Privilege and confidentiality in generative AI workflows
本文聚焦于生成式人工智能工作流中的特权与保密性问题。作者指出，生成式AI系统通过三种不同方式存储和处理客户数据：训练与记忆中的模型参数、实时会话中的上下文窗口以及用于检索增强生成（RAG）的知识数据库。每种模式都会对保密性和法律职业特权产生
2026-07-09 归档
今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。
← 返回归档列表FDIFormer:Protocol-Aware Transformer Learning for False Data Injection Attack Detection in Smart Grid Networks
该论文聚焦于智能电网中基于IEC 61850协议的GOOSE消息面临的虚假数据注入（FDI）攻击检测问题。智能电网依赖通信网络和智能电子设备实现可靠的自动运行，但这也使其容易遭受网络攻击，如消息篡改、虚假命令注入和拒绝服务攻击。其中FDI攻
pypdf: Possible long runtimes for repeated malformed cross-reference entries
CVE-2026-59937
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malf
pypdf: Possible large memory usage for wrong image dimensions
CVE-2026-59938
pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with declared imag
Denial of service via crafted push/pull gossip message in memberlist
CVE-2026-14362
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling tha
Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
CVE-2026-59731
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially deco
Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver
CVE-2026-60102
Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb dri
Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files
CVE-2026-59927
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directive in src/mistune/dir
Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions
CVE-2026-59928
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repe
Mistune: Arbitrary File Read via Include directive path traversal
CVE-2026-59924
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes use
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
CVE-2026-59929
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/rende
inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
CVE-2026-59925
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-ast
Mistune: XSS via unescaped class option in Admonition directive
CVE-2026-59926
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_admonition() in src/mistune/direc
U-Boot 2026.04-rc3 Buffer Overflow in nfs_readlink_reply() via NFS READLINK
CVE-2026-29009
U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONF
U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()
CVE-2026-29008
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
CVE-2026-59923
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_url() does not block p
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content
CVE-2026-59930
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents direc
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
CVE-2026-59922
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or c
U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c
CVE-2026-29007
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFI
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
CVE-2026-59895
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in