Benchmarking the Benchmarks: Evaluating Automated Safety Benchmarks for Small Language Models
这篇 arXiv 论文系统性地评估了现有自动化安全基准在小型语言模型（SLM）上的适用性与可靠性。研究背景是：SLM 正越来越多地被部署在资源受限、对隐私敏感的场合（如边缘设备、本地推理），其安全性和偏见问题可能引发实际的安全与社会风险。然
2026-08-21 归档
今日共收录 1701 条安全情报，包含 827 个 CVE，444 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Beyond the Hype: Evaluating LLM Integration and Practical Limitations in Security Operation Centers
本文通过半结构化访谈 20 名安全运营中心（SOC）从业人员（包括一线分析师、SOC 经理和工具开发者），系统评估了大语言模型（LLM）在 SOC 中的集成现状与实际限制。研究背景是 LLM 正越来越多地被引入 SOC 以支持日志摘要、告警
决赛直播｜第四届阿里CTF安全挑战赛
该事件为第四届阿里CTF安全挑战赛的决赛直播通知，由阿里安全团队主办，先知社区发布。标题为“决赛直播｜第四届阿里CTF安全挑战赛”，发布时间为2026年8月21日。输入数据仅包含标题、来源、标签（community、research、xia
Winter: CSRF through AJAX handler names reachable as backend page actions
### Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level `GET` naviga
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
### Impact Users with the `backend.manage_branding` ("Customize the back-end") or `backend.manage_editor` ("Manage glob
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
### Impact Affected versions of Winter CMS did not enforce the `ImportExportController` behavior's granular access cont
Winter: My Account preview exposes another backend user's profile by record ID
### Impact `Backend\Controllers\MyAccount`, introduced in v1.2.13, declares an empty `$requiredPermissions` array so th
Winter: Stored XSS through Backend List widget image columns
### Impact `Backend\Widgets\Lists::evalImageTypeValue()` interpolated the resolved image URL into a single-quoted `src`
Fleet: ORDER BY column injection on activity list endpoints
### Summary An authenticated user with read access to Activity could influence the `ORDER BY` clause of the activity li
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
### Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to e
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
### Impact Affected versions of Winter CMS allow authenticated backend users with the `cms.manage_assets` permission ("
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
## Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution Th
AGFlow 三洞审计：补丁追着漏洞跑，有个版本掉队了
AGFlow 三洞审计：补丁追着漏洞跑，有个版本掉队了
Windows11 0day内核提权漏洞分析与利用（CVE-2026-62737）
CVE-2026-62737
Windows11 0day内核提权漏洞分析与利用（CVE-2026-62737）
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
CVE-2026-73570
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, accordi
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
CVE-2026-32475
Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if succe
Hackers Target Zimbra Servers in Active Exploitation Campaign
CVE-2026-73570
Exploitation of the Zimbra Collaboration vulnerability CVE-2026-73570 has been observed by Poland’s CERT Polska. The pos
Critical GitLab Flaw Exploited Shortly After Disclosure
CVE-2026-19478
CVE-2026-19478 can be exploited without authentication to modify or delete public projects and user data. The post Criti
TENET: Telegram Mini App (in)security
本文针对 Telegram Mini App 生态的安全问题展开研究。Telegram 拥有超过 4.5 亿日活用户，Mini App 作为内嵌于客户端的网页应用，引入了显著的安全风险。研究发现，许多 Mini App 将认证材料（如会话令
Linguistic Holonomy and Statistical Watermarks: Inner Geometry of Meaning-Preserving Transformations
该论文提出了一种全新的理论框架，用于分析语言模型统计水印在语义保持变换下的鲁棒性。传统观点认为，水印的脆弱性源于其依赖于同义替换等保持意义的变换，而现有评估方法通常仅通过变换前后文本的语义相似度（即端点相似度）来衡量水印的存留。作者指出，这