Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain
Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive.
2026-10-24 归档
今日共收录 814 条安全情报，包含 0 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表A Digital Twin to Improve Cyber-Social Impact
The increasing complexity of Industrial Control Systems (ICS) and their integration with IT infrastructures has signific
After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the syst
MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems
Agentic AI extends large language models (LLMs) from generating responses to planning and executing complex workflows, s
Disclosure Begets Disclosure: A Self-Reinforcing Privacy Loop in LLM Agents with Persistent Memory
Large language model (LLM) agents increasingly use persistent memory to personalize responses, and personal attributes i
ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents
AI agents keep long-term memory, much of which comes from web pages and tool results. Agent harnesses, the software that
Contextual Candour: Role-Aware Graduated Disclosure for LLMs over Mixed-Sensitivity Contexts
LLMs increasingly operate over mixed-sensitivity contexts, where they must reason over information ranging from public t
Self-Evolving Static Analysis via LLM Pseudo-Labeling
Security bugs often slip past static analysis not because they are impossible to detect, but because detection rules hav
Raise or Check? Predicting the Necessity of Additional Fuzzing for Continuous Fuzzing
Continuous fuzzing is used for vulnerability detection in Open Source Software (OSS). Large-scale services such as Googl
HydraPoT: A Configurable Multi-Agent Framework for Cost-Aware LLM-Assisted Honeypots
Large language models (LLMs) can improve honeypot realism by generating dynamic, context-aware responses, but powerful c
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?`
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
### Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one tha
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
### Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted loca
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
### Summary On Windows, attacker-controlled content in a wheel's `.dist-info/namespace_packages.txt` can cause setuptoo
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-H
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
### Impact Three issues allowed actions protected by the `#[Authorize]` attribute to run against records the current us
Echo: WebSocket proxy can retain connections and handlers after client disconnect
## Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket cli
Echo: Decompress permits unbounded gzip expansion in v4
## Impact Echo v4's opt-in Decompress middleware exposed a gzip-decoded request stream without limiting its expanded si