An LLM-Driven Fuzzing Framework for Detecting Logic Instruction Bugs in PLCs.
本文提出 LogicFuzz，据作者称这是首个专门针对可编程逻辑控制器（PLC）固件中逻辑指令库进行模糊测试的框架。PLC 广泛用于工业自动化，其逻辑指令库由供应商提供并编译进设备固件，若存在安全缺陷，可能被物理控制程序、网络服务或运行时子
2026-08-08 归档
今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Prεεmpt: Sanitizing Sensitive Prompts for LLMs.
本文针对大型语言模型（LLM）推理阶段中提示词（prompt）包含敏感信息可能泄露给专有LLM API 的隐私问题，提出了一种基于密码学思想的提示词净化器（prompt sanitizer）概念及其系统实现 Prmpt（论文标题中写作 Pr
Firewall for AI
Firewall for AI
Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the...
CVE-2026-11425
Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allo
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
CVE-2026-71851
### Summary `CryptoJS.lib.WordArray.random()` in affected versions is not a cryptographically secure random number gene
Six Android App Widget configuration activities in the Datadog Android application are declared...
CVE-2026-44965
Six Android App Widget configuration activities in the Datadog Android application are declared android:exported="true"
The launcher activity AppActivity in the Datadog Android application is declared android:exported...
CVE-2026-47363
The launcher activity AppActivity in the Datadog Android application is declared android:exported="true" with launchMode
On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId...
CVE-2026-47364
On every successful login, the Datadog Android application calls FirebaseCrashlytics.setUserId with the signed-in user's
The Datadog Android application stores operationally sensitive content in plaintext SQLite...
CVE-2026-47362
The Datadog Android application stores operationally sensitive content in plaintext SQLite databases via Room. Two datab
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated...
CVE-2026-64637
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer...
CVE-2026-68772
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attacke
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with...
CVE-2026-17596
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:cre
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD:...
CVE-2026-19208
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
CVE-2026-67422
### Summary Four inline processors in pymdown-extensions contain regular expressions with exponential backtracking. A s
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
CVE-2026-63223
### Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable a
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
CVE-2026-63221
### Impact A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is u
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
CVE-2026-54164
## Summary The API Platform serializer's `AbstractItemNormalizer` does not validate the resource type returned when res
Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that...
CVE-2022-4995
Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthent
Postiz is an open-source social media scheduling tool. The route that serves locally stored media...
CVE-2026-19264
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied pat
Firefox browsers
Firefox browsers