大模型安全风险治理与防护
本文链接
大模型企业应用十大常见安全风险 01 样本投毒（数据污染） 02 恶意利用（Prompt注入攻击） 03 代码辅助工具数据泄露（第三方代码辅助工具） 04 第三方代码依赖风险（开源模型/库污染） 05 自动化Agent权限滥用 06 自建模型平台暴露面过大 07 训练数据隐私泄露 08 模型推理劫持（对抗样本攻击） 09 AI伦理与偏见放大 10 开源模型滥用（深度伪造与辅助犯罪）
Aggregator
Программирование умирает? Это как бутерброд: пока всё красиво — ты не замечаешь, как он собран. До первого крошащегося слоя
1 month 1 week ago
Генеративные модели меняют не только интерфейсы — они меняют мышление.
信息安全漏洞周报（2025年第31期）
1 month 1 week ago
根据国家信息安全漏洞库（CNNVD）统计，本周（2025年7月28日至2025年8月3日）安全漏洞情况如下
CVE-2025-8620 | GiveWP Plugin up to 4.6.0 on WordPress information disclosure
1 month 1 week ago
A vulnerability was found in GiveWP Plugin up to 4.6.0 on WordPress. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to information disclosure.
The identification of this vulnerability is CVE-2025-8620. The attack may be initiated remotely. There is no exploit available.
vuldb.com
CVE-2025-54623 | Huawei HarmonyOS 5.0.1/5.1.0 Devicemanager Module integer overflow to buffer overflow
1 month 1 week ago
A vulnerability was found in Huawei HarmonyOS 5.0.1/5.1.0. It has been declared as critical. This vulnerability affects unknown code of the component Devicemanager Module. The manipulation leads to integer overflow to buffer overflow.
This vulnerability was named CVE-2025-54623. The attack needs to be initiated within the local network. There is no exploit available.
vuldb.com
CVE-2025-54622 | Huawei HarmonyOS 5.0.1/5.1.0 Devicemanager Module authentication bypass
1 month 1 week ago
A vulnerability was found in Huawei HarmonyOS 5.0.1/5.1.0. It has been classified as critical. This affects an unknown part of the component Devicemanager Module. The manipulation leads to authentication bypass by primary weakness.
This vulnerability is uniquely identified as CVE-2025-54622. The attack needs to be done within the local network. There is no exploit available.
vuldb.com
Proxmox VE 9.0 正式发布：基于 Debian 13，内核更前沿，快来体验极客级虚拟化环境
1 month 1 week ago
Proxmox VE 9.0 正式发布，基于 Debian 13 和 Linux 内核 6.14.8-2 打造，支持 QEMU 10.0.2、LXC 6.0.4 等组件升级，并新增快照链式支持、高可用配置优化及现代化移动端界面。
CVE-2025-54621 | Huawei HarmonyOS 5.1.0 WantAgent Module resource control
1 month 1 week ago
A vulnerability was found in Huawei HarmonyOS 5.1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component WantAgent Module. The manipulation leads to improper control of resource through lifetime.
This vulnerability is handled as CVE-2025-54621. Local access is required to approach this attack. There is no exploit available.
vuldb.com
大模型和多智能体系统安全风险分析和洞察
1 month 1 week ago
本文链接
随着⼈⼯智能（AI）技术的⻜速发展，以⼤型语⾔模型（LLMs）为核⼼的智能体（AI Agents）和多智能体系统(Multi-Agents System)正⽇益深⼊到各个应⽤领域，从简单的对话助⼿到复杂的⾃主决策系统。与此同时，作为连接 AI 模型与外部世界（包括⼯具、数据源和其他智能体）的关键桥梁，模型上下⽂协议（MCP）的出现进⼀步拓展了 AI 智能体的能⼒边界。然⽽，这种能⼒和集成度的提升也带来了前所未有的安全挑战。本⽂将针对⽬前披露的针对⼤模型、 MCP 和 AI 智能体的各类安全攻击⽅法，简要分析和总结，深⼊剖析原理、关联性和影响，⼒求提供⼀个当前时点较为全⾯的威胁分析视图，并结合最新的研究进展，为当前的防御策略提供洞察
CVE-2025-54620 | Huawei HarmonyOS 5.0.1/5.1.0 Ability Module deserialization
1 month 1 week ago
A vulnerability has been found in Huawei HarmonyOS 5.0.1/5.1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Ability Module. The manipulation leads to deserialization.
