[原创]C/C++ 自写补丁-设置硬件断点 x86_x64

[原创]C/C++ 自写补丁-设置硬件断点 x86_x64

历史摘要 · 未重新核验 · 看雪

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

## Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

### Summary When `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free t

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

### Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list,

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

### Summary adm-zip enforces a `maxOutputLength` guard against decompression bombs on its synchronous `getData()` path,

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

## Summary Denial of Service in `adm-zip`'s async decompression API allows an unauthenticated attacker to crash the ent

历史摘要 · 未重新核验 · GitHub Advisory

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

**Affected package:** adm-zip (npm) **Affected version:** 0.6.0 ## Summary The fix shipped for CVE-2026-39244 (`method

历史摘要 · 未重新核验 · GitHub Advisory

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

## Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | `nodemailer` | | Repository | https:

历史摘要 · 未重新核验 · GitHub Advisory

Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)

CVE-2026-86950

Apple today released patches for all of its operating systems. However, only patches for older branches include a securi

历史摘要 · 未重新核验 · SANS ISC

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

CVE-2026-86950

Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said

历史摘要 · 未重新核验 · The Hacker News

Apple Patches Meta-Reported Zero-Day Linked to ‘Extremely Sophisticated Attack’

CVE-2026-86950

Apple has released iOS and macOS updates to patch the zero-day vulnerability tracked as CVE-2026-86950. The post Apple P

历史摘要 · 未重新核验 · SecurityWeek

SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents

该论文《SEAD: A State-Based Perspective on Attack and Defense in Tool-Using Agents》针对工具调用型语言模型智能体（tool-using agents）提出了一种以「状

历史摘要 · 未重新核验 · arXiv cs.CR

LENS: The Sum Is Worse Than the Parts for Set-Level Poisoning in Retrieval-Augmented Generation

该论文研究检索增强生成（RAG）系统在「集合级」投毒场景下的新型脆弱性。传统观点认为 RAG 通过聚合多篇外部文档来提升答案可靠性，但作者指出：这种联合整合本身会引入一个被忽视的攻击面——单篇文档各自看起来都合理无害，但把它们作为整体一起送

历史摘要 · 未重新核验 · arXiv cs.CR

DGF-Bench: A Benchmark for Simulating and Auditing Deception Against Multi-Agent Governance Boards

DGF-Bench 是一篇面向多智能体（multi-agent）治理决策场景的评测基准论文，作者 Jeremy Canale，归类 cs.AI。其核心问题是：当由语言模型驱动的智能体代替企业治理委员会来评审项目时，它们需要阅读证据、套用成文

历史摘要 · 未重新核验 · arXiv cs.CR

She Spoofed Sea Ships by the Sea Shore: Measuring Large-Scale GPS Spoofing in Global Maritime Traffic

本文针对海事领域的 GPS 欺骗（GPS spoofing）问题，开展了目前首个全球尺度的系统性测量研究。研究背景是：GPS 欺骗虽已被公认为对海上航行安全的严重威胁，但其在全球范围内的普遍程度、持续时间与空间结构此前基本缺乏量化证据。作者

历史摘要 · 未重新核验 · arXiv cs.CR

When Tools Silently Lie: Evaluating and Mitigating Blind Compliance in Tool-Augmented Data Agents

该论文研究工具增强型数据智能体（tool-augmented data agents）中的一个关键可靠性缺陷：当工具调用在技术上“执行成功”时，其返回的证据仍可能是貌似合理却实际错误的，而智能体往往并不具备判断该证据应当被采信还是应当被交叉

历史摘要 · 未重新核验 · arXiv cs.CR

OT-PCA: New Key-Recovery Plaintext-Checking Oracle Based Side-Channel Attacks on HQC with Offline Templates

本文提出 OT-PCA(Offline Template Plaintext-Checking Attack)一种针对后量子密钥封装机制 HQC(Hamming Quasi-Cyclic)的新型侧信道密钥恢复攻击框架,其基础是明文检测(Pl

历史摘要 · 未重新核验 · arXiv cs.CR

Still There, No Longer Seen: Exposing Compression-Induced Risk in Large Vision-Language Models

该论文关注大型视觉语言模型（LVLM）在推理加速中被广泛采用的视觉 token 压缩技术所引入的安全盲区。压缩能显著降低推理成本，但现有鲁棒性评估多用聚合指标，无法回答一个关键归因问题：某次对抗性失败究竟是由压缩过程新增的，还是原本就继承自

历史摘要 · 未重新核验 · arXiv cs.CR

Selective Channel Restoration for Backdoored Vision-Language Models

视觉语言模型（VLM）具备强大的多模态理解与生成能力，已被广泛用于图文问答、检索、多模态 Agent 感知等场景。但其微调流程通常依赖第三方或不可信数据，攻击者可通过在微调数据中投毒，向模型植入后门：在正常输入上表现正常，一旦出现特定触发模

历史摘要 · 未重新核验 · arXiv cs.CR

Efficient Linkage-Based Compartmentalization on CHERI

该论文研究在 CHERI 能力硬件内存安全基础上，如何高效实现进程内细粒度隔离（compartmentalization）。核心问题在于：现有隔离机制（如 Intel MPK）并发可用的保护域数量极其有限（最多 16 个），无法在大规模软件

历史摘要 · 未重新核验 · arXiv cs.CR