ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

CVE-2026-56665

### Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP)

历史摘要 · 未重新核验 · GitHub Advisory

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page...

CVE-2026-81918

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A us

历史摘要 · 未重新核验 · GitHub Advisory

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags...

CVE-2026-81917

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non...

CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing f

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove...

CVE-2026-89757

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable foli

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf...

CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffe

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-...

CVE-2026-89754

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_p

历史摘要 · 未重新核验 · GitHub Advisory

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix...

CVE-2026-89736

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound c

历史摘要 · 未重新核验 · GitHub Advisory

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

CVE-2026-56829

## Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component ## Descript

历史摘要 · 未重新核验 · GitHub Advisory

Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion

CVE-2026-11748

# Vulnerability `SearchFirstActiveDirectoryRealm.findUserDn()` substitutes the user-supplied username from the login fo

历史摘要 · 未重新核验 · GitHub Advisory

Traefik HTTP/3 Backend NTLM Connection Reuse

CVE-2026-88007

## Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolate

历史摘要 · 未重新核验 · GitHub Advisory

rclone: RC per-server auth-proxy bypass

CVE-2026-88044

## Summary `serve/start` accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse t

历史摘要 · 未重新核验 · GitHub Advisory

rclone: FTP cross-session auth-proxy backend confusion

CVE-2026-88017

## Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind t

历史摘要 · 未重新核验 · GitHub Advisory

DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents

该论文关注 LLM 智能体（Agent）面临的间接提示注入（indirect prompt injection）检测难题。作者指出，当注入攻击成功时，攻击痕迹会体现在 Agent 自身的行为轨迹上：一段正常的工具调用前缀、一个被投毒的观测结

历史摘要 · 未重新核验 · arXiv cs.CR

Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation

该论文聚焦于大语言模型（LLM）被引入安全运营中心（SOC）后所引入的新型攻击面。作者指出，将 LLM 用于威胁情报的聚合、解读与优先级排序虽然显著提升了分析效率，但同时也打开了间接提示注入（indirect prompt injectio

历史摘要 · 未重新核验 · arXiv cs.CR

Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuning

该论文研究的是大语言模型越狱攻击中的一个特殊分支——任意密码（arbitrary cipher）或隐蔽通信攻击。此前的相关工作表明，攻击者可以针对商业模型的微调 API 下手：用大量经过某种自定义加密方案编码的有害问题与回答构造语料，对目标

历史摘要 · 未重新核验 · arXiv cs.CR

ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks

该论文研究检索增强生成（RAG）系统中的知识投毒风险。RAG 通过外部证据为大型语言模型（LLM）的输出提供依据，提升事实性，但同时也把外部知识库变成了攻击面。既有代表性攻击通常需要注入多篇文档，或使用直接断言目标答案的模板化文本，成本和可

历史摘要 · 未重新核验 · arXiv cs.CR

Maverick: Private and Verifiable LLM Inference Made Practical via Matrix-Vector Multiplication Delegation

该论文面向一个日益突出的现实矛盾：开源大模型（LLM）在能力上已可与闭源模型竞争，并且允许用户在不把输入暴露给服务商的前提下本地推理，但大规模模型对本地算力要求极高，因此大量用户仍不得不租用第三方算力，从而重新引入隐私泄露与计算结果被篡改（

历史摘要 · 未重新核验 · arXiv cs.CR

You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements

这篇论文研究的是网络安全测量研究中一个长期被忽视但影响深远的方法论问题：抽样策略如何影响测量结果的有效性与可推广性。背景是，大规模 Web 安全测量（例如统计某种漏洞、错误配置或协议实现问题的普遍程度）通常依赖 Tranco、Common

历史摘要 · 未重新核验 · arXiv cs.CR

LLMSec-AV: A Vulnerability Taxonomy and LLM-Driven Software Weakness Discovery Framework for Autonomous Vehicles

该研究关注自动驾驶（AV）软件的安全弱点发现难题：现代自动驾驶系统依赖数百万行安全关键代码，而通用静态分析工具并不理解哪些代码会实际影响车辆运动控制，因此可能既漏报关键缺陷、又产生大量无意义告警。作者提出的核心问题是：如果把明确的自动驾驶安

历史摘要 · 未重新核验 · arXiv cs.CR