This vulnerability is known as CVE-2025-54620. An attack has to be approached locally. There is no exploit available.
vuldb.com
CVE-2025-54619 | Huawei HarmonyOS 5.0.1/5.1.0 Multi-mode Input Module resource control
1 month 1 week ago
A vulnerability, which was classified as problematic, was found in Huawei HarmonyOS 5.0.1/5.1.0. Affected is an unknown function of the component Multi-mode Input Module. The manipulation leads to improper control of resource through lifetime.
This vulnerability is traded as CVE-2025-54619. The attack needs to be approached locally. There is no exploit available.
vuldb.com
CVE-2025-54618 | Huawei HarmonyOS 5.0.1/5.1.0 Distributed Clipboard Module permission
1 month 1 week ago
A vulnerability, which was classified as critical, has been found in Huawei HarmonyOS 5.0.1/5.1.0. This issue affects some unknown processing of the component Distributed Clipboard Module. The manipulation leads to permission issues.
The identification of this vulnerability is CVE-2025-54618. Access to the local network is required for this attack to succeed. There is no exploit available.
vuldb.com
CVE-2025-54616 | Huawei HarmonyOS 5.1.0 ArkUI Framework out-of-bounds write
1 month 1 week ago
A vulnerability classified as critical was found in Huawei HarmonyOS 5.1.0. This vulnerability affects unknown code of the component ArkUI Framework. The manipulation leads to out-of-bounds write.
This vulnerability was named CVE-2025-54616. Attacking locally is a requirement. There is no exploit available.
vuldb.com
Searchlight Cyber unveils AI Agent to automate dark web threat actor summaries
1 month 1 week ago
Searchlight Cyber has released a new AI capability that summarizes the activity of a threat actor in its dark web investigation platform, Cerberus. The Searchlight AI Agent uses the Cerberus’ dark web data lake to provide a quick overview of a threat actor, including their activity, conversation history, aliases, and associations, helping law enforcement and cybersecurity professionals to quickly identify profiles of interest and areas of investigation to pursue. Criminals use the dark web to … More →
The post Searchlight Cyber unveils AI Agent to automate dark web threat actor summaries appeared first on Help Net Security.
Industry News
CVE-2025-54615 | Huawei HarmonyOS 5.0.1/5.1.0 Media Library Module information disclosure
1 month 1 week ago
A vulnerability classified as problematic has been found in Huawei HarmonyOS 5.0.1/5.1.0. This affects an unknown part of the component Media Library Module. The manipulation leads to information disclosure.
This vulnerability is uniquely identified as CVE-2025-54615. Local access is required to approach this attack. There is no exploit available.
vuldb.com
CVE-2025-54614 | Huawei HarmonyOS 5.0.1/5.1.0 Home Screen Module denial of service
1 month 1 week ago
A vulnerability was found in Huawei HarmonyOS 5.0.1/5.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Home Screen Module. The manipulation leads to denial of service.
This vulnerability is handled as CVE-2025-54614. An attack has to be approached locally. There is no exploit available.
vuldb.com
CVE-2025-54613 | Huawei HarmonyOS 5.1.0 Card Management Module resource control
1 month 1 week ago
A vulnerability was found in Huawei HarmonyOS 5.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Card Management Module. The manipulation leads to improper control of resource through lifetime.
This vulnerability is known as CVE-2025-54613. The attack needs to be approached locally. There is no exploit available.
vuldb.com
CVE-2025-54612 | Huawei HarmonyOS 5.1.0 Card Management Module resource control
1 month 1 week ago
A vulnerability was found in Huawei HarmonyOS 5.1.0. It has been classified as problematic. Affected is an unknown function of the component Card Management Module. The manipulation leads to improper control of resource through lifetime.
This vulnerability is traded as CVE-2025-54612. It is possible to launch the attack on the local host. There is no exploit available.
vuldb.com
CVE-2025-54609 | Huawei HarmonyOS 5.0.1/5.1.0 Audio Codec Module out-of-bounds
1 month 1 week ago
A vulnerability was found in Huawei HarmonyOS 5.0.1/5.1.0 and classified as problematic. This issue affects some unknown processing of the component Audio Codec Module. The manipulation leads to out-of-bounds read.
The identification of this vulnerability is CVE-2025-54609. The attack may be initiated remotely. There is no exploit available.
vuldb.com
CVE-2025-54607 | Huawei HarmonyOS 5.0.1/5.1.0 ArkWeb Module certificate validation
1 month 1 week ago
A vulnerability has been found in Huawei HarmonyOS 5.0.1/5.1.0 and classified as critical. This vulnerability affects unknown code of the component ArkWeb Module. The manipulation leads to improper certificate validation.
This vulnerability was named CVE-2025-54607. The attack can be initiated remotely. There is no exploit available.
vuldb.com