Chrome for Android Update
Hello Everyone! We've just released Chrome 157 (157.0.8103.14) for Android to a small percentage of users. It'll become
2026-10-24 归档
今日共收录 814 条安全情报，包含 0 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Firewall for AI
Firewall for AI
[原创]从 REA 的 19 万 Star 说起 — AI 逆向的能力边界与攻防趋势
[原创]从 REA 的 19 万 Star 说起 — AI 逆向的能力边界与攻防趋势
[原创]ROP（Return-Oriented Programming）返回导向编程 · 游戏安全相关技术边界探索【2】
[原创]ROP（Return-Oriented Programming）返回导向编程 · 游戏安全相关技术边界探索【2】
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge device
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels...
CVE-2026-115931
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not r
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
CVE-2026-115883
### Summary The Postgres and SQLite stores save a namespace as its labels joined with `.`, so `("tenant", "bob")` and `
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
CVE-2026-115889
## Summary In Wasmtime prior to v43, the Cranelift compiler backend bit-packs its SSA value indices in a way that can r
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
CVE-2026-112906
`SoftFileLock` and `MarkerSoftFileLock` evict an unparsable marker (the lock file at ``, whose presence says a process h
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
CVE-2026-112914
When a soft-lock stale break finds that the marker (the lock file at ``) it renamed aside was a live one recreated by a
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is...
CVE-2026-115800
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model o
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
CVE-2026-114055
## Summary API clients can supply arbitrary `mm_processor_kwargs` per request. vLLM forwards these values through the m
Electron: Mitigation for compromised eMudhra intermediate certificates
CVE-2026-115570
### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
CVE-2026-114050
## Summary Multimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
CVE-2026-62204
## Summary `installBazaarPlugin` (and the equivalent endpoints for widgets/icons/templates/themes) accept `packageName`
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
CVE-2026-73054
### Summary Two checks on the same WebSocket request URI parse it differently. The authentication exemption for keepali
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to...
CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server...
CVE-2026-115812
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier mig
WildFakeToolBench: Benchmarking AI-Generated Image Detectors with Web-Sourced Image Processing
As AI generated images are getting popular these days, discussions on such generations are widely existed in current pub
Your Token Is Gone: A Token-Consumption Countermeasure for Disrupting LLM-Based Scam Systems
LLM-based scam systems increasingly combine adaptive dialogue, persistent context, external tools, and multi-agent coord