A Binary and System Integrated Analysis Approach for Securing the QUIC Protocol
本文提出并评估了一种名为二进制与系统集成安全分析（BSISA）的方法，用于分析QUIC协议实现的安全性。传统QUIC安全分析仅关注捕获的网络流量，而忽略了编译后二进制代码中的防御机制是否真正存在且在攻击时生效。BSISA将二元级分析（分析编
2026-07-07 归档
今日共收录 976 条安全情报，包含 239 个 CVE，384 篇安全通告，以及 83 篇研究论文。
← 返回归档列表Securing Deep Learning Hardware: A Survey of Side-Channel Vulnerabilities and Countermeasures
随着深度学习模型在医疗、金融和安全等关键领域的广泛部署，确保其免受新兴威胁变得至关重要。其中，侧信道攻击（SCA）构成了一项特殊挑战，因为它们可以在无需直接访问模型的情况下提取敏感信息，如模型架构、参数甚至用户输入。通过利用硬件的物理和微架
Security Analysis of RIS-Assisted Physical-Layer Authentication Over Multipath Channels
本文针对可重构智能表面（RIS）辅助的多径信道物理层认证进行安全性分析。在物理层认证中，用户身份验证依赖于传输信道特性。假设合法验证者Bob控制RIS，合法发送者Alice配备单天线，攻击者Trudy拥有多天线并使用预编码来欺骗Bob的验证
An Exploratory Study of Malicious Link Posting on Social Media Applications
该论文针对社交媒体应用中恶意链接分享的安全漏洞进行了探索性研究。研究背景是社交网络平台作为全球通信工具的广泛使用，其中链接分享功能虽然方便，但也为攻击者提供了利用漏洞、感染用户设备的途径。攻击者可以发布包含恶意URL的帖子或消息，但现有研究
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL forma...
CVE-2026-42147
Coolify 是一个开源且可自托管的服务器、应用和数据库管理工具。在 4.0.0-beta.474 之前版本中，S3 存储端点验证仅检查 URL 格式，而 testConnection() 函数会向配置的端点发送服务器端请求，导致拥有存储
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpol...
CVE-2026-42143
Coolify 是一个开源、自托管的服务器、应用和数据库管理工具。在 4.0.0-beta.471 之前的版本中，用户可控的持久卷（persistent volume）名称未经转义或验证即被拼接到托管服务器上执行的 shell 命令中。当触
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($pro...
CVE-2026-34198
CVE-2026-34198 影响 Coolify 开源自托管管理工具（版本 < 4.0.0-beta.471）。该漏洞源于 TrustProxies 中间件配置不当，信任所有代理（$proxies = '*'），导致服务器接受来自任何来源
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated...
CVE-2026-34168
CVE-2026-34168 是一个影响 Coolify（开源自托管服务器、应用和数据库管理工具）的高危命令注入漏洞。Coolify 在版本 4.0.0-beta.471 之前，其 LocalPersistentVolume.name 字段
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are sing...
CVE-2026-34152
Coolify 是一个开源的自托管服务器、应用和数据库管理工具。在版本 4.0.0-beta.471 之前，其部署前和部署后命令处理存在漏洞。具体来说，系统虽然对命令进行了单引号转义，但由于后续通过 SSH heredoc 传输且保留了换行
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component (app/Livewire...
CVE-2026-34057
Coolify 是一个开源的自托管工具，用于管理服务器、应用程序和数据库。在 4.0.0-beta.471 版本之前，其数据库导入 Livewire 组件（位于 app/Livewire/Project/Database/Import.ph
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentinel_token setting is used in shell commands...
CVE-2026-34034
Coolify 是一个开源的自托管工具，用于管理服务器、应用程序和数据库。在 4.0.0-beta.466 之前的版本中，sentinel_token 设置项在 shell 命令中使用时缺乏充分的验证，导致拥有服务器 Sentinel 设置
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived pat...
CVE-2026-53648
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product fi
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without a...
CVE-2026-53647
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `ser
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address ba...
CVE-2026-13356
A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the brows
Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encrypt...
CVE-2024-56141
Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b0
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a...
CVE-2026-53646
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `Client
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to it...
CVE-2026-53645
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged
FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets ...
CVE-2026-53644
FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticate
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin AP...
CVE-2026-53643
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged st
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enabled, a logged-in c...
CVE-2026-53642
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Requ