Modeling Failure Dynamics in Time-Constrained Authentication Systems: Evidence of a Success Cliff in USSD Workflows
该论文聚焦于时间受限交互系统（如基于USSD的金融服务）中的认证失败动力学。USSD系统具有严格的会话时间限制和顺序用户交互特性，虽然更强的认证机制能提升安全性，但也会增加交互复杂性和时间负担，可能导致交易完成率下降。作者提出了一个模拟框架
2026-07-09 归档
今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。
← 返回归档列表How Reliable Is the Multi-Input Heuristic for Bitcoin Address Clustering in Law Enforcement Contexts?
本研究针对区块链取证中广泛使用的多输入启发式（MIH）方法在执法场景下的可靠性进行了系统评估。MIH通过将同一交易中的多个输入地址聚类到同一实体，是比特币地址聚类的经典方法。尽管被执法机构大量用于追踪非法加密货币流向，但该启发式的实际准确率
Continual Learning With Participation Privacy: An Auditable Buffering-Aggregation Recipe
本文研究持续学习场景下的参与隐私（Participation Privacy）问题。在联邦学习、流式学习中，模型往往持续更新并发布中间模型，因此隐私保护需覆盖完整轨迹并适应自适应交互。针对单次编辑的相邻用户流（即一个插入或删除操作会导致后续
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
该论文系统化整理了2023-2026年间关于AI编码代理执行安全性的39篇论文，将其分为17个类别，并直接验证了每个类别与原始来源的一致性。研究背景是AI编码代理可以读取仓库、调用工具和执行shell命令，但缺乏足够的人类监督，因此其执行层
The Cathedral and the Bazaar of Software Vulnerabilities: From the NVD to the CNAs
本文系统分析了国家漏洞数据库（NVD，称为“大教堂”）与多个CVE编号机构（CNA，称为“集市”）之间在通用漏洞评分系统（CVSS）指标上的分歧问题。NVD长期以来作为漏洞信息的权威来源，支撑着软件更新优先级等下游任务；而众多CNA提供了多
MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination
本文提出了一种名为MoLIFE（Mobile Live Intelligent Forensics Examination）的新型数字取证方法论，用于移动设备的数据获取与分析。随着Android和iOS等移动操作系统不断加强数据保护机制（如
Is Randomness Necessary for Adaptive Data Analysis?
自适应数据分析（ADA）问题旨在形式化描述当数据集被重复使用时如何防止假发现和过拟合。输入是一个包含 n 个独立同分布样本的数据集，这些样本来自未知分布 P，目标是回答一系列自适应选择的统计查询。已有研究表明，对于随机化机制，存在计算高效的
Monitoring Vulnerabilities in Next-Generation Automotive Operating Systems
该论文针对下一代软件定义汽车（SDV）中的操作系统安全漏洞进行了全面分析。研究背景是SDV通过集成复杂的硬件和软件系统正在革新交通，但同时也引入了严峻的安全挑战。作者指出现有的漏洞评估工具在处理操作系统漏洞时存在不足，尤其是在真实环境中高效
QUBO Modeling of Module Learning With Errors: Stability and Scaling in Post-Quantum Cryptography
该论文提出了一种将小规模模块学习带错误（MLWE）问题编码为二次无约束二元优化（QUBO）模型的系统方法，适用于量子退火硬件。研究背景在于格基后量子密码学的安全性依赖于LWE/MLWE问题的难度，而量子退火是一种潜在的求解组合优化问题的量子
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the pr...
CVE-2026-54784
CoreWCF 是 Windows Communication Foundation (WCF) 服务端到 .NET Core 的移植版本。在版本 1.9.0 中，当使用 TransportWithMessageCredential 模式并
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution u...
CVE-2026-54778
CoreWCF 是 Windows Communication Foundation (WCF) 服务端在 .NET Core 上的移植版本。在 1.8.1 和 1.9.1 之前的版本中，当使用 Unix 域套接字 (UnixDomainS
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops proces...
CVE-2026-54775
CVE-2026-54775 是 CoreWCF 项目中的一个拒绝服务漏洞。CoreWCF 将 Windows Communication Foundation (WCF) 的服务端移植到 .NET Core。在版本 1.8.1 和 1.9
Differentially private quantum sensor networks
该论文研究了量子传感网络中的隐私保护问题。量子传感利用纠缠量子传感器网络进行函数估计，具有比经典方法更高的灵敏度（海森堡极限缩放）。然而，当传感器网络用于测量敏感数据（如生物医学数据）时，存在隐私泄露风险。作者首先指出纠缠传感器网络易受某些
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security...
CVE-2026-15132
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code ins
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium securit...
CVE-2026-15131
Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium secu...
CVE-2026-15130
Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypa
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security sev...
CVE-2026-15129
Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap c
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chr...
CVE-2026-15128
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbit
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chr...
CVE-2026-15127
Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbit
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security...
CVE-2026-15126
Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code ins