SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors

联邦学习（FL）因其在不共享原始数据的情况下协作训练模型的能力，成为隐私敏感应用的有前景的范式。然而，其去中心化特性使其本质上易受后门攻击，恶意客户端将隐藏触发器嵌入本地训练数据以操纵模型预测。现有防御主要在聚合前/期间运作，无法完全消除持

历史摘要 · 未重新核验 · arXiv cs.CR

RAVEN: Agentic RAG for Automated Vulnerability Repair

该论文提出了 RAVEN，一个结合智能体检索增强生成（Agentic RAG）与受控迭代修复的自动化漏洞修复框架。现有自动修复方法多局限于内存相关漏洞或局部可修复场景，泛化能力弱，且常依赖专有模型。RAVEN 完全基于开源 LLM，可在本地

历史摘要 · 未重新核验 · arXiv cs.CR

A Post-Quantum Secure Lattice-Based Forward-Secure Identity Based Encryption with Applications to Internet of Things Architecture

随着物联网（IoT）的飞速发展，异构且资源受限的设备之间产生了前所未有的数据交换规模。在这种环境下保证机密性和安全的密钥管理极具挑战性。传统的公钥基础设施需要沉重的证书处理开销，而基于身份加密（IBE）通过直接从设备身份推导公钥，提供了一种

历史摘要 · 未重新核验 · arXiv cs.CR

TRACE: A Threat Modelling Methodology for Distributed, Cloud-First, and Decentralized Organisations

现代组织越来越多地采用分布式、云优先和去中心化的架构，这打破了传统威胁建模方法（如STRIDE、PASTA、Trike、OCTAVE、LINDDUN、攻击树和MITRE ATT&CK）所依赖的三个基本假设：明确的安全边界、单一的所有者组织以

历史摘要 · 未重新核验 · arXiv cs.CR

On the Curse of Dimensionality in Private Sparse Covariance Estimation and PCA

本文研究高维差分隐私（DP）下的协方差矩阵估计和主成分分析（PCA）问题，重点关注协方差矩阵的k-行-列稀疏性（k-RCS）假设。在非私有设置中，已知仅需poly(k, log d)个样本即可解决这两个问题。然而，在DP设置下，现有的最好结

历史摘要 · 未重新核验 · arXiv cs.CR

DIPBox: A Multi-scale Testing Framework for Tracking Dataset Regeneration

该论文聚焦于训练数据集的版权保护问题。现有防御机制主要针对单个数据点的追踪，但忽略了数据集再生（dataset regeneration）的威胁，即攻击者可能通过对原始数据集进行变换或部分采样来生成新的数据集，从而规避授权。作者通过测量公开

历史摘要 · 未重新核验 · arXiv cs.CR

Quantum Key Distribution Without Shared Reference Frame Under Unital Noise

该论文研究了一种实际场景下的量子密钥分发（QKD）问题：当通信双方经由一个未知、平稳、单比特幺正噪声信道进行通信，且由于相对运动或旋转等原因无法建立全局共享参考系（即双方对量子态的测量基没有共同约定）时，如何实现安全的密钥分发。这种场景在卫

历史摘要 · 未重新核验 · arXiv cs.CR

HOWLR: A Client-Driven Approach to BGP Hijack Detection

BGP劫持允许攻击者在前缀级别劫持流量，并冒充目标服务向客户端提供恶意内容。传统上，检测此类攻击依赖于网络运营商，导致终端用户在数小时内暴露于风险之中。本文提出了一种客户端驱动的BGP劫持检测方法HOWLR，其核心洞察在于：BGP劫持虽然能

历史摘要 · 未重新核验 · arXiv cs.CR

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips ...

CVE-2026-54236

vLLM是一个用于大型语言模型推理和服务的开源引擎。该漏洞（CVE-2026-54236）源于对之前漏洞CVE-2026-22778修复的不完整。之前的修复引入了一个sanitize_message辅助函数，用于在错误消息到达客户端之前去除

历史摘要 · 未重新核验 · NVD

Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /private/role_bindings/:org_id endpoint, unlike the POST a...

CVE-2026-56321

Capgo (backend Supabase edge functions) before 12.128.2 does not apply the global authentication middleware to the GET /

历史摘要 · 未重新核验 · NVD

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that...

CVE-2026-55603

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the librar

历史摘要 · 未重新核验 · NVD

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, This vulnerability is fixed in 1.84.0.

CVE-2026-49468

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, This vulnerabili

历史摘要 · 未重新核验 · NVD

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to d...

CVE-2026-54288

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit M

历史摘要 · 未重新核验 · NVD

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by...

CVE-2026-53779

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers t

历史摘要 · 未重新核验 · NVD

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed...

CVE-2026-53663

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were

历史摘要 · 未重新核验 · NVD

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplie...

CVE-2026-11834

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router mod

历史摘要 · 未重新核验 · NVD

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or ...

CVE-2026-55602

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middlewar

历史摘要 · 未重新核验 · NVD

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears mor...

CVE-2026-54289

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Ed

历史摘要 · 未重新核验 · NVD

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed i...

CVE-2026-54278

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is po

历史摘要 · 未重新核验 · NVD

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Messa...

CVE-2026-53537

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Dispos

历史摘要 · 未重新核验 · NVD