LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards
Autonomous agents have been observed acting beyond their assigned tasks, accessing unauthorized systems, and establishin
2026-10-29 归档
今日共收录 3209 条安全情报，包含 2330 个 CVE，388 篇安全通告，以及 93 篇研究论文。
← 返回归档列表Factual Yet One-Sided: Stance Poisoning and Evidence Balancing in Retrieval-Augmented Generation
The stance expressed in responses from retrieval-augmented generation systems is significantly influenced by the stance
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increase
LABScon26 Replay | Keynote: A Sober Analysis of AI Impact
Harvard Professor James Mickens weighs the promises of AI against its potential harms, arguing for hardware-based mechan
AI used in Aur0ra ransomware testing and execution
The GOLD OGRE threat group has used AI extensively to develop tools and to orchestrate and execute ransomware operations
ESET APT Activity Report Q2 2026–Q3 2026
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026
Cohere’s Qwen Story: Looks More Like Model Jaggedness
Key findings On October 26, Cohere reported a puzzling incident involving Qwen3.8-Flash-Next, an open-weight model from
Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants
Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes
Chrome for Android Update
Hello Everyone! We've just released Chrome 157 (157.0.8103.30) for Android to a small percentage of users. It'll become
Chrome Beta for Android Update
Hi everyone! We've just released Chrome Beta 158 (158.0.8127.2) for Android. It's now available on Google Play . You can
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to e...
CVE-2026-97860
YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who h
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because...
CVE-2026-118650
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an en
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the con...
CVE-2026-118264
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a clien
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software ...
CVE-2026-76418
A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is...
CVE-2026-79589
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to exec...
CVE-2026-113691
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledge...
CVE-2026-42949
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A spec
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG fi...
CVE-2026-109822
Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive in
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary ...
CVE-2026-93864
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution a
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-...
CVE-2026-90465
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster i