SECURITY RESEARCH / PUBLIC RECORD
找到邊界，留下能被驗證的修補。
這裡彙整 Lucas Futures 與 Longwei Wang 的公開漏洞研究、協調揭露及上游修補紀錄。所有數字都對應可查證的公告或合併請求。
7 CVEs · 11 merged upstream security fixes
7 筆已公開 CVE
- CVE-2026-34450 — Anthropic Claude SDK · Python · CVSS 4.8
- CVE-2026-41686 — Anthropic Claude SDK · TypeScript · CVSS 4.8
- CVE-2026-39821 — Go x/net/idna · CVSS 9.6
- CVE-2026-46601 — Go x/image/webp · CVSS 7.5
- CVE-2026-56854 — Go x/crypto/ssh · CVSS 7.5
- CVE-2026-73851 — Microsoft Kiota · CVSS 6.1
- CVE-2026-94212 — Apache APISIX · CVSS 6.4
11 筆已合併的上游資安改善
- Google · google/draco #1203 — STL decoder bounds checks
- Google · google/draco #1204 — OBJ invalid-pointer guard
- Google · google/draco #1205 — PLY list-entry bounds checks
- NVIDIA · NVIDIA/NVFlare #4344 — Safe model deserialization
- NVIDIA · NVIDIA/garak #1645 — Parameterized SQL queries
- NVIDIA · NVIDIA/GenerativeAIExamples #429 — Supply-chain dependency pin
- NVIDIA · NVIDIA/NemoClaw #610 — Docker build-arg injection hardening
- NVIDIA · NVIDIA/NemoClaw #612 — Snapshot path validation
- NVIDIA · NVIDIA/NemoClaw #613 — Security-sensitive ignore rules
- NVIDIA · NVIDIA/NemoClaw #769 — Credential stripping and digest enforcement
- OpenAI · openai/openai-agents-python #2772 — Supply-chain dependency upper bound
ZDI coordinated disclosure
ZDI-CAN-33788 — MariaDB · CVSS 8.8
此案件仍列於 ZDI upcoming advisories；在正式公告前不宣稱為已公開 CVE。