【大模型服务平台 TokenHub】&【智能体开发平台】& 【云开发 CloudBase】 关于腾讯云 MiniMax-M2.5 模型下线及切换升级的通知

【大模型服务平台 TokenHub】&【智能体开发平台】& 【云开发 CloudBase】 关于腾讯云 MiniMax-M2.5 模型下线及切换升级的通知

历史摘要 · 未重新核验 · 腾讯云安全公告

MFSA 2026-66Security Vulnerabilities fixed in Firefox for iOS 152.4

MFSA 2026-66Security Vulnerabilities fixed in Firefox for iOS 152.4

历史摘要 · 未重新核验 · Mozilla Security Advisories

APSB26-77: Security update available for Adobe Creative Cloud Desktop Application

APSB26-77: Security update available for Adobe Creative Cloud Desktop Application

历史摘要 · 未重新核验 · Adobe Security Bulletins

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature...

CVE-2026-1609

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user ac

历史摘要 · 未重新核验 · GitHub Advisory

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level...

CVE-2026-63175

PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level variables rather than in

历史摘要 · 未重新核验 · GitHub Advisory

ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

CVE-2026-58196

# Security Advisory: SSRF in remote MCP server authentication discovery **Severity:** High. **CWE:** CWE-918. **Affecte

历史摘要 · 未重新核验 · GitHub Advisory

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

CVE-2026-50285

## Summary The HPKE V2 URL decode path in `pkg/hpke/url.go` decompresses attacker-controlled zstd data without any size

历史摘要 · 未重新核验 · GitHub Advisory

ViewComponent: Reused Component Instances Retain Stale Render Context

CVE-2026-54497

# Reused Component Instances Retain Stale Render Context ## Summary `ViewComponent::Base` instances retain multiple re

历史摘要 · 未重新核验 · GitHub Advisory

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

CVE-2026-53656

### Impact The FiftyOne App/API server (`fiftyone/server/app.py`) and the `/media` route (`fiftyone/server/routes/media

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform...

CVE-2026-20298

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform...

CVE-2026-20296

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26

历史摘要 · 未重新核验 · GitHub Advisory

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code...

CVE-2026-40501

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in S

历史摘要 · 未重新核验 · GitHub Advisory

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud...

CVE-2026-20297

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector ...

CVE-2026-20146

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

历史摘要 · 未重新核验 · GitHub Advisory

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

CVE-2026-54494

## Summary Koel's outbound-URL guard `App\Helpers\Network::isPublicHost()` classifies an IP as "public" using PHP's `fi

历史摘要 · 未重新核验 · GitHub Advisory

Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

CVE-2026-50552

Summary Koel v9.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint

历史摘要 · 未重新核验 · GitHub Advisory

LangBot: Authenticated RCE Via MCP Configuration

CVE-2026-54449

### Summary Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the M

历史摘要 · 未重新核验 · GitHub Advisory

When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems

该论文研究了多智能体LLM系统中的分布式后门攻击问题。在多智能体环境中，每个LLM智能体可以调用工具、发送消息，系统通常会部署运行时监控器检查每个步骤或消息的合法性。然而，论文揭示了一个根本漏洞：攻击者可以将有害载荷分割成多个无害的片段，分

历史摘要 · 未重新核验 · arXiv cs.CR

WaterMoE: Expert-Routing-based Watermarking for High Fidelity and Efficiency

大型语言模型（LLM）的成功应用带来了内容溯源和滥用的担忧，因此可靠的水印技术不可或缺。然而现有水印技术在实际部署中面临两个主要障碍：一是严重降低模型性能，二是增加推理开销。为了验证这一问题，作者构建了一个涵盖不同生成任务的综合基准，系统评

历史摘要 · 未重新核验 · arXiv cs.CR

ProfMalPlus: Agent-Coordinated Detection of Malicious NPM Packages via Static-Dynamic Analysis Synergy

本文提出ProfMalPlus，一个用于检测恶意NPM包的新型系统。开源软件通过传递依赖容易受到供应链攻击，尤其是注入到NPM包中的恶意代码。现有检测器通常存在以下不足：对混淆行为建模不充分、忽略JavaScript的面向对象特性、静态与动

历史摘要 · 未重新核验 · arXiv cs.CR