Towards Robust Personalized Federated Learning: Vulnerability Assessment and Defense Co-Design
随着物联网设备的普及，分布式边缘系统开始大规模收集敏感数据，为设备端机器学习提供了应用场景。联邦学习（FL）通过仅传输模型参数而不交换原始数据，在一定程度上缓解了隐私泄露风险。然而，当前研究忽视了一个关键盲点：在个性化联邦学习（PFL）场景
2026-06-25 归档
今日共收录 1364 条安全情报，包含 629 个 CVE，391 篇安全通告，以及 120 篇研究论文。
← 返回归档列表One-Prompt Censorship Evasion via Generative Diffusion Models
本文研究了网络审查与规避之间不断升级的对抗。当前审查方已从静态规则过滤演进到基于深度学习的流量分析，而现有的自动化规避工具虽然利用随机搜索和可编程启发式方法，但在多种审查机制下的鲁棒性不足，且配置复杂、需要手动调优或特定领域语言，可用性差。
RAVEN: Agentic RAG for Automated Vulnerability Repair
自动化漏洞修复是缓解软件安全问题的重要方向。现有方法多局限于内存漏洞、单一编程语言或依赖专有大语言模型（LLM），且泛化能力不足。本文提出RAVEN框架，基于智能体检索增强生成（Agentic RAG）和可控迭代修复，实现可扩展、高效、自主
TL++: Accuracy and Privacy Preserving Traversal Learning for Distributed Intelligent Systems
本文提出 TL++，一种面向分布式智能系统的两层遍历学习框架。分布式系统常需在数据孤岛间训练模型，但联邦学习在异构分区下效率低且需完整模型交换，拆分学习虽减少通信但无法恢复集中式小批量梯度行为且可能暴露明文激活。TL++ 通过构建虚拟批次（
Sponsored Group Signature and its Application to Privacy-preserving Guest Access in Smart Environments
该论文提出了一种新颖的群签名变体——赞助群签名（SPGS），旨在解决智能环境（如智能建筑）中需要灵活成员加入机制的场景。传统群签名中，所有成员只能由群管理员统一添加，缺乏灵活性。SPGS引入了两级成员结构：第一级成员（赞助者）有权赞助第二级
SoK: AI Secure Code Generation: Progress, Pitfalls, and Paths Forward
本文是首篇系统化综述（SoK），旨在回答当前AI代码生成模型在安全代码生成方面究竟能做什么、仍然失败在哪里以及未来如何前进。作者提出了一个三级分析框架：第一级测量模型对安全编码原则的自然语言理解能力；第二级测量模型在生成代码时实际应用这些原
Quantum Key Distribution Without Shared Reference Frame Under Unital Noise
本文研究在未知、平稳、单位性量子比特信道下进行量子密钥分发（QKD）的实际场景，同时假设通信双方由于相对运动和旋转等原因无法建立全局共享参考系。该场景常见于卫星QKD中。作者提出两种方法克服物理量子比特噪声和缺少共享参考系的问题。第一种方法
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer does not remove <iframe> elements. Combined with the SiYuan Electron client'...
CVE-2026-54759
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, Lute's HTML sanitizer does not remove el
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HT...
CVE-2026-54070
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/read
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting ...
CVE-2026-54069
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server uncondit
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kerne...
CVE-2026-54068
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ rou...
CVE-2026-54066
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Trave
In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket ...
CVE-2026-53005
In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCK
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Rem...
CVE-2026-56262
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauth
Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. ...
CVE-2026-13140
Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exp
In the Linux kernel, the following vulnerability has been resolved: batman-adv: clear current gateway during teardown batadv_gw_node_free() removes the gateway list entries du...
CVE-2026-52926
In the Linux kernel, the following vulnerability has been resolved: batman-adv: clear current gateway during teardown
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even a...
CVE-2026-53928
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a passwor
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any file in share...
CVE-2026-47388
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with kno
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a d...
CVE-2026-47386
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests us
Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that cau...
CVE-2026-54762
Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity vulnerabilit