Phoenix: Presence keys colliding with `Object.prototype` members break existence checks
CVE-2026-56812
### Summary The Phoenix JavaScript presence client (`assets/js/phoenix/presence.js`) tests whether a presence already e
2026-09-04 归档
今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。
← 返回归档列表ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
CVE-2026-63670
### Summary A mutation-XSS / allowedTags bypass: when `textarea` (or `xmp`) is included in `allowedTags`, an input conta
TOON: Prototype pollution when decoding untrusted TOON input
CVE-2026-82404
### Summary Decoding attacker-controlled TOON containing a `__proto__`, `constructor`, or `prototype` key wrote through
SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
本论文针对大型语言模型（LLM）智能体在安全运营中心（SOC）作为自主分析员时面临的两大核心限制：有限的上下文窗口无法容纳包含数千主机的身份认证图，以及自由文本生成无法保证推荐的安全处置动作与网络拓扑结构的一致性。为此，作者提出了 Sent
Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning
本文针对基于大语言模型的多智能体系统（MAS）的安全防护问题。现有基于拓扑引导的安全机制通常在图神经网络（GNN）上利用智能体间的通信图来定位风险智能体和干预网络结构，但这类方法假设单一操作者能够汇总所有带标签的轨迹。在跨组织的真实环境中，
SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment
Mixture-of-Experts (MoE) 是一种用于大规模语言模型的缩放架构，每次前向传播只激活少量专家模块，从而在近恒定计算量下实现海量参数增长。混合 MoE 进一步引入共享专家（shared expert）来捕获普遍有用的表示，
Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models
该论文研究了大型语言模型（LLM）在用户要求模型自行设计身份验证测试时的行为。作者设计了一个分阶段的开发者身份实验，测试了ChatGPT、Claude、Qwen、Mistral和Llama五种主流模型。实验中，用户声称“我是你的开发者”并要
Athena: Vulnerability-Affected Library Identification via Knowledge Graph Completion
该论文针对软件供应链安全中的一个关键问题：漏洞数据库条目中常存在受影响库信息缺失或错误，导致单点漏洞难以准确扩散到下游依赖应用。现有自动化方法大多将受影响库识别视为孤立的文本检索任务，忽略了漏洞数据库中实体之间的关联结构。为此，作者提出 A
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely acces...
CVE-2026-85148
CVE-2026-85148 涉及由 Lightstar 开发的 SmartIT Desktop Manager 中存在硬编码凭据（Use of Hard-coded Credentials）安全漏洞。该漏洞允许未认证的远程攻击者利用一个固
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials...
CVE-2026-85146
CVE-2026-85146 是 Lightstar 公司开发的 SmartIT Desktop Manager 产品中存在的硬编码凭证漏洞。该漏洞源于应用程序源代码中直接写入了 SSH 服务账户和 SmartIT Agent 的密码，未认
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud