IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute...
CVE-2026-84073
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to i
2026-09-19 归档
今日共收录 1784 条安全情报，包含 814 个 CVE，581 篇安全通告，以及 100 篇研究论文。
← 返回归档列表IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query...
CVE-2026-81656
IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute...
CVE-2026-84031
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
CVE-2026-63406
### Summary The telemetry subsystem embeds a hardcoded auth token (`"secret"`) in the public source and transmits raw CL
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
CVE-2026-58197
## Summary A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`
Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
CVE-2026-61795
### Summary A parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHa
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
CVE-2026-33625
### Summary lmdeploy <= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that al
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
CVE-2025-66455
## Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize messages rec
MAGS: Multi-agent Auto-formalization Guarantees Safety for Agentic Outputs
该论文针对 LLM 编码智能体大规模生成复杂程序、人工审查难以为继所带来的安全与功能失效风险，提出了一套统一的多智能体框架 MAGS（Multi-agent Auto-formalization Guarantees Safety for
PentestChain: A Cost-Aware, MCP-Orchestrated Framework for Automated Penetration Testing with Free-Tier LLMs
该论文提出 PentestChain，一个面向自动化渗透测试的十阶段框架，核心动机是解决 AI 驱动渗透测试的成本可及性问题。作者指出，此前基于 GPT-4 等前沿闭源模型（premium frontier models）的自动化渗透测试虽
InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation
本文研究检索增强生成（RAG）系统的语料库投毒威胁。现有针对 RAG 的投毒攻击大多属于「单点显式注入」，即把恶意载荷完整封装在单一文档中，因此近年出现的缓解机制能够较有效地识别并削弱这类威胁。作者首先通过实验验证：面对「间接逻辑诱导」这一
Towards TEE-Certified DP: Verifiable Differentially Private Training on Legacy GPUs
这篇论文研究的是「可验证的差分隐私训练」问题：随着机器学习被广泛采用，监管与政策层面对训练数据保护提出越来越强的要求，差分隐私（DP）成为关键技术手段；但一个研究较少的问题是——如何认证训练过程中 DP 确实被忠实执行。理想情况下，外部验证
Autonomy in Check: Governor-Mediated Adaptive Security at the Edge
该论文关注网络边缘场景下自适应安全机制的信任边界问题。随着边缘安全日益依赖自动化规划器（automated planner），包括规则型控制器、学习型策略以及 LLM 辅助智能体，这些组件会把观测结果直接翻译为策略执行动作。作者指出：一旦规
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ...
CVE-2026-92229
本漏洞影响 WordPress 插件 Forminator Forms – Contact Form, Payment Form & Custom Form Builder（联系表单、支付表单与自定义表单构建器），所有 1.57.2 及更早
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismat...
CVE-2026-84434
CVE-2026-84434 是 WordPress 插件 Gravity Forms（版本 ≤ 3.1.0.4）中的一个任意文件上传漏洞，由插件内部的 upload_file 函数引发。该插件的表单上传流程被拆分为两个阶段：字段校验阶段与
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment