Acknowledgements
Acknowledgements
2026-08-14 归档
今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。
← 返回归档列表QMSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing.
本文针对模糊测试中未初始化内存使用（Use-of-Uninitialized-Memory, UUM）错误检测的实践难题提出了一种新的高效方案 QMSan。现有的模糊测试兼容 UUM 检测器 MSan 要求所有被测试程序的库都必须经过完全插
Beyond Indistinguishability: Measuring Extraction Risk in LLM APIs.
该论文针对大语言模型（LLM）API 中数据提取风险的定义与度量问题展开研究。作者指出，当前广泛使用的不可区分性（indistinguishability）属性——例如差分隐私上界或经验测量的成员推断攻击低风险——通常被当作模型具备足够抵御
Firewall for AI
Firewall for AI
A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part...
CVE-2026-19756
A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjec
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook...
CVE-2026-72851
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXE
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated...
CVE-2026-72842
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access b
Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders...
CVE-2026-72850
Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with t
Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api...
CVE-2026-72856
Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link...
CVE-2026-72849
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that...
CVE-2026-72776
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adj
A flaw has been found in EnzoVezzaro mcp-dominican-layer up to...
CVE-2026-19751
A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected el
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in...
CVE-2026-18741
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management mod
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential...
CVE-2026-8715
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in th
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access...
CVE-2026-19297
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary...
CVE-2026-17482
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper co
django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows...
CVE-2026-73531
django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend...
CVE-2026-72664
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on manag
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an...
CVE-2026-72640
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manage
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
CVE-2026-12243
# Summary nltk.data.load() and nltk.data.find() resolve user-supplied resource names to filesystem paths using url2pathn