今日共收录 748 条安全情报，包含 44 个 CVE，388 篇安全通告，以及 64 篇研究论文。
← 返回归档列表CVE-2026-5366
CVE-2026-5366 是 Prefect 工作流自动化平台 3.6.23 版本中存在的一个严重远程代码执行漏洞。漏洞根源于 `GitRepository` 存储类对用户输入的 `commit_sha` 和 `directories`
A record user could read field values hidden from them by field-level SELECT permissions by reaching the records through
A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR sel
SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (
CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms
CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
CrowdStrike Named a Leader in Identity Threat Detection and Response
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North
本文旨在弥合多方计算（MPC）理论与实践之间的差距，特别是针对具有间歇性延迟的网络环境中实现完全鲁棒性（即保证输出交付，包括离线阶段）的问题。现有的MPC库缺乏完全的鲁棒性，而理论上的MPC构造虽然能够保证鲁棒性，但实践中缺乏高效的可验证/
本文首次展示了针对资源公钥基础设施（RPKI）的降级攻击。RPKI旨在通过验证BGP路由通告的授权来防止前缀劫持，但其设计存在一个关键权衡：当网络无法从发布点检索RPKI信息（如路由源授权ROA）时，会回退到无验证的BGP路由决策，从而优先
该论文提出并实现了 Spoki，一种实时反应式网络望远镜，旨在捕捉传统无状态扫描（如 ZMap）的第二阶段行为。传统网络望远镜仅捕获第一个入站数据包，无法观察攻击者随后发起的攻击或数据交互。Spoki 通过响应异步 TCP SYN 包并完成
本文针对现代CPU微架构中非线性缓存切片函数（cache-slice functions）的逆向工程提出了创新方法。由于CPU缓存是微架构攻击（如Spectre、DRAMA等）的关键组件，理解其寻址机制对攻击者和防御者都至关重要。然而，In