The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block...
CVE-2026-84899
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it
2026-09-06 归档
今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly...
CVE-2026-84930
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership...
CVE-2026-84935
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigat
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site...
CVE-2026-75586
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formData[
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to...
CVE-2024-11080
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display...
CVE-2026-84896
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before out
CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
CVE-2026-75858
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
CodeWhale: js_execution leaks parent environment to model context via missing env scrub
CVE-2026-75915
### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in
Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning
本文针对基于大语言模型（LLM）的多智能体系统（MAS）在跨组织协作场景下的安全问题，提出了一种隐私保护的拓扑引导安全机制。现有方法通常假设单一运营方可以汇总所有标注轨迹，在全局通信图上训练图神经网络（GNN）以定位高风险智能体并干预拓扑结
SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment
MoE（混合专家）是为扩展大语言模型而设计的架构，每个token仅激活少量专家模块，从而在计算量基本不变的情况下支持大规模参数增长。近年来的混合架构还引入共享专家以捕获有用的通用特征，进一步提升稳定性与泛化能力。MoE已被许多旗舰开源和商业
SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
该论文提出 SENTINEL-RL，一种用于安全运营中心（SOC）的智能体架构，旨在克服大型语言模型（LLM）智能体在自主威胁分析中的两个核心局限：有限上下文窗口难以承载大规模认证图，以及自由文本生成无法保证推荐动作与网络拓扑的一致性。SE
Trust Me, I'm Your Developer: Self-Issued Authentication in Large Language Models
该论文研究了大型语言模型（LLM）在身份验证场景中的一种新型安全失效模式。传统上，LLM安全研究多集中于角色扮演类越狱，而忽略了当用户要求模型通过一个由模型自身设计的测试来验证身份声明时会发生什么。作者对ChatGPT、Claude、Qwe
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to th...
CVE-2026-75816
CVE-2026-75816 是 WordPress 插件 “Frontend Admin by DynamiApps” 中的高危漏洞，影响该插件所有版本（包括最新受支持的 3.29.12）。该漏洞被归类为“认证绕过”，可导致账户接管。核心
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to ...
CVE-2026-86153
根据 NVD 元数据，CVE-2026-86153 影响 Tenda CP3 固件版本 27.5.57.101。该漏洞位于 Functions/Redirect.cpp 文件中的 CRedirServer::SetRedirectEnabl
A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Execu...
CVE-2026-86152
Tenda CP3 固件版本 27.5.57.101 中存在一个高危命令注入漏洞。漏洞位于 Functions/AutoAddWifi.cpp 文件中的 CAutoAddWifi::ThreadProc 函数，属于 Kylin 组件。攻击者
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Managemen...
CVE-2026-86151
CVE-2026-86151 影响腾达（Tenda）CP3 固件版本 27.5.57.101。该漏洞源于设备网络配置管理组件（Apis/system.c）中的函数 sub_2F77E8 存在操作系统命令注入缺陷。远程攻击者在具备高权限（基于
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface...
CVE-2026-86149
根据 NVD 的元数据，Tenda CP3 固件版本 27.5.57.101 被报告存在于 Net/NetCheckPing.cpp 文件中的操作系统命令注入漏洞。攻击者可通过控制 interface_name 和 host 参数，向底层系
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulatio...
CVE-2026-86148
CVE-2026-86148 是 Tenda CP3 智能设备（固件版本 27.5.57.101）中存在的一处操作系统命令注入漏洞。根据 NVD 元数据，该漏洞位于组件 Kylin 的 Apis/system.c 文件中，涉及函数 Syst
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise