Bit-ViP: Leveraging Bit-planes to Preserve Visual Privacy in Images through Obfuscation
本文提出了一种基于比特平面的图像模糊方案 Bit-ViP，旨在保护视觉隐私的同时保持图像在识别任务中的可用性。随着计算机视觉应用（如监控系统和社交媒体）的激增，数据存储在云服务器上时面临着安全和视觉隐私的威胁。现有的图像模糊方法要么容易受到
2026-06-30 归档
今日共收录 1015 条安全情报，包含 254 个 CVE，381 篇安全通告，以及 97 篇研究论文。
← 返回归档列表Formal Security Analysis of Agent Protocol Composition
该论文针对AI智能体协议的安全性问题展开研究。当前智能体协议定义了工具调用、任务委派和跨系统协调的方式，但其安全需求不完整且在不同部署中执行不一致。作者提出AgentThread框架，一种从规范文本到运行SDK的源链接安全保证分析框架。Ag
Exploring and Exploiting Synchrony Limitations of Time-Triggered Network-Agnostic Guardians
该论文研究了时间触发通信协议中网络无关监护器（network-agnostic guardians）的同步限制及其可利用性。时间触发通信依赖可信组件（监护器）强制遵循预定网络调度，网络无关监护器因降低成本和复杂度而被广泛使用，但其时钟同步依
The Role of Online Forums in Developer Understanding of Privacy Law -- A Reddit Case Study
该论文研究了软件从业者如何利用在线论坛（以Reddit为例）来理解和应对复杂的隐私法律要求。作者通过两项研究：一项是对223名来自监管相关subreddit的Reddit用户进行问卷调查，另一项是对2248条帖子和回复进行定性分析。结果显示
Syntactic Separation Implies Computational Indistinguishability: An Abstract Obstruction Theorem
这篇论文提出并证明了一个抽象障碍定理：在局部句法系统（local syntactic system）中，句法分离（syntactic separation）蕴含计算不可区分性（computational indistinguishabili
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot: bab3a5797557014c...
CVE-2026-14160
CVE-2026-14160 是影响三星开源 JavaScript 引擎 Escargot（特定 commit bab3a5797557014ce3c2e28419a6310cfba90d0d）的一个检查时间与使用时间（TOCTOU）竞争条
The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including...
CVE-2026-12114
该漏洞（CVE-2026-12114）存在于WordPress的Team Members – Multi Language Supported Team插件中，影响所有版本直至8.7。漏洞类型为存储型跨站脚本（Stored XSS），根本原
mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset() on the result of smp_packet_alloc() before checking it for NULL. smp_packet_...
CVE-2026-10648
Zephyr RTOS 的 MCUmgr 子系统中存在一个空指针解引用漏洞。漏洞位于 subsys/mgmt/mcumgr/transport/src/serial_util.c 文件的 mcumgr_serial_process_frag
A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (DoS) via supplying a crafted Common Pac...
CVE-2026-51221
EIPStackGroup OpENer是一个开源的EtherNet/IP协议栈实现，广泛用于工业控制和自动化设备。该漏洞存在于Git提交76b95c版本的OpENer库中，位于Get_Attribute_List函数内，涉及对通用数据包格
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to...
CVE-2026-34592
Coolify 是一个开源、自托管的服务器、应用和数据库管理工具。在 4.0.0-beta.471 之前的版本中，Coolify 的服务器和项目查询未限定当前团队范围，导致任何经过认证的用户可以通过直接指定 ID 来访问其他团队所属的服务器
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate wit...
CVE-2026-55957
Apache Tomcat 中存在一个认证绕过漏洞，编号为 CVE-2026-55957。当使用 JNDIRealm 并配置为通过 GSSAPI 进行绑定认证时，由于缺少关键步骤，攻击者可以在不提供正确密码的情况下成功认证。该漏洞影响多个版
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_sec...
CVE-2026-41896
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.470, a critical Authenticated Host Remote Code Execution ...
CVE-2026-34597
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in ...
CVE-2026-34594
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.
CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decrypt_done($tag) form compares it agai...
CVE-2026-13758
CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt
PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions...
CVE-2026-57919
PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DA
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the N...
CVE-2026-56018
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory
JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division...
CVE-2026-56017
JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful t
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. ...
CVE-2026-54889
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scri
Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex converts between an Elixir %MDEx.Document{} struct and Co...
CVE-2026-54888
Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex