Http4s: DigestAuth allows replay of captured requests
CVE-2026-69206
The `DigestAuth` replay defence stores `lastNc + 1` rather than the nonce-count (`nc`) value it just accepted. When a le
2026-09-16 归档
今日共收录 2620 条安全情报，包含 1789 个 CVE，446 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
CVE-2026-69204
## Summary Ember's HTTP/1.1 request parser does not reject a message that carries both a `Transfer-Encoding` and a `Con
RuleAutoPilot: Synthesizing Deployable Suricata Rules from Network Traffic
本论文聚焦于基于规则的入侵检测系统（如 Suricata）在规则编写环节的瓶颈问题：编写高质量检测规则需要深厚的专家经验，且规则产出速度难以跟上新兴威胁的演进节奏。现有基于大语言模型（LLM）的方案虽然能降低分析员负担，但存在两类缺陷：一是
CIG-MIA: Context-Induced Information Gain Membership Inference Attacks against Retrieval-Augmented Generation
该论文研究的是针对检索增强生成(RAG)系统的知识库成员推断攻击(Membership Inference
InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation
检索增强生成（RAG）通过在生成阶段引入外部知识库，显著提升了大语言模型的时效性与事实性，但也把语料库变成了新的攻击面。已有针对 RAG 的投毒研究基本遵循“单点显式注入”范式：把完整的恶意内容封装在单篇文档中，被检索命中后直接进入提示上下
RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution
检索增强生成（RAG）通过在生成阶段引入外部知识库的检索结果，显著降低了大型语言模型的幻觉与事实性错误，已成为提升 LLM 输出质量的主流范式。然而近期研究揭示了一个关键隐私漏洞：攻击者可构造特定查询，借助检索环节从底层语料库中提取个人可识
SpliTEE: Improving LLM Inference on Trusted Hardware with Differentially Private GPU Outsourcing
该论文研究如何在可信执行环境(TEE)中高效、安全地运行大语言模型(LLM)推理。背景问题是: 用户提交给 LLM 的提示(prompt)可能包含敏感或隐私信息, 而远程部署的模型可能通过重训练时的无意记忆等途径滥用这些信息。一个自然的防护
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to ...
CVE-2026-14349
CVE-2026-14349 是 WordPress 插件 TrueBooker – Appointment Booking and Scheduler System(预约与排程系统)中的一处授权绕过漏洞,影响范围覆盖该插件 1.2.3 及
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugi...
CVE-2026-12793
JetFormBuilder — Dynamic Blocks Form Builder 是 WordPress 平台上一款用于构建动态表单的流行插件。CVE-2026-12793 是一个严重程度为 9.8（CVSS 3.1）的权限提升漏洞
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud
Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud
Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud