Repairing Broken Access Control in Web Applications with LLMs: An Empirical Benchmark Study
Broken access control (BAC) ranks among the most severe web-application vulnerability classes, yet its automated repair
2026-10-28 归档
今日共收录 2009 条安全情报，包含 1141 个 CVE，471 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Reversible Pseudonymisation of Documents Sent to External LLMs: an Open Bilingual Benchmark and an Engine
Professionals send working documents to external large language models. A common safeguard is reversible pseudonymisatio
CVE-to-ATT&CK Mapping via Evidence-Constrained Ranking
Mapping CVEs to MITRE ATT&CK techniques helps defenders translate vulnerability information into hypotheses about advers
Enhancing LLM-Based Vulnerability Detection via Representation-Aware Logical Ensemble
Automated vulnerability detection in C source code is a long-standing challenge, as traditional static analysis tools of
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
### Summary In affected versions, MCP servers reachable over HTTP put no limit on the size of a POST body or on the numb
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the serv
[原创]CVE-2020-6507利用链
CVE-2020-6507
[原创]CVE-2020-6507利用链
CVE-2026-39821：Go idna 纯 ASCII 标签解码漏报
CVE-2026-39821
CVE-2026-39821：Go idna 纯 ASCII 标签解码漏报
CVE-2026-6791：8 MiB 输入击穿 glibc wordexp 栈
CVE-2026-6791
CVE-2026-6791：8 MiB 输入击穿 glibc wordexp 栈
CVE-2026-6307：漏掉一次签名比较，Wasm 返回类型错乱
CVE-2026-6307
CVE-2026-6307：漏掉一次签名比较，Wasm 返回类型错乱
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
CVE-2026-86950
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to old
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
CVE-2026-80097
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a t
Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness
We introduce Heads of Security (HoS), a prompt injection defense that enforces instruction-data separation via a small s
Revisiting Privacy Risks in Quantized Deep Neural Networks
Model quantization has become a fundamental technique for enabling the efficient deployment of large-scale deep neural n
When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications
HTTP method semantics are a common boundary between safe retrieval and state-changing operations; however, deployed web
Penny for Your Prompts: A Measurement Study of Contextual Leakage in AI Chat Platforms
AI chatbot platforms have become one of the most popular web interfaces users interact with online, routinely receiving
SecDMP: Provably Secure Data Memory-Dependent Prefetching (Extended Version)
Data memory-dependent prefetchers (DMPs) are a microarchitectural optimization recently introduced in mainstream desktop
Constraining the Commit Boundary: A DIO/ODI-Informed Authorization Guardrail for Agentic Entity Resolution
Agentic Entity Resolution (ER) systems iteratively plan actions, retrieve evidence, revise hypotheses, and propose graph
When Is a Relation Worth Trusting? Manipulation Costs, Exposure, and the Trust Trap in Multi-Relational Graph Learning
Multi-relational graph detectors learn from clean data how much to trust each relation, but an adversary pays a differen
Asynchronous Verifiable and Complete Secret Sharing: From Design Patterns to System-Level Trade-offs
Modern secret sharing protocols promise robust secret sharing in fully asynchronous Byzantine systems, but their practic