A Trilemma in AMM Mechanism Design
本文研究自动做市商（AMM）机制设计中的三难困境。AMM是区块链上流行的去中心化交易模式，用户通过智能合约直接交易加密资产，但面临抢跑和尾随攻击（即矿工可提取价值MEV）导致的劣质价格。早期工作证明在共识层完全消除MEV不可行，因此近年研究
2026-05-30 归档
今日共收录 1277 条安全情报，包含 517 个 CVE，386 篇安全通告，以及 105 篇研究论文。
← 返回归档列表Control Flow Graph Recovery for Dynamically Loaded Code via Symbolic Library Resolution
本文提出一种结合符号执行与推测性库预加载的技术，用于恢复动态加载代码的控制流图（CFG）。动态代码加载技术被恶意软件广泛使用以逃避静态分析，但现有静态分析方法无法处理运行时的动态链接引入的间接调用，导致CFG不完整。作者设计了一个基于两层架
Protecting On-Device AI Inference: A Systematic Review of Attacks and Defence Mechanisms
本文是第一篇系统性地综述针对设备端AI推理（on-device AI inference）的攻击与防御机制的研究。随着边缘和移动设备上预训练AI模型用于客户端推理的普及，安全与隐私威胁日益突出，包括模型窃取/提取、对抗性攻击和数据泄露。现有
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In 0.24.8 and earlier, quic_stream_recv can dereference a null substream pointer when a substream is in reo...
CVE-2026-45151
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In 0.24.8 and earlier, quic_stream_recv can derefe
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio->prov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* duri...
CVE-2026-44640
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio->prov_data is stored as nni_
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.102.2, a malicious ZIP archive imported wi...
CVE-2026-45668
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bas
OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator...
CVE-2026-35674
OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped client
A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of...
CVE-2026-10062
A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRou
Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the ...
CVE-2026-49325
Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowle...
CVE-2026-44237
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently
A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument ip/mask/...
CVE-2026-10060
A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetRoute of the file /gofor
Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent...
CVE-2026-49323
Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcyc
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming...
CVE-2026-46579
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP fronte
A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain N...
CVE-2026-42965
A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creat
Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the...
CVE-2026-49322
Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year al
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authenticati...
CVE-2026-45044
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelis
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse
CVE-2026-20929
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse
Hackers exploit FortiClient EMS flaw to push infostealer malware
CVE-2026-35616
Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Serv
Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
CVE-2026-39987
An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions af
Compatibility Test Suite (CTS)
Android 兼容性测试套件（CTS）是一套用于验证 Android 设备是否符合 Android 兼容性定义文档（CDD）的测试工具。该公告是 2026 年 5 月 30 日发布的，但内容仅提及 CTS 的通用信息，并未涉及任何具体的安