Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents
该论文针对持久化AI代理（Persistent AI Agents）的安全性提出了一种新的运行时防御框架。与传统单轮对话助手不同，持久化AI代理通过长期运行的软件系统与用户交互，其不安全内容可通过持久化状态、可复用技能和工具中介交互传播，形
2026-07-13 归档
今日共收录 797 条安全情报，包含 77 个 CVE，415 篇安全通告，以及 53 篇研究论文。
← 返回归档列表Locating the Security Patches for Disclosed OSS Vulnerabilities with Vulnerability-Commit Correlation Ranking.
本文针对开源软件（OSS）漏洞的安全补丁定位问题展开研究。安全补丁是防御漏洞威胁的关键，但现有方法主要依赖CVE/NVD中的辅助信息（如漏洞描述、影响版本）来缩小补丁提交的搜索范围，然而这些方法在实践中的覆盖率极低——初步研究表明，即使借助
Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`
CVE-2026-10666
parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the
Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)
CVE-2026-10664
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src
filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
CVE-2026-61874
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, all
Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint
CVE-2026-56336
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain
Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint
CVE-2026-56313
Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that al
Capgo - Insufficient Authentication in Email Change Endpoint
CVE-2026-56308
Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification
Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
CVE-2026-56281
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit p
Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker...
CVE-2026-58596
Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges o
Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized...
CVE-2026-58281
Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ove
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
多款Huawei路由器信息泄露漏洞
多款Huawei路由器信息泄露漏洞
SV-TrustEval-C: Evaluating Structure and Semantic Reasoning in Large Language Models for Source Code Vulnerability Analysis.
该论文提出了一个名为 SV-TRUSTEVAL-C 的基准测试，用于评估大语言模型（LLM）在 C 语言源代码漏洞分析中的结构推理和语义推理能力。结构推理评估模型在不同数据流和控制流复杂度下识别代码元素间关系的能力；语义推理则检验模型在代码
A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This...
CVE-2026-15524
A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of t
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this...
CVE-2026-15511
A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function sy
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some...
CVE-2026-15512
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the
Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO...
CVE-2026-56313
Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that al
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats...
CVE-2026-56281
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit p