平台在云工作负载
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection
Security & Identity
Security & Identity