2026-05-27 归档

今日共收录 1142 条安全情报，包含 375 个 CVE，381 篇安全通告，以及 103 篇研究论文。

← 返回归档列表

安全公告2026-05-26 发布INFO

There is a mitigation bypass / (incomplete fix) for CVE-2025-62582 (Unauthenticated Remote...

CVE-2026-9642

There is a mitigation bypass / (incomplete fix) for CVE-2025-62582 (Unauthenticated Remote Database Access) An unauthe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-321 #severity:critical

安全公告2026-05-26 发布INFO

SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with...

CVE-2025-68708

SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the

历史摘要 · 未重新核验 · GitHub Advisory

#advisory

安全公告2026-05-26 发布INFO

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android...

CVE-2025-68711

AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker

历史摘要 · 未重新核验 · GitHub Advisory

#advisory

安全公告2026-05-26 发布INFO

SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger...

CVE-2025-68709

SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript exe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory

安全公告2026-05-26 发布INFO

Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android...

CVE-2025-68710

Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with

历史摘要 · 未重新核验 · GitHub Advisory

#advisory

安全公告2026-05-26 发布INFO

code100x contains an authentication bypass vulnerability in the Mobile API that allows...

CVE-2026-8890

code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-639 #severity:high

安全公告2026-05-26 发布INFO

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated...

CVE-2026-3660

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update se

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-863 #severity:critical

安全公告2026-05-26 发布INFO

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in...

CVE-2026-48689

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffe

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-122 #cwe-787 #severity:critical

安全公告2026-05-26 发布INFO

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM...

CVE-2026-8633

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-94 #severity:critical

安全公告2026-05-26 发布INFO

Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

CVE-2026-39964

### Summary The Typebot viewer (`packages/embeds/js`) renders anchor tags from rich text bubble content without filteri

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #severity:medium

威胁情报2026-05-27 发布INFO

Firewall for AI

历史摘要 · 未重新核验 · Akamai Security Research

#ddos #botnet #akamai

威胁情报2026-05-26 发布INFO

Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations

Notable integrations include CrowdStrike, Palo Alto Networks, Microsoft, Okta, Zscaler, Netskope, Cloudflare, Fortinet,

历史摘要 · 未重新核验 · SecurityWeek

#enterprise #news #securityweek

威胁情报2026-05-26 发布INFO

Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment

Hardcoded machineKey values in a configuration file enabled ViewState deserialization attacks leading to remote code exe

历史摘要 · 未重新核验 · SecurityWeek

#enterprise #news #securityweek

学术论文2026-05-26 发布INFO

Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents

本文提出一种针对基于大语言模型（LLM）的智能体的新型防御框架——AuthGraph。LLM智能体被部署在电子邮件管理、金融交易、代码执行等高风险场景中，通过工具调用与外部世界交互。在执行过程中，智能体需要读取攻击者可控制的外部数据源（如邮

历史摘要 · 未重新核验 · arXiv cs.CR

#agent-security #llm

学术论文2026-05-25 发布INFO

An Efficient and Privacy-Preserving Architecture for Cross-Institutional Collaborative RAG

本文针对跨机构协作式检索增强生成（RAG）中存在的隐私法规导致的数据孤岛问题，提出了一种高效且保护隐私的联邦RAG架构FedRAG。传统联邦RAG系统因Transformer自注意力机制需要跨节点访问分布式键值缓存而面临根本冲突。FedRA

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.DC #federated-rag #privacy-preserving #fedrag #llm

学术论文2026-05-24 发布INFO

Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices

该论文针对大型语言模型（LLM）通过工具调用控制物理设备时面临的安全挑战，提出了一种名为Device Context Protocol（DCP）的紧凑、安全优先的通信协议。现有方案如Model Context Protocol（MCP）及其

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.NI #cs.LG #agent-security #llm #iot

学术论文2026-05-26 发布INFO

BAIT: Boundary-Guided Disclosure Escalation via Self-Conditioned Reasoning

本文提出了一种名为BAIT（Boundary-Aware Iterative Trap）的三步越狱框架，旨在通过引导大语言模型（LLM）逐步披露内部信息来实现恶意目标。BAIT方法首先要求模型识别其保护边界（即防御策略所禁止的敏感内容范围）

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.CL #agent-security #llm

学术论文2026-05-26 发布INFO

Cordyceps: Covert Control Attacks on LLMs via Data Poisoning

大型语言模型（LLM）常基于未经整理的数据集进行微调，攻击者可向这些数据注入毒化样本。现有的数据毒化攻击大多依赖固定的触发短语，这使得诸如异常检测、干净数据正则化或在线监控等防御手段可以有效缓解。本文提出一种新的数据毒化方法，通过利用共享知

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.AI #cs.LG #data-poisoning #covert-control #llm

学术论文2026-05-24 发布INFO

Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications

大型语言模型（LLM）的广泛部署迫切需要系统化的安全评估方法。现有方法要么依赖预定义视角的静态基准测试，要么采用动态红队探测潜在漏洞，但均存在依赖专家知识、缺乏系统保证、容易过时等局限。针对这些问题，本文提出 POLARIS 框架，将基于规

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.AI #cs.SE #agent-security #llm

学术论文2026-05-23 发布INFO

CyberMaskQA: A Privacy-Aware Benchmark for Evaluating Large Language Models in Cybersecurity Question Answering

本论文提出并构建了 CYBERMASKQA，一个面向网络安全问答的隐私感知基准数据集。当前，大型语言模型（LLM）被越来越多地用于事件响应、漏洞分析等关键网络安全问答任务，但真实操作环境中的系统日志、网络配置等上下文往往包含 IP 地址、主

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.LG #agent-security #llm