Stateful Analysis and Fuzzing of Commercial Baseband Firmware.
基带固件是蜂窝通信中的关键组件，但因其专有、闭源以及状态化处理逻辑的复杂性，系统性安全测试面临巨大挑战。现有方法往往忽视基带任务间的依赖关系和输入处理逻辑的状态性，导致测试覆盖有限且效率低下。本文提出 Loris，一种针对商业基带固件的状态
2026-06-21 归档
今日共收录 748 条安全情报，包含 44 个 CVE，388 篇安全通告，以及 64 篇研究论文。
← 返回归档列表TrafficPulse: A Road-Sensor Assisted Traffic Tweet Misinformation Detection System.
该论文旨在解决社交媒体（特别是X平台）上交通推文中的误信息问题。传统交通事件检测依赖传感器和司机报告，而社交媒体虽能提供实时信息，但面临文本模糊、位置定位困难、以及误导性帖子的挑战。作者提出一个名为TrafficPulse的实时推文验证流水
LAMD: Context-Driven Android Malware Detection and Classification with LLMs.
本文提出 LAMD（Context-Driven Android Malware Detection and Classification with LLMs），一个利用大语言模型（LLM）进行上下文驱动的安卓恶意软件检测与分类框架。针对现
DISARM: Target Electronic Device Informed Mitigation of Software Runtime Side-Channel Vulnerabilities
本文提出了一种名为DISARM的新型运行时侧信道漏洞缓解方法。运行时侧信道攻击利用程序执行时间的波动来窃取敏感信息（如加密密钥、敏感变量数据）。现有解决方案通常试图平衡敏感代码在不同控制流路径上的执行时间，以消除时间泄露，但多数方法未考虑目
AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded ...
CVE-2026-56345
AVideo 29.0及之前版本的Meet插件中存在一个授权绕过漏洞，位于 uploadRecordedVideo.json.php 端点。该漏洞源于端点从上传的文件名中提取目标用户ID（users_id）而未经任何验证。攻击者如果掌握了M
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function...
CVE-2026-12771
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/pro
AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live...
CVE-2026-56342
AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows aut
Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices...
CVE-2026-56307
Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudf
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user...
CVE-2026-5366
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient...
CVE-2025-71331
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat
Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via...
CVE-2024-58351
Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig opti
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute...
CVE-2022-50972
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass...
CVE-2019-25763
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attacke
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to...
CVE-2026-56215
Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, whi
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that...
CVE-2026-56073
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypa
Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions
CVE-2026-11941
### Impact Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functio
symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses
CVE-2026-55877
### Description The `ux_icon()` Twig function is marked `is_safe=['html']`, so Twig never escapes its output. `Icon::to
Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate...
CVE-2026-48584
Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a networ
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate...
CVE-2026-45480
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
Firewall for AI
Firewall for AI