CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generation
该论文研究检索增强代码生成（RACG）系统中的知识投毒攻击。RACG通过从外部代码库、文档和补丁中检索知识并注入到生成上下文，显著提升了大语言模型（LLM）的代码生成能力，但也引入了新的信任边界：恶意构造的代码工件可以在不修改底层LLM的情
2026-09-05 归档
今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Stable Channel Update for Desktop
CVE-2026-85049 · CVE-2026-85047 · CVE-2026-85051 · CVE-2026-85043 · CVE-2026-85044 · CVE-2026-85050 · CVE-2026-85048 · CVE-2026-85053 · CVE-2026-85042 · CVE-2026-85045 · CVE-2026-85046 · CVE-2026-85052
The Stable channel has been updated to 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, which will rol
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
CVE-2026-80825
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx headroom in usb_sdio_
QAnything 2.0.0 Unauthenticated Cross-User File Disclosure
CVE-2026-85671
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_
Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router
CVE-2026-85607
Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.up
Traefik before v2.11.55 mTLS Bypass via TLS Option Conflict
CVE-2026-85597
Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the ...
CVE-2026-75925
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
CVE-2026-75160
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an ...
CVE-2026-85184
@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
CVE-2026-70403
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log i
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
CVE-2026-69657
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
CVE-2026-61614
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tok
erofs: remove fscache backend entirely
CVE-2026-80899
In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over
netfs: release readahead folios on iterator preparation failure
CVE-2026-80897
In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator prepara
erofs: cap LZMA stream pool size
CVE-2026-80892
In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompre
sctp: reject stale cookies with mismatched verification tags
CVE-2026-80890
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verifica
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
CVE-2026-80863
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() fr
KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts
CVE-2026-80853
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops