piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat...

CVE-2026-109442

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat

历史摘要 · 未重新核验 · GitHub Advisory

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits...

CVE-2026-105297

Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set i

历史摘要 · 未重新核验 · GitHub Advisory

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from...

CVE-2026-105298

Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-

历史摘要 · 未重新核验 · GitHub Advisory

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun...

CVE-2026-109395

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based Unsafe

历史摘要 · 未重新核验 · GitHub Advisory

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow...

CVE-2026-109126

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of...

CVE-2026-112371

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of t

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874...

CVE-2026-112370

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usr

历史摘要 · 未重新核验 · GitHub Advisory

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537...

CVE-2026-112358

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability af

历史摘要 · 未重新核验 · GitHub Advisory

russh: Unbounded memory allocation in agent protocol server via crafted constraint records

CVE-2026-111061

### Summary `russh_keys::agent::server::add_key` (`russh/src/keys/agent/server.rs:271-319`) spawns a dedicated tokio ta

历史摘要 · 未重新核验 · GitHub Advisory

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

CVE-2026-111059

## Summary Mercury turns Jupyter notebooks into shared web apps/dashboards. The `mr.Markdown` widget converts its input

历史摘要 · 未重新核验 · GitHub Advisory

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

CVE-2026-108372

## Summary `loopx serve-status` sends `Access-Control-Allow-Origin: *` on **every** response, including its unauthentic

历史摘要 · 未重新核验 · GitHub Advisory

Proof-of-Machine-Learning-Inference: Mining Knowledge, Not Hashes

Bitcoin-style Proof-of-Work (PoW) secures permissionless blockchains but spends substantial computation on hash puzzles

历史摘要 · 未重新核验 · arXiv cs.CR

NIOCIS: Typed-Decision Next-Hop Routing with Node-Conditioned Option Spaces for Tool-Use Agents

Tool-use agents pay per decision: at each hop a language model re-reads the state and thinks for seconds, though its act

历史摘要 · 未重新核验 · arXiv cs.CR

RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation

Retrieval-Augmented Generation (RAG) enables large language models to access external knowledge during inference, but it

历史摘要 · 未重新核验 · arXiv cs.CR

Towards Architectural-Level Safety Control: Relocating Hazardous Knowledge into Removable Experts in Mixture-of-Experts Models

Large language models acquire broad knowledge from web-scale corpora during pretraining, including knowledge that could

历史摘要 · 未重新核验 · arXiv cs.CR

SoK: PIAtlas: Decomposing the Unbounded Prompt Injection Attack Space

Prompt injection is the dominant security risk for large-language-model (LLM) applications and agents, yet the field sti

历史摘要 · 未重新核验 · arXiv cs.CR

CAT-RAG: Improving Secure Code Generation with Category-Aware Agentic Retrieval

Despite rapid progress in LLM-based code generation, security vulnerabilities remain widespread, and retrieval-augmented

历史摘要 · 未重新核验 · arXiv cs.CR

ABF-Bench: A Verifiable Benchmark for Agentic Blockchain Forensics

Blockchain forensics is adversarial and open-ended: money launderers split, swap, and bridge funds, cut their trail at m

历史摘要 · 未重新核验 · arXiv cs.CR

Cloud & Application Security

Cloud & Application Security

历史摘要 · 未重新核验 · CrowdStrike

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

历史摘要 · 未重新核验 · CrowdStrike