Answer-Only Disclosure: Private-Context LLM Assistance over Web APIs with a Leakage Ledger
Web assistants increasingly answer questions about a user's private documents by pairing a small on-device model with a
2026-10-31 归档
今日共收录 3279 条安全情报，包含 2996 个 CVE，94 篇安全通告，以及 100 篇研究论文。
← 返回归档列表ICALL-BENCH: Benchmarking LLM Interprocedural Reasoning in Binary Programs
Recent benchmarks show that LLMs achieve strong performance in both function-level binary understanding and end-to-end b
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
CVE-2026-116696
### Summary **All evidence, reproduction steps, and scripts in the report were verified against a real running instance
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
CVE-2026-96629
### Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits bot
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571
CVE-2026-54442
### Summary The URL validation regex `^(https?:/)?/.*` added to emissary's `NavAction.java` allows protocol-relative UR
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, a
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api...
CVE-2026-63377
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses on...
CVE-2026-114612
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.
CVE-2026-107060
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to anoth
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the ...
CVE-2026-112712
@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() func
Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication and inject or delive...
CVE-2026-78334
Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote atta
In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcp_write_collapse_fence() sets TCP_SKB_CB(skb)->...
CVE-2026-98549
In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mer...
CVE-2026-29063
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Po
Tracking AI adoption in North Korean threat actor tradecraft
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and effici
Binance probes potential $5.8 billion crypto-theft hack
Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital ass
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over
CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)
CVE-2026-111497
CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Sever
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnection(...
CVE-2026-118778
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
CVE-2026-96633
## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process thro