SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR sel
2026-06-20 归档
今日共收录 996 条安全情报，包含 203 个 CVE，413 篇安全通告，以及 100 篇研究论文。
← 返回归档列表SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named a Leader in Identity Threat Detection and Response
CrowdStrike Named a Leader in Identity Threat Detection and Response
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way
AI agents can access data, trigger workflows, deploy code, and interact with critical business systems, often with littl
From Noise to Signal: Precisely Identify Affected Packages of Known Vulnerabilities in npm Ecosystem.
该论文针对npm生态系统中已知漏洞影响包识别的高误报率问题（即“噪声”），提出了一种精确识别受漏洞影响包的方法。研究背景是，npm包依赖关系复杂，单个漏洞可能波及大量直接或间接依赖的包，而现有的基于版本匹配或公告映射的方法往往产生大量误报，
LOKI: Proactively Discovering Online Scam Websites by Mining Toxic Search Queries.
在线电商诈骗（如购物诈骗、宠物诈骗等）每年在全球造成数百万美元的经济损失。安全社区已开发出高精度的检测系统来判断网站是否为欺诈网站，但如何有效地发现待检测的候选诈骗网站仍是一个挑战。依赖用户举报的方式被动且缓慢，而主动向搜索引擎发送查询来返
DNN Latency Sequencing: Extracting DNN Architectures from Intel SGX Enclaves with Single-Stepping Attacks.
本文研究了一种针对Intel SGX（软件保护扩展）的新型侧信道攻击方法，旨在从受保护的飞地中提取深度神经网络（DNN）的架构信息。Intel SGX通过硬件级隔离保护敏感计算，但侧信道攻击仍可能泄露信息。作者提出的DNN延迟序列化攻击利用
The Exact Security of BIP32 Wallets.
本文首次对BIP32（比特币改进提案32）钱包系统进行了完整的形式化安全分析，无需任何修改。BIP32自2012年引入以来，已成为最常用的比特币钱包之一，但此前缺乏对其具体安全属性的严格证明。该研究基于Das等人（CCS '19）的近期工作
Themis: Ambiguity-Aware Network Intrusion Detection based on Symbolic Model Comparison.
网络入侵检测系统（NIDS）常因实现层面的差异而被绕过：攻击者精心构造的数据包在NIDS和最终主机上的处理方式不同，导致NIDS无法检测。这些差异源于大量端主机实现及其演化，NIDS通常采用简化实现来近似和泛化，但这种方式存在根本缺陷，因为
MPC-Friendly Commitments for Publicly Verifiable Covert Security.
本文研究了在双方安全计算（MPC）中高效验证承诺的问题。考虑场景：一方P1向另一方P2承诺一个值x，后续将用于安全计算，P2希望确保P1没有作弊，即x确实被输入到安全计算中。作者在公开验证隐蔽（PVC）安全模型下构造承诺方案，该模型是恶意模