Reverse Engineering Compliance: A Dual-Graph Verification Framework for Auditing Legacy IT Security Concepts

该论文针对NIS-2指令对持续、可审计合规证据的需求，提出了一种自动化的遗留IT安全概念验证框架。当前组织仍大量使用传统文档形式的IT安全概念（IT-SC），迁移至机器可读格式（如OSCAL）时若缺乏验证，可能将过时资产带入新格式。现有研究

历史摘要 · 未重新核验 · arXiv cs.CR

Securing Autonomous Vehicle Systems via Twin-Aware Federated Reinforcement Learning

该论文针对联邦强化学习（FRL）在自主车辆系统中的安全漏洞问题展开研究。FRL允许多个智能体在不共享原始数据的情况下协同学习，提升了隐私性和可扩展性，但在安全关键的自动驾驶场景中，投毒攻击（poisoning attacks）通过注入恶意系

历史摘要 · 未重新核验 · arXiv cs.CR

Deanonymizing Monero Transactions in Tor Network

本文研究了隐私币门罗币（Monero）在整合Tor网络时引入的安全漏洞。门罗币使用Dandelion++协议及匿名网络（如Tor和I2P）来防止攻击者将交易与源IP关联。然而，作者发现门罗币的Tor集成存在一个根本性缺陷：一个门罗币Tor节

历史摘要 · 未重新核验 · arXiv cs.CR

Differentially private quantum sensor networks

本文研究了量子传感器网络在函数估计中的应用，并首次探讨了其隐私保护问题。量子传感利用量子纠缠实现比经典传感更优的灵敏度（海森堡极限缩放 O(1/n^2)）。然而，当传感器网络用于测量敏感数据（如生物医学数据）时，可能遭受隐私攻击。作者首先展

历史摘要 · 未重新核验 · arXiv cs.CR

Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures

现代数据中心日益依赖大规模 GPU 集群和现场可再生能源，导致计算负载与电力电子主导电网之间形成紧密耦合的物理信息系统。本文提出了一种此前未被探索的脆弱性 Bit2Watt：攻击者通过操纵 GPU 工作负载，诱导受控的高频功率调制，从而破坏

历史摘要 · 未重新核验 · arXiv cs.CR

Security and Privacy in Agentic AI: Grand Challenges and Future Directions

本文基于一项前瞻性扫描研究，汇集了来自学术界、工业界和政府的30位国际顶尖专家，通过聚焦讨论和协作练习，系统性地识别并阐述了智能体人工智能（Agentic AI）在安全与隐私方面面临的重大挑战和未来研究方向。研究指出，随着AI系统自主性的不

历史摘要 · 未重新核验 · arXiv cs.CR

Lower Bounds for PIR with Preprocessing from Blackbox Cryptography

本文针对单服务器私有信息检索（PIR）在预处理场景下的计算下界进行了研究。已有工作表明，单服务器PIR若实现亚线性通信，则每个查询需要线性数量的（公钥）服务器操作。近期的突破性工作通过利用预处理成功构造了查询计算亚线性的单服务器PIR，从而

历史摘要 · 未重新核验 · arXiv cs.CR

Idiobionics: The Unification of Privacy and Intelligent Robotic Prostheses

该论文提出了一个名为“idiobionics”的新研究方向，旨在统一隐私保护与智能机器人假肢（即仿生肢）的研究。随着机器人假肢日益集成先进传感器和基于人工智能的控制方法，它们已成为半自主的可穿戴机器人系统，能够与用户共同适应。然而，这些技术

历史摘要 · 未重新核验 · arXiv cs.CR

MoLIFE: Methodology, Technologies, and Challenges for Mobile Live Intelligent Forensics Examination

该论文提出了一种名为 MoLIFE（Mobile Live Intelligent Forensics Examination）的新型数字取证方法论，旨在解决当前移动设备取证面临的核心挑战：随着 Android 和 iOS 等平台的数据保护

历史摘要 · 未重新核验 · arXiv cs.CR

The UnderConstructionPage PRO plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.76. This is due to the plugin accepting arbitrary...

CVE-2026-11426

CVE-2026-11426 影响 WordPress 插件 UnderConstructionPage PRO 的所有版本（包括 5.76 及以下）。该漏洞源于插件在处理 template_thumbnail 参数时，未对用户提供的本地文

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

CVE-2026-58590

CVE-2026-58590 是 Drupal FlowDrop 模块中的一个授权缺失漏洞，允许攻击者通过强制浏览（Forceful Browsing）方式访问本应受限的资源。该漏洞影响 FlowDrop 从 0.0.0 到 1.6.0 的

历史摘要 · 未重新核验 · NVD

Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

CVE-2026-58589

CVE-2026-58589 是 Drupal 的 FlowDrop 模块中一个缺失授权（Missing Authorization）漏洞，影响版本从 0.0.0 到 1.6.0。该漏洞允许攻击者通过暴力浏览（Forceful Browsi

历史摘要 · 未重新核验 · NVD

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the reset_password endpoint. This issue is fixed in vers...

CVE-2026-58503

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via

历史摘要 · 未重新核验 · NVD

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token...

CVE-2026-55883

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebS

历史摘要 · 未重新核验 · NVD

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no...

CVE-2026-55882

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD serv

历史摘要 · 未重新核验 · NVD

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked...

CVE-2026-55852

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Imp

历史摘要 · 未重新核验 · NVD

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js G...

CVE-2026-55810

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphin

历史摘要 · 未重新核验 · NVD

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag att...

CVE-2026-55809

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance f

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Dr...

CVE-2026-55808

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

历史摘要 · 未重新核验 · NVD

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 1...

CVE-2026-55807

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue af

历史摘要 · 未重新核验 · NVD