Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control

本文研究了大型语言模型（LLM）作为自主代理时，其工具调用权限控制的安全缺陷。作者指出，当未授权工具出现在代理的上下文窗口中时，即使模型被明确指示禁止调用，在对抗性场景下仍可能被选中。现有基于提示（prompt）的约束方法效果有限，只能将未

历史摘要 · 未重新核验 · arXiv cs.CR

An Empirical Study of Privacy Leakage Chains via Prompt Injection in Black-Box Chatbot Environments

本文针对基于大型语言模型（LLM）的聊天机器人代理，研究了一种通过间接提示注入实现隐私泄露的攻击链。研究背景是：LLM代理通过结合自然语言推理和外部工具（如网页浏览）来处理用户请求，这提升了可用性，但也带来了安全风险，因为不可信的外部内容可

历史摘要 · 未重新核验 · arXiv cs.CR

Safety Geometry Collapse in Multimodal LLMs and Adaptive Drift Correction

多模态大语言模型（MLLM）在文本模态中学习到的安全能力往往无法泛化到语义等价的非文本输入（如图像、视频），导致持续的多模态安全差距。本文从表示几何的角度研究这一现象，通过分析文本对齐的拒绝方向（refusal direction）和模态引

历史摘要 · 未重新核验 · arXiv cs.CR

Protection Is (Nearly) All You Need: Structural Protection Dominates Scoring in Globally Capped KV Eviction

本文研究了在共享全局上限的解码时（decode-time）场景下，多种KV缓存逐出策略（LRU, H2O, SnapKV, StreamingLLM, Ada-KV, QUEST, Random）的表现。作者发现，这些策略存在一个共同的漏洞

历史摘要 · 未重新核验 · arXiv cs.CR

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

多模态大语言模型（MLLMs）在接收多图像输入时存在安全隐患。现有越狱方法仅使用单张图像，限制了攻击空间：无法将有害请求分布到多张图像、携带丰富信息或利用额外视觉推理任务分散模型注意力。本文提出一种组合式越狱框架DMN，通过分布式指令（Di

历史摘要 · 未重新核验 · arXiv cs.CR

Refusal Evaluation in Coding LLMs and Code Agents: A Systematic Review of Thirteen Malicious-Code Prompt Corpora (2023-2025)

本文系统综述了2023-2025年间发布的13个公开恶意代码提示语料库（包括AdvBench、CyberSecEval系列、RMCBench、RedCode、MCGMark、JailbreakBench、CySecBench、Malware

历史摘要 · 未重新核验 · arXiv cs.CR

phpMyFAQ: Default Empty API Token Authentication Bypass

### Summary A default empty API client token allows any unauthenticated user to create and modify FAQ entries, categori

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: IDOR Account Takeover

### Summary An Insecure Direct Object Reference (IDOR) vulnerability in phpMyFAQ's Admin API allows any authenticated ad

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation

### Summary The password reset API can be triggered without authentication and without any out-of-band confirmation ste

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows

## Summary The `/api/v1/chatflows/apikey/:apikey` endpoint (whitelisted, accessible with API key auth only) returns all

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification

### Summary A Mass Assignment vulnerability in the PUT /api/v1/user endpoint allows authenticated users to directly modi

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage

### Summary The TTS generation endpoint sets `Access-Control-Allow-Origin: *` as a hardcoded response header, independe

历史摘要 · 未重新核验 · GitHub Advisory

wger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None

## Summary GHSA-mhc8-p3jx-84mm (CVE-2026-43948) reported that wger's `reset_user_password` and `gym_permissions_user_ed

历史摘要 · 未重新核验 · GitHub Advisory

OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server

### Impact Unauthenticated denial of service. ### Summary When installing provider or module packages from attacker-co

历史摘要 · 未重新核验 · GitHub Advisory

Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions

### Impact This affects only workflows that pin an exact affected Composer semver version through setup-php, for example

历史摘要 · 未重新核验 · GitHub Advisory

Apache Camel JMS 反序列化(CVE-2026-40860)漏洞分析

CVE-2026-40860

Apache Camel JMS 反序列化(CVE-2026-40860)漏洞分析

历史摘要 · 未重新核验 · 先知社区

Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks

CVE-2026-9082

Drupal has released security updates for a "highly critical" security vulnerability in Drupal Core that could be exploit

历史摘要 · 未重新核验 · The Hacker News

Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

CVE-2026-45585

Microsoft on Tuesday released a mitigation for a BitLocker bypass vulnerability named YellowKey following its public dis

历史摘要 · 未重新核验 · The Hacker News

Devilray: A Systematic Adversarial Model Revealing Blind Spots in Fake Base Station Detection

本文针对虚假基站（FBS）检测领域面临的现实挑战展开研究。过去二十年来，由于获取商用FBS（C-FBS）设备存在巨大的财务和监管壁垒，研究者无法直接观察真实攻击行为，导致检测系统多基于自建原型进行设计与评估，可能遗漏实际攻击面的关键盲区。为

历史摘要 · 未重新核验 · arXiv cs.CR

Hallucination as Exploit: Evidence-Carrying Multimodal Agents

该论文提出了一种新型安全威胁：多模态智能体中的“幻觉即利用”（Hallucination as Exploit）。多模态智能体通过截图、文档、网页等视觉输入选择工具调用。当模型产生错误的视觉主张（如误认页面元素）并触发点击、邮件发送、数据提

历史摘要 · 未重新核验 · arXiv cs.CR