Continual Backdoor Training in IoT/CPS

该论文聚焦于物联网（IoT）和网络物理系统（CPS）中持续学习（CL）环境下的后门攻击安全问题。随着IoT/CPS系统需要不断适应环境变化、设备异构性和概念漂移，持续学习被广泛用于提升系统效用。然而，持续学习的增量更新、回放缓冲区和表示重用

历史摘要 · 未重新核验 · arXiv cs.CR

Attribute Inference from Interactive Targeted Ads

该论文研究交互式定向广告系统中的属性推断攻击。广告商通过定向广告系统可以选择特定用户群体，并将广告单元与可见的用户互动暴露相结合。当用户互动仍与引发该互动的广告活动关联时，广告商可能收到与用户个体相关的观测数据，而不仅仅是聚合报告。作者将此

历史摘要 · 未重新核验 · arXiv cs.CR

A Formal Resilience Framework for Cyber-Physical Embodied Systems under Device-Level Cyberattacks

本论文提出了一种面向网络物理具身系统（CPS）的形式化弹性框架。传统的容错机制通过分析传感器和执行器输出、检测渐进漂移或突发故障来触发容错机制，但这种方法在应对网络攻击造成的微妙干扰时存在不足，尤其是对于具身CPS——其中的计算和物理设备不

历史摘要 · 未重新核验 · arXiv cs.CR

VLALeaks: Membership Inference Attacks against Vision-Language-Action Models

本研究首次系统性地探索了视觉-语言-动作（VLA）模型在成员推理攻击（MIA）下的隐私泄露风险。VLA模型通过端到端方式学习视觉、语言和动作的联合表示，广泛应用于机器人控制领域。然而，由于机器人数据获取成本高昂，模型可能记忆训练数据，导致数

历史摘要 · 未重新核验 · arXiv cs.CR

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker ...

CVE-2026-7273

CVE-2026-7273 是 Zyxel GS1900-48HPv2 交换机固件（版本至 2.90(ABTQ.1)C0）中 CGI 程序的一个栈缓冲区溢出漏洞。该漏洞允许位于局域网内的未认证攻击者通过发送特制的 HTTP 请求，触发栈溢出

历史摘要 · 未重新核验 · NVD

A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulner...

CVE-2026-1766

GNOME localsearch（原 tracker-miners）的 MP3 提取组件 tracker-extract-mp3 存在堆缓冲区溢出漏洞。该漏洞源于处理特制 MP3 文件时，对 malformed ID3v2.3 COMM（

历史摘要 · 未重新核验 · NVD

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier

CVE-2026-9258

CVE-2026-9258 是佳能 EOS Network Setting Tool（版本 1.5.0 及更早）中的一个安全漏洞，由于程序未能正确验证 SSH 主机密钥，攻击者可以利用此漏洞实施中间人攻击（MitM）。具体而言，当用户通过该

历史摘要 · 未重新核验 · NVD

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by stre...

CVE-2026-48854

CVE-2026-48854 是 elixir-grpc 库中一个影响 gRPC 服务器的资源耗尽漏洞。该漏洞源于 Elixir.GRPC.Server.Adapters.Cowboy.Handler 模块中的 read_full_body

历史摘要 · 未重新核验 · NVD

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via t...

CVE-2026-48723

BrowserStack 的 Cypress CLI 工具（browserstack-cypress-cli）在 1.36.4 之前版本中存在操作系统命令注入漏洞。漏洞位于 readCypressConfigUtil.js 的 loadJs

历史摘要 · 未重新核验 · NVD

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or deni...

CVE-2026-5064

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might all

历史摘要 · 未重新核验 · NVD

Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle() and/...

CVE-2026-48157

Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.

历史摘要 · 未重新核验 · NVD

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interp...

CVE-2026-48017

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate

历史摘要 · 未重新核验 · NVD

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read,...

CVE-2026-12087

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the l

历史摘要 · 未重新核验 · NVD

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predict...

CVE-2026-11832

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was genera

历史摘要 · 未重新核验 · NVD

Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.

CVE-2026-52702

Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.

历史摘要 · 未重新核验 · NVD

Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.

CVE-2026-52700

Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.

历史摘要 · 未重新核验 · NVD

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

CVE-2026-52699

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

历史摘要 · 未重新核验 · NVD

Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

CVE-2026-52697

Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

历史摘要 · 未重新核验 · NVD

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

CVE-2026-52695

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

历史摘要 · 未重新核验 · NVD

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

CVE-2026-52694

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

历史摘要 · 未重新核验 · NVD