MalwarePT: A Binary-Level Foundation Model for Malware Analysis
该论文提出 MalwarePT，一个面向二进制级别的恶意软件分析基础模型。现有自动化恶意软件分析方法大多依赖手工特征或针对特定任务设计的模型，缺乏通用性和可迁移性。近期二进制级基础模型的发展为可重用的程序表示提供了可能，但它们在恶意软件分析
2026-05-19 归档
今日共收录 917 条安全情报，包含 132 个 CVE，384 篇安全通告，以及 107 篇研究论文。
← 返回归档列表A No-Defense Defense Against Gradient-Based Adversarial Attacks on ML-NIDS: Is Less More?
本文研究旨在探索通过精心设计深度神经网络（DNN）架构本身来抵御基于梯度的对抗攻击的可能性，而无需引入任何额外的显式防御机制（如对抗训练、输入预处理等）。研究背景是机器学习驱动的网络入侵检测系统（ML-NIDS）易受对抗样本攻击，现有防御方
AI Agents May Always Fall for Prompt Injections
该论文聚焦于AI Agent中最为关键的漏洞——提示注入（Prompt Injection）。尽管近期在防御方面有所进展，但作者指出当前主流的防御范式（数据-指令分离）存在根本性缺陷：它既无法检测通过上下文操纵进行的攻击，又会损害符合上下文
Filter-then-Verify: A Multiphase GNN and ModernBERT Framework for Social Engineering Detection in Email Networks
本文提出了一种两阶段“过滤-验证”框架，用于检测电子邮件网络中的社会工程攻击。社会工程攻击利用人类信任而非软件漏洞，传统过滤器难以有效检测。该框架首先使用归纳图神经网络（GNN）进行结构异常检测，识别异常的发送者-接收者模式；然后采用带有共
Simple Power Analysis on Post-Quantum Code Based Cryptosystems
本文研究后量子密码体制中基于编码的密码系统（McEliece 和 BIKE）在简单功耗分析（SPA）下的信息泄露风险。随着量子计算机的发展，传统公钥密码面临威胁，后量子密码成为替代方案。McEliece 和 BIKE 作为基于编码理论的候选
Explicit cost analysis of Toom-4 multiplication for incomplete NTT in lattice-based cryptography
该论文研究了格基密码学中多项式乘法的效率问题。在格基密码系统中，多项式乘法是最基础且计算密集的操作。数论变换（NTT）虽然能实现快速乘法，但对系数域的模数有严格限制。Hafiz等人（2025）通过分析不完整NTT（将截断NTT与常规乘法方法
A Method for Securely Transmitting Large Video Files Using Chaotic Compression and Encryption
该论文提出了一种针对大视频文件的同时压缩与加密系统（SDCE），旨在解决传统压缩和加密方法计算开销大、处理时间长、不适合实时应用的问题。核心方法是将基于混沌映射的加密与霍夫曼无损编码压缩整合到一个统一框架中：利用逻辑映射生成伪随机混沌序列用
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in a...
CVE-2026-33234
CVE-2026-33234 影响 AutoGPT 工作流自动化平台 0.1.0 至 0.6.51 版本。漏洞位于 `autogpt_platform/backend/backend/blocks/email_block.py` 中的 Se
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an una...
CVE-2026-33232
AutoGPT 是一款工作流自动化平台，用于创建、部署和管理持续运行的 AI 智能体。其 0.4.2 至 0.6.51 版本中存在一个未经认证的拒绝服务（DoS）漏洞，根源在于 download_agent_file 端点处理请求时会为每个
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permissi...
CVE-2026-33052
Mantis Bug Tracker (MantisBT) 是一个开源的问题跟踪系统。其版本 2.28.0 和 2.28.1 中存在一个权限提升漏洞。具有“add_profile_threshold”权限的低权限认证用户可以通过在有效的配置
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthor...
CVE-2026-32312
GLPI 是一款免费的资产和 IT 管理软件包。在版本 11.0.0 至 11.0.6 中，存在一个权限绕过漏洞：拥有表单读取 (forms READ) 权限的认证用户可以导出其无权访问的表单结构，导致敏感信息泄露。该漏洞已在版本 11.0
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authe...
CVE-2026-30950
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent
FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS) vulnerability through the fsNick coo...
CVE-2026-27964
FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-
FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-byte, without stripp...
CVE-2026-27892
FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores
FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to ...
CVE-2026-27891
FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerabi
BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This...
CVE-2026-27737
BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation for
SOGo 5.12.7 contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the databas...
CVE-2026-8851
SOGo 5.12.7 contains a SQL injection vulnerability in the Access Control List management functionality that allows authe
In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissio...
CVE-2026-4137
In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` cr
FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, potentially leading to compr...
CVE-2026-26978
FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize dat
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the i...
CVE-2026-22810
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior