CFE-PPAR: Compression-friendly encryption for privacy-preserving action recognition leveraging video transformers
本文提出了一种针对隐私保护动作识别（PPAR）的压缩友好加密方法CFE-PPAR。PPAR旨在让机器理解视频中的人类活动而不泄露敏感视觉内容。现有加密方法在加密视频被压缩（如Motion-JPEG或H.264）时，会导致识别性能和视觉质量急
2026-05-08 归档
今日共收录 1100 条安全情报，包含 294 个 CVE，452 篇安全通告，以及 61 篇研究论文。
← 返回归档列表Adversarial procurement in blockchains
该论文研究了区块链协议中一种新兴的设计模式：利用执行任务与验证任务之间的计算不对称性（例如，SNARKs 等密码学有效性证明需要证明者耗费大量计算，而验证者只需少量计算）。在这种模式下，协议需要在假名、对抗性环境中高效地征集昂贵任务的执行者
Beyond Collection: Measuring the Detection Efficacy of Modern Security Logging Standards
该论文首次系统评估了现代安全日志标准的检测效能。针对当前日志标准（CIM、OCSF、ECS）在捕获关键攻击指标方面的相对有效性缺乏实证研究的问题，作者提出了一种基于自动化安全利用遥测收集（SETC）框架的新型评估方法。SETC 在容器化环境
Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use
本文针对企业级AI系统中检索增强生成（RAG）和智能体AI系统的多租户安全隔离问题，提出了一种分层隔离架构。现有系统通常基于语义相似度、关键词匹配或混合方法按相关性对文档排序，而非按授权策略，导致不同租户的查询可能因得分最高而暴露其他租户的
Gaming the Metric, Not the Harm: Certifying Safety Audits against Strategic Platform Manipulation
该论文研究了英国《在线安全法》和欧盟《数字服务法》等法规中，将标量指标作为在线平台合规证据的可靠性问题。监管机构依赖这些指标，但平台可能通过策略性操作（例如将推荐路由到语义等价但危害不变的内容变体）来优化指标分数，而不真正减少伤害。作者将审
Toward Space-Based Public Key Systems: Enabling Secure Space Communications through In-Orbit Trust Services
随着新太空时代的发展，近地轨道上由独立实体运营的卫星数量激增，这带来了更丰富的空间服务需求，但也要求安全、近实时的协调。高效的太空资产认证对于下一代任务至关重要。传统依赖地面的公钥基础设施（PKI）存在延迟和操作瓶颈，限制了在动态太空环境中
$α$-Wasserstein Mechanism for Rényi Pufferfish Privacy
该论文提出了一种基于α-Wasserstein距离的机制来实现Rényi Pufferfish隐私保护，使用了拉普拉斯噪声和高斯噪声。通过应用Hölder不等式，作者证明了拉普拉斯机制的尺度参数可以通过W_α度量的上界进行校准，从而对于α∈
Age Verification in the Web -- Holy Grail to Control Access to Restricted Content
该论文聚焦于网络环境中年龄验证机制的缺失问题，指出当前未成年人在未经有效年龄检查的情况下即可访问色情、赌博、暴力、仇恨言论以及烟酒等有害内容，对其世界观和心理健康构成严重威胁。作者首先分析了现有法规及方案，如欧盟《数字服务法案》（DSA）推
A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a manipulation of the...
CVE-2026-8128
SourceCodester SUP Online Shopping 1.0 版本中 /admin/viewmsg.php 文件存在 SQL 注入漏洞。攻击者可远程构造恶意参数 msgid，触发 SQL 注入，可能导致数据库信息泄露、篡改或
This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may allow an attacker to obtain encrypted tenant email addresses and related metadata fro...
CVE-2026-6411
CVE-2026-6411 影响 MAXHUB Pivot 客户端应用（版本低于 v1.36.2）。攻击者无需认证即可通过网络远程利用此漏洞。核心问题在于应用程序内硬编码了一个 AES 密钥，攻击者可借此解密任意租户的加密邮箱地址及相关元数
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-2710
该 CVE 记录已被 CVE 编号机构拒绝或撤销，因此不包含任何漏洞信息或安全影响。根据 NVD 发布的状态，此 CVE ID 不再被视为有效的安全公告。没有提供 CVSS 评分、受影响产品、厂商或利用状态。安全团队无需对此记录采取任何行动
A vulnerability was found in 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84. Affected is the function executeCognitivePulse of the file src/kernel.ts. Performin...
CVE-2026-8112
A vulnerability was found in 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84. Affected is the function e
A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query pa...
CVE-2026-8106
A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page th
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploit...
CVE-2026-8034
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that a
The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization misconfiguration. The VerySecureApp allows anonymous user...
CVE-2026-7891
The VerySecureApp made by DIVD using Mendix Studio Pro 11.8.0 Beta allows unintended data exposure due to authorization
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests wit...
CVE-2026-7541
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to
An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configur...
CVE-2026-6736
An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attack
Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary Ja...
CVE-2026-41929
Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor previ
Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key....
CVE-2026-41928
Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated
Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-41105
Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges ove