VeriChat: An Agentic Conversational AI Assistant for Hardware Security Verification
本文提出了 VeriChat，一个面向硬件安全验证领域的智能对话助手。硬件安全验证是一个多阶段过程，工程师需要处理复杂的设计分析、威胁评估和验证策略，然而当前验证环境缺乏结构化的安全指导。通用聊天机器人（如 ChatGPT、Gemini）存
2026-07-04 归档
今日共收录 996 条安全情报，包含 192 个 CVE，454 篇安全通告，以及 95 篇研究论文。
← 返回归档列表From Forgeries to Foundation Models: A Systematic Survey of Identity Document Attack and Detection
本文是首个系统性地从统一威胁模型角度审视身份证件伪造攻击与检测方法的综述。当前，生成式AI工具（如扩散模型、大语言模型）使得无需专业技术即可高保真合成身份证件或进行字段级篡改，而现有检测方法仍基于不反映这种威胁的基准测试，造成严重的“现实差
Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks
这篇论文研究了轻量级机器学习模型在工业物联网(IIoT)网络入侵检测中的跨域泛化失败问题。尽管轻量级模型因适合资源受限的边缘部署而被广泛提出，但大部分报告的结果仅评估模型在其训练网络上的性能，而未验证其在未见网络上的行为。本研究在多个IIo
SoK: Attack and Defense Landscape of Mobile On-device AI Systems
移动端设备端AI（MoAI）系统将本地部署的AI模型与传统移动软件组件集成，直接在终端设备上提供智能功能，具有隐私保护、低延迟和离线可用等优势。然而，本地存储AI模型引入了新的安全风险。本文是首个针对MoAI安全的系统化知识梳理，涵盖安全支
CVE-TTP KG: Knowledge Graph Linking Software Vulnerabilities to Attack Behaviors
本文针对当前威胁环境中，CVE/NVD 等漏洞数据库缺乏与攻击者行为（如 MITRE ATT&CK 战术和技术）的显式关联，导致安全团队难以快速理解漏洞的实际利用后果问题，提出了一种将软件漏洞与攻击行为模式链接的知识图谱构建方法。作者首先构
A forgery attack on the Block.co blockchain-based digital credential certification system
该论文针对基于区块链的数字证书认证系统Block.co进行了安全性分析，发现其存在一个严重漏洞，允许攻击者伪造被系统视为有效的证书。Block.co系统利用区块链的不可篡改性和持久性来实现去中心化的证书认证，但其中缺乏中心化的可信权威机构来
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gatewa...
CVE-2026-14617
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function Gatewa
Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-58597
Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to pe
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over ...
CVE-2026-58524
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)
Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CVE-2026-58522
Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CVE-2026-58300
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.
CVE-2026-58299
Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execu
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over ...
CVE-2026-58298
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
CVE-2026-58297
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
CVE-2026-58296
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized a
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-58295
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58294
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58293
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-58292
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netw
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-58291
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker t