Image Quality Assessment of Identity Cards Using Measures from Open Face Image Quality
本文针对远程身份验证系统中身份证图像质量评估的挑战，提出将开放人脸图像质量（OFIQ）标准中与采集相关的质量度量应用于身份证图像。预处理流程包括角点检测、透视归一化和全面的前景掩码，以确保准确且无偏的质量度量计算。通过分析这些度量与三种展示
2026-06-13 归档
今日共收录 1165 条安全情报，包含 370 个 CVE，402 篇安全通告，以及 115 篇研究论文。
← 返回归档列表The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPre...
CVE-2026-9848
该漏洞存在于 WordPress 的 WP Ticket 插件中，版本 ≤6.0.4。插件通过挂钩 `posts_request` 过滤器并调用 `wp_ticket_com_posts_request()` 函数，在未认证前台搜索请求中执
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the ...
CVE-2026-12089
该漏洞影响 WordPress 插件 LWS Optimize – All-in-One Speed Booster & Cache Tools 至 3.3.19 版本。由于函数 combine_current_css() 在组合 CSS
Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the...
CVE-2026-6676
CVE-2026-6676 是 Avira 反病毒引擎在处理畸形的 POSIX tar 归档文件时存在堆缓冲区越界写入漏洞。该漏洞影响 Windows、macOS 和 Linux 平台上引擎版本低于 8.3.27.12 的 Avira 反病
Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus...
CVE-2025-9033
CVE-2025-9033 是 Avira Antivirus 引擎中的一个堆缓冲区越界读取漏洞，影响 Windows、macOS 和 Linux 平台。该漏洞存在于引擎处理畸形 PDF 文件时，由于未正确验证边界，可能导致堆缓冲区越界读取
Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files throug...
CVE-2026-53867
Capgo 在 12.128.2 版本之前存在安全漏洞，当用户更换或删除个人资料图片时，系统未能从后端存储中删除先前上传的旧图片文件。攻击者可以利用之前生成的 URL 直接访问这些孤立的图片文件，从而实现未授权获取用户上传的内容。该漏洞源于
OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can e...
CVE-2026-53839
OpenClaw 在 2026.5.7 之前版本中存在主机名验证漏洞。该漏洞位于重试端点检查逻辑中，未能进行精确主机名匹配，而是允许通过匹配主机名前缀来绕过验证。攻击者可以构造一个与受信任主机相似的主机名前缀，从而将认证材料发送到不可信的端
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intend...
CVE-2026-53837
CVE-2026-53837 是 OpenClaw 组件中的一个不当访问控制漏洞，影响版本早于 2026.5.6。该漏洞源于 Mattermost 事件处理器未能正确验证频道类型元数据，导致攻击者可以通过发送缺少频道类型信息的恶意 Matt
snaproot: Decentralized File Integrity Verification Using Blockchain-Anchored Cryptographic Hashing
本文提出 snaproot，一种基于 Solana 区块链的轻量级去中心化文件完整性验证系统。针对现有方案依赖中心化权威（存在单点故障和信任问题）或去中心化存储（资源开销过高）的弊端，snaproot 采用 Haber 和 Stornett
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated f...
CVE-2026-53836
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows
OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that allows authenticated senders to create or update binding...
CVE-2026-53835
OpenClaw before 2026.5.6 contains a configuration enforcement bypass vulnerability in Feishu dynamic-agent bindings that
OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allows authenticated senders to skip allowFrom policy checks. ...
CVE-2026-53834
OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that allow
OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explici...
CVE-2026-53833
OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows auth
OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on...
CVE-2026-53831
OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that a
OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reloa...
CVE-2026-53830
OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and
OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversi...
CVE-2026-53829
OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide com
OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without prope...
CVE-2026-53828
OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authentic
OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exp...
CVE-2026-53826
OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes th
OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Att...
CVE-2026-53824
OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to contin
OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access ca...
CVE-2026-53823
OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Sl