2026-10-03 归档

CVE-2026-103625 · CVE-2026-103622 · CVE-2026-103621 · CVE-2026-103631 · CVE-2026-103630 · CVE-2026-103627 · CVE-2026-103624 · CVE-2026-103626 · CVE-2026-103629 · CVE-2026-103628 · CVE-2026-103623

The Stable channel has been updated to 154.0.8037.97/.98 for Windows and Mac and 154.0.8037.97 to Linux which will roll

历史摘要 · 未重新核验 · Google Chrome Releases

#google #chrome #browser

安全公告2026-10-02 发布INFO

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

CVE-2026-76844

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

历史摘要 · 未重新核验 · Microsoft MSRC

#microsoft #msrc #windows

威胁情报2026-10-02 发布INFO

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CVE-2026-104286

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting

历史摘要 · 未重新核验 · The Hacker News

#cybersecurity #news #thn

威胁情报2026-10-02 发布INFO

Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

CVE-2026-104286

CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files

历史摘要 · 未重新核验 · SecurityWeek

#enterprise #news #securityweek

安全公告2026-10-02 发布INFO

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

# Security Advisory — SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of `CheckHostSSRF`) | Field | Value | |-

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-918 #severity:high

安全公告2026-10-02 发布INFO

Trigger.dev: Cross-environment deployment cancel

### Summary Trigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `pre

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-639 #severity:medium

安全公告2026-10-02 发布INFO

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

### Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and tr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-918 #severity:high

学术论文2026-10-01 发布INFO

ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications

该论文聚焦“失效的访问控制”(Broken Access Control, BAC) 这一长期位居 OWASP 风险榜前列的 Web 安全问题，指出现有自动化检测手段难以覆盖它的根本原因：与注入类漏洞不同，注入是“不可信数据流入危险操作”的

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.SE #broken-access-control #llm-agent #web-security #static-analysis #benchmark

学术论文2026-09-30 发布INFO

PassGPT+: Leveraging Linguistic Priors for Password Modeling

该论文关注的核心问题是：在大规模口令泄露语料上训练生成式模型时，引入自然语言的先验知识是否能更准确地刻画人类构造口令的规律，以及自回归与非自回归（扩散）两类生成范式在口令建模任务上的适配性差异。作者指出现有工作 PassGAN、PassGP

历史摘要 · 未重新核验 · arXiv cs.CR

#cs.LG #password-security #llm #generative-models #authentication #ai-security

学术论文2026-09-30 发布INFO

SafeDepth: Safety-Aware Token-Level Adaptive Computation

该论文研究的是大模型推理效率优化与安全对齐之间的冲突问题。近年来出现的一类令牌级自适应（token-level adaptive）Transformer 模型认为并非每个 token 都需要经过全部层，于是按 token 选择性地跳过部分层

历史摘要 · 未重新核验 · arXiv cs.CR

#llm-safety #efficient-inference #adaptive-computation #alignment #ai-security