2026-05-20 归档

今日共收录 1110 条安全情报，包含 284 个 CVE，411 篇安全通告，以及 113 篇研究论文。

安全公告2026-05-20 发布INFO

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an...

CVE-2026-24207

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-288 #severity:critical

安全公告2026-05-20 发布INFO

The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up...

CVE-2026-8418

The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-352 #severity:medium

安全公告2026-05-20 发布INFO

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable...

CVE-2026-7284

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-269 #severity:critical

安全公告2026-05-20 发布INFO

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions...

CVE-2026-6555

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-434 #severity:critical

安全公告2026-05-20 发布INFO

The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress...

CVE-2026-6394

The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

安全公告2026-05-19 发布INFO

FileBrowser Quantum: unauthenticated user share share info

CVE-2026-46410

### Impact Some sensitive info -- such as source and path can get exposed. ### Patches Update to the latest version ##

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-200 #severity:high

安全公告2026-05-19 发布INFO

Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

CVE-2026-46378

### Summary `dasel`'s selector lexer enters a non-terminating loop when tokenizing an unterminated regex pattern such a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-835 #severity:high

安全公告2026-05-19 发布INFO

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

CVE-2026-46377

### Summary `dasel`'s selector lexer panics with an index-out-of-range error when tokenizing a quoted string that ends

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-129 #severity:high

安全公告2026-05-19 发布INFO

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

CVE-2026-46338

# Summary `pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_pat

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #severity:medium

安全公告2026-05-19 发布INFO

Trubo: Login callback CSRF/session fixation

CVE-2026-45773

### Impact Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost cal

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-352 #severity:medium

安全公告2026-05-19 发布INFO

Turbo: Unexpected local code execution during Yarn Berry detection

CVE-2026-45772

### Impact Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain ma

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-426 #severity:low

威胁情报2026-05-20 发布INFO

Firewall for AI

历史摘要 · 未重新核验 · Akamai Security Research

#ddos #botnet #akamai

威胁情报2026-05-19 发布INFO

TP-Link, Photoshop, OpenVPN, Norton VPN vulnerabilities

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed eight vulnerabilities in TP-Link, and one each i

历史摘要 · 未重新核验 · Cisco Talos

#vuln_research #talos #cisco #malware

学术论文2026-05-19 发布INFO

Auditing Privacy in Multi-Tenant RAG under Account Collusion

该论文研究多租户检索增强生成（RAG）服务中的隐私审计问题，特别是当多个同一租户下的账户串通共谋时，每个账户声称的差分隐私（DP）保证会如何退化。作者首先指出，现有RAG系统通常为每个账户提供针对索引的（ε_acc, δ_acc）-DP保证

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.IR #cs.LG #agent-security #llm #rag #differential-privacy

学术论文2026-05-18 发布INFO

OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences

该论文研究记忆增强型大语言模型（LLM）代理的安全性问题。这类代理通过迭代反思和自我进化来解决复杂任务，但现有针对代理记忆的攻击要么需要高权限（如直接控制系统提示或记忆数据库），要么依赖显式恶意内容，容易被先进的安全过滤器检测到。论文发现，

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.AI #cs.LG #agent-security #llm #poisoning #self-evolution

学术论文2026-05-18 发布INFO

From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation

该论文提出一个统一的端到端框架，旨在弥合网络入侵检测与可操作响应之间的鸿沟。框架由两个紧密耦合的阶段组成：第一阶段使用三个独立训练的二元深度神经网络（DNN）集成，将网络流量分类为良性、拒绝服务（DoS）或分布式拒绝服务（DDoS），在CI

历史摘要 · 未重新核验 · arXiv cs.CR

#network-security #intrusion-detection #rag #deep-learning

学术论文2026-05-18 发布INFO

Speed Kills: Exploring Confused Deputy Attacks Through Edge AI Accelerators

本文首次系统研究了边缘AI加速器（AIA）中的confused deputy攻击（CDA）。AI加速器是专用硬件（如TPU），用于高效执行AI应用和端侧推理。与常规应用不同，AIA不受操作系统限制，且对应用处理器（AP）的安全机制（如内核/

历史摘要 · 未重新核验 · arXiv cs.CR

#edge-ai #confused-deputy #ai-accelerator

学术论文2026-05-17 发布INFO

ADR: An Agentic Detection System for Enterprise Agentic AI Security

本文提出了Agentic AI Detection and Response (ADR) 系统，这是首个大规模、经过生产验证的企业级AI代理安全框架，专门用于保护通过Model Context Protocol (MCP) 运行的AI代理。

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.AI #cs.LG #agent-security #llm

漏洞预警2026-05-20 发布CRITICAL

The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOC...

CVE-2026-7637

WordPress Boost插件（版本2.0.3及以下）存在PHP对象注入漏洞。该漏洞源于插件在处理STYXKEY-BOOST_USER_LOCATION cookie时，对未信任输入进行了不安全的反序列化。攻击者无需认证即可通过精心构造

历史摘要 · 未重新核验 · NVD

#cve #cwe-502

威胁情报2026-05-20 发布INFO

CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms

历史摘要 · 未重新核验 · CrowdStrike

#crowdstrike #apt #edr