SFDS: Selective File Disclosure System
传统网络资源访问控制依赖身份认证与访问管理（IAM）系统，这类系统引入了用户认证、身份管理和授权服务等复杂组件，同时也带来了由漏洞、配置错误或实现缺陷引发的安全风险。此外，不同文件格式采用不同机制（如PDF的PAdES标准）保证真实性和完整
2026-07-13 归档
今日共收录 797 条安全情报，包含 77 个 CVE，415 篇安全通告，以及 53 篇研究论文。
← 返回归档列表Secure QR Codes: Authenticity Verification via EdDSA Signatures and CBOR Certificates
本论文针对二维码（QR码）缺乏固有安全机制的问题，提出了一套完整的安全二维码架构演化方案。QR码被广泛信任，但易受欺骗攻击（如quishing），尤其是在自助停车机等公共基础设施场景。作者首先评估了一种完全离线的概念验证方案，该方案采用Ed
Portable Acceleration of Learning With Errors KEMs for Post-Quantum Cryptography
本文针对后量子密码（PQC）迁移中基于Learning With Errors（LWE）的密钥封装机制（KEM）计算开销大、GPU加速方案依赖特定硬件（如CUDA）导致的厂商锁定问题，提出了一种基于OpenMP Target offload
Privacy Detective: A Narrative Game that Cultivates Student Developers' Privacy Awareness by Harnessing Legal Documents
本文提出了一种名为 Privacy Detective 的叙事调查游戏，旨在通过利用真实法律文档（如 FTC 投诉和判决）来培养开发者（特别是学生开发者）的隐私意识。研究背景是：开发者对系统数据收集、使用和共享的选择直接影响用户隐私体验，但
MLQENABLER: Enabling Secure Machine Learning Queries over Encrypted Database in Cloud Computing
在云计算环境中，公共云服务提供商（CSP）通常将云存储作为主要服务，同时利用客户存储在云上的数据提供额外的机器学习（ML）服务。这种商业模式扩展了云计算的边界，但也带来了严重的安全隐患：公共云并非完全可信，可能将客户的敏感数据出售给第三方。
A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp of the ...
CVE-2026-15514
A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCS
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the ar...
CVE-2026-15513
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the f
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com...
CVE-2026-15512
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the
A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. The manipulation results in improper authorization. The at...
CVE-2026-15510
A vulnerability was found in Leantime up to 3.8.0. Affected is the function Setting::saveSetting of the component API. T
A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON-RPC Endpoint. The manipulation of the argument role lead...
CVE-2026-15509
A vulnerability has been found in Leantime up to 3.8.0. This impacts the function editUser/addUser of the component JSON
A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy Handler. Performin...
CVE-2026-15507
A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file
A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the component Driver....
CVE-2026-15506
A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown func
A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra/web/js/markdownit.js of the component YAML Frontmatter. ...
CVE-2026-15505
A weakness has been identified in vnotex vnote up to 3.20.1. Impacted is an unknown function of the file /src/data/extra
Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-linked list (obj_list) of dynamically allocated kernel obj...
CVE-2026-10667
Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-l
parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the port substring into a fixed 17-byte stack buffer (char i...
CVE-2026-10666
parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the
In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CON...
CVE-2026-10665
In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbou
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src/wifi_mgmt.c copied TWT (Target Wake Time) flow entries f...
CVE-2026-10664
The nRF70 Wi-Fi driver's power-save event handler nrf_wifi_event_proc_get_power_save_info() in drivers/wifi/nrf_wifi/src
In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing ...
CVE-2026-10663
In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c
A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The manipulat...
CVE-2026-15502
A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php o
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the file astrbot/dashboa...
CVE-2026-15501
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function T