DVDR_LLM

DVDR-LLM：大型语言模型何时协同工作能更好地检测和修复软件漏洞？ 研究论文的官方实现与工件： "DVDR-LLM：大型语言模型何时协同工作能更好地检测和修复软件漏洞？" 🎯 概述 DVDR-LLM 是一个集成框架，系统性地研究了聚合多个大型语言模型（LLM）进行软件漏洞检测与修复时的基本权衡。我们的综合评估揭示了在安全关键型应用中关于精确率-召回率平衡、模型多样性收益以及基于共识的方法的关键见解。 主要发现 精确率-召回率权衡 ：集成在补丁有效性评估中减少了误报（准确率+10-12%），但在漏洞识别中增加了漏报 复杂度收益...

EUVD-2026-71219

Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision...

Linux Distros Unpatched Vulnerability : CVE-2026-70409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by...

eldap: eldap: Denial of Service via long LDAP referral URL port

A flaw was found in eldap, a component of Erlang/OTP. A malicious or compromised Lightweight Directory Access Protocol LDAP server could exploit this vulnerability by returning a referral Uniform Resource Locator URL with an excessively long port number. This unbounded port component is then...

DEBIAN-CVE-2026-70409

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parseport/2 passes the port substring straight to...

CVE-2026-70409

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parseport/2 passes the port substring straight to...

DEBIAN-CVE-2026-59696

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uristring:getport/1 passes the port substring to binarytointeger/1 with no length bound,...

CVE-2026-59696

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uristring:getport/1 passes the port substring to binarytointeger/1 with no length bound,...

CVE-2026-71562

Erlang/OTP inets httpc contains an improper validation flaw where server-supplied Content-Length and Retry-After header values are converted via unbounded list_to_integer/1 before size checks can apply. A malicious HTTP server can return a numeric header with up to roughly 1.26 million digits , c...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098676)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098676 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction jump...

Astra Linux – Vulnerability in gmp

The GNU Multiple Precision Arithmetic Arithmetic Library GMP version up to 6.2.1 has an integer overflow issue in the mpz/inpraw.c file, which can lead to a buffer overflow due to malicious input. This results in a segmentation fault on 32-bit platforms...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ptp: Unregistering virtual clocks when unregistering a physical clock. When unregistering a physical clock that contains virtual clocks, the virtual clocks must also be unregistered. This fix resolves the following errors that...

CVE-2026-12632 Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type

Zephyr's Precision Time Protocol receive handler ptpmsgpostrecv in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptpmsgtype msg-header.typemajorsdoid & 0xF, range 0-15 and uses it to index the msgsize table. That table only defines entries up to PTPMSGMANAGEMENT...

CVE-2026-68133

A flaw was found in the Linux kernel's ice driver. A local attacker, by triggering a Physical Function PF reset while the Precision Time Protocol PTP state is uninitialized, could cause an invalid state transition. This could lead to a kernel bug and a system crash, resulting in a Denial of Servi...

CVE-2026-68134

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

CVE-2026-68133

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver...

EUVD-2026-55417

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

CVE-2026-68316 accel: ethosu: Fix element size accounting for cmd stream validation

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

EUVD-2026-55515

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

CVE-2026-68134

The CVE-2026-68134 entry concerns the Linux kernel ptp_s390 module. The vulnerability arises from a missing facility check that could allow the physical clock to be registered even when facility 28 is not installed or PTFF QPT is unavailable. The public details in the connected sources indicate t...