fast-uri vulnerable to host confusion via literal backslash authority delimiter
CVE-2026-16221
### Impact `fast-uri` v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's na
2026-07-22 归档
今日共收录 2277 条安全情报，包含 1464 个 CVE，419 篇安全通告，以及 96 篇研究论文。
← 返回归档列表Gitea: Notification API leaks private issue metadata after access revocation
CVE-2026-58419
# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private
Gitea: Unauthorized Access to Labels of Private Organizations
CVE-2026-25038
## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpo
Tracing the Shadows: Automatic Tracking and Analysis of Crypto Money Laundering via Transaction Semantic Analysis
随着去中心化金融（DeFi）的快速发展，与加密货币相关的安全事件日益增多。攻击者在事件发生后通常尝试快速转移被盗资产，隐藏非法资金的来源并最终兑换为法币。然而，现有的反洗钱（AML）方法难以应对DeFi交易的语义复杂性：它们要么过度依赖底层
They'll Verify. They Just Won't Act. How Authority Framing and Laundered Code Turn a Trusted Agentic CI/CD Pipeline Into an Attack Surface
本研究构建了一个由五个独立智能体组成的 CI/CD 流水线（分类 → 开发者 → 安全扫描 → 代码审查 → 批准/部署），每个智能体使用来自三个供应商的不同生产级 LLM，并置于影子模式下的 LLM 防火墙之后。一个不受信任的外部 iss
Find Before You Fine-Tune: A Diagnostic Study of Small LLMs for Cybersecurity QA
该论文针对网络安全领域问答 (QA) 任务中微调小型语言模型 (LLMs) 的挑战，提出了一种任务导向的诊断框架 FiT (Find before Fine-Tune)。研究背景是：尽管微调能提升领域对齐，但可能侵蚀先验知识、削弱指令遵循能
RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery
该论文提出了一种针对基于LLM的编码代理（coding agent）在发现跨站脚本（XSS）漏洞时的验证框架RECEIPT。由于LLM代理在探索应用时可能产生不可信的报告（例如虚假声称找到漏洞），作者首先刻画了三种奖励黑客（reward-h
CryptanalysisBench: Can LLMs do Cryptanalysis?
该论文研究了大型语言模型（LLM）在密码分析任务上的能力。密码分析处于数学推理与网络安全交叉点，这两领域正是LLM进展最快的方向。作者构建了CryptanalysisBench基准测试，包含191个任务，覆盖6类密码原语（分组密码、哈希函数
Towards an Automated Test of LLM Security Knowledge
本文提出了一种半自动化的方法来评估大型语言模型（LLM）在特定安全领域的知识水平。当前评估LLM安全知识的主要方式是构建挑战问题集或任务基准，这些方法需要大量人工工作和安全专业知识。作者利用消费者保护机构（CPA）发布的权威信息，通过检测L
GARAGE: Characterizing the Automation Boundary in LLM-based Attack Graph Generation
该论文提出GARAGE，一个基于检索增强生成（RAG）的框架，旨在解决当前自动化工具在处理非结构化网络威胁情报（CTI）和汽车行业特定架构细节方面的不足。GARAGE将分散的CTI转化为可操作的领域特定知识库，用于自动生成攻击图。具体地，它
Measuring and Evaluating the Performance of Generative AI Models for Scam Detection
本文研究生成式AI模型（特别是大型语言模型，LLMs）在诈骗检测中的实际表现。随着在线诈骗造成日益严重的财产和个人伤害，基于LLM的检测系统已被广泛应用于邮件网关、浏览器扩展和欺诈监控面板等安全产品中。然而，一个普遍假设是这些模型天生适合所
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments