Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming
该论文研究如何通过一个自动化的智能体研究环境，对另一个生产级LLM智能体进行自动化红队测试，以发现可复用的漏洞知识。作者提出了AHA（智能体攻击智能体）框架，这是一个可证伪的发现循环：首先提出一个漏洞假设，然后构造一个验证器（falsifi
2026-07-15 归档
今日共收录 995 条安全情报，包含 81 个 CVE，528 篇安全通告，以及 87 篇研究论文。
← 返回归档列表HedgeDoc: Stored HTML injection via email local-part
CVE-2026-58487
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe
9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints
CVE-2026-59801 · CVE-2026-62327 · CVE-2026-62328
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attack
9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
CVE-2026-59801 · CVE-2026-62328 · CVE-2026-62327
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attac
9Router 0.4.41 - Unauthenticated API Exposure via /api/providers
CVE-2026-62327 · CVE-2026-62328 · CVE-2026-59801
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact
M365 Copilot for iOS Elevation of Privilege Vulnerability
CVE-2026-58617
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a ne
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2026-58613
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2026-58536
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery
CVE-2026-62197
OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket
MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
CVE-2026-58500
MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In
CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
CVE-2026-62240
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one
Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing
CVE-2026-61504
Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be
Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests
CVE-2026-61502
Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its
Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer
CVE-2026-61501
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote u
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending reques...
CVE-2026-59801
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain...
CVE-2026-13385
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web...
CVE-2026-11851
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in...
CVE-2025-56365
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model co
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
CVE-2026-50157
### Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect H
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS