A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame...
CVE-2026-8836
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/sn
2026-05-19 归档
今日共收录 917 条安全情报，包含 132 个 CVE，384 篇安全通告，以及 107 篇研究论文。
← 返回归档列表DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields...
CVE-2026-45231
DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, descripti
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
CVE-2026-45553
### Summary `ui.restructured_text()` renders reStructuredText server-side with Docutils without disabling file insertio
HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap...
CVE-2026-29964
HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to impro
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file...
CVE-2026-45230
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelet
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to...
CVE-2026-42822
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges ove
CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion
CVE-2026-45727
The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path comp
Formie: Pre-authenticated server-side template injection in Hidden fields
CVE-2026-45697
### Impact - Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that wer
LibreNMS: Cross-Site Scripting in ShowConfigController
CVE-2026-2728
### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the ShowConfig page of devices affected by the R
Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
CVE-2026-45298
## Summary In a default dozzle deploy (the documented quickstart, no `DOZZLE_AUTH_PROVIDER` set), `POST /api/notificati
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
CVE-2026-45138
## Summary The custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (
Firewall for AI
Akamai 发布了名为“Firewall for AI”的新产品，旨在保护AI工作负载免受分布式拒绝服务（DDoS）攻击和其他网络威胁。该产品针对AI API和模型推理端点，提供应用层和网络层的防护，包括速率限制、机器人检测和流量分析。由
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More
本周安全新闻汇总了多个重大事件：Microsoft Exchange 0-day漏洞被积极利用，攻击者利用漏洞入侵邮件服务器；npm生态中发现蠕虫，恶意软件包通过依赖关系传播；攻击者在GitHub上创建虚假AI模型仓库，诱导用户下载信息窃取
STRIKE: A Structured Taxonomy of Cybercrime for Risk, Impact, Knowledge, and Evolution
网络犯罪在规模和复杂性上呈指数级增长，传统分类方案难以捕捉现代威胁的复杂性和多样性。为此，本文提出 STRIKE（Structured Taxonomy for Risk, Impact, Knowledge, and Emerging T
GRID: Graph Representation of Intelligence Data for Security Text Knowledge Graph Construction
安全知识图谱能为安全智能体提供可计算的外部记忆，但从长篇网络威胁情报（CTI）文本中构建知识图谱面临挑战：大语言模型（LLM）缺乏扎实的安全领域知识，且端到端的文档-图谱训练难以用廉价稳定的奖励进行监督。本文提出 GRID（Graph Re
From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation
该论文提出一个统一的端到端框架，弥合了网络入侵检测与响应之间的鸿沟。框架由两个紧密耦合的阶段组成：第一阶段使用三个独立训练的二元深度神经网络（DNN）集成模型，对网络流量流进行分类，区分为良性、拒绝服务（DoS）或分布式拒绝服务（DDoS）
ADR: An Agentic Detection System for Enterprise Agentic AI Security
该论文提出了 Agentic AI Detection and Response (ADR) 系统，这是首个大规模、生产验证的企业级框架，用于保护通过 Model Context Protocol (MCP) 运行的 AI 代理。作者识别了
A Multi-Layer Cloud-IDS Pipeline with LLM and Adaptive Q-Learning Calibration
该论文针对云计算环境中入侵检测系统（IDS）面临的挑战——分层动态架构、未知攻击/零日攻击，以及机器学习模型在实验环境表现良好但在实际云部署中性能下降的问题，提出了一种基于强化学习的多层级、置信度感知的入侵检测框架。系统覆盖网络层、主机层和
Asking Back: Interaction-Layer Antidistillation Watermarks
这篇论文针对大型语言模型（LLM）API服务中难以检测的未授权知识蒸馏问题，提出了一种新颖的交互层反蒸馏水印方案。现有防御手段主要在教师模型的输出token层面施加水印，例如绿名单水印、密码学方案或反蒸馏采样，但这些方法容易被攻击者通过改写
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike 于 2026 年 5 月 19 日发布博客，宣布被 Frost & Sullivan 评为 2026 年雷达报告中云原生应用保护平台（CNAPP）的领导者。该报告评估了多家云安全厂商，CrowdStrike 因其在