Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities.
该论文展示了一种名为Rain的攻击方法，利用已公布的旧漏洞（L1TF，2018年发现）与推测性越界加载组合，在公共云平台上实现跨虚拟机数据泄露。作者指出，云服务商通常采用孤立补丁方式缓解漏洞，而未消除根本原因，导致组合攻击仍可能奏效。实验在
2026-07-18 归档
今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。
← 返回归档列表WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'
CVE-2026-11324
The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cros
OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals
CVE-2026-62228
OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust ca
OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass
CVE-2026-62220
OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limit
OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs
CVE-2026-62210
OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-rea
Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering
CVE-2026-44182
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution
CVE-2026-44181
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber
Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed
CVE-2026-44180
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber
WireGuard Easy Weak Token Generation Information Disclosure via OTL Route
CVE-2026-63089
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation
bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb
CVE-2026-54728
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb
bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes
CVE-2026-61718
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb w
Squid: Memory disclosure in FTP gateway
CVE-2026-47729
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in t
Diffie-Hellman Picture Show: Key Exchange Stories from Commercial VoWiFi Deployments.
该论文研究了商业VoWiFi（无线VoIP）部署中的密钥交换过程。VoWiFi允许通过WiFi拨打和接听电话，但用户设备与核心网络之间需要建立安全通道。论文分析了多家移动运营商的实际VoWiFi实现，发现其密钥交换（Diffie-Hellm
Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference.
本文提出了一种针对LLM推理零知识证明验证的新型攻击——Hollow-LLM攻击。在零知识证明（ZKP）场景中，验证者通常需要检查证明者是否基于正确权重执行了推理，但本文发现攻击者可以构造一类“计算上琐碎”的权重，即权重值极小或特定模式，使
Contextualizing Sink Knowledge for Java Vulnerability Discovery.
该论文提出了一个名为 GONDAR 的 sink 中心化模糊测试框架，用于在 Java 应用程序中系统性地发现安全漏洞。现有的模糊测试工具往往忽略了安全敏感 API（sink）所携带的漏洞特定知识，例如到达 sink 的程序约束和触发漏洞的
The Secrets Must Not Flow: Scaling Security Verification to Large Codebases.
现有程序验证器能够证明安全协议实现的高级属性，但由于需要大量人工努力，难以扩展到大型代码库。针对这一挑战，本文提出了一种名为Diodon的新方法。Diodon通过将代码库分割为协议实现（核心）和其余部分（应用程序）来解决扩展性问题。这种分割
Ivanti Endpoint Manager Mobile代码注入漏洞
Ivanti Endpoint Manager Mobile代码注入漏洞
Risk Ledger Raises $32 Million in Series B Funding
2026年7月17日，英国供应链安全风险管理公司Risk Ledger宣布完成3200万美元的B轮融资。该公司提供协作平台，帮助组织评估和管理第三方供应商的安全风险，通过共享安全问卷、持续监控和风险评分，改善供应链可见性。这笔资金将用于扩大
On the Detectability of Active Gradient Inversion Attacks in Federated Learning.
联邦学习（FL）允许多个客户端协同训练机器学习模型，同时将数据保留在本地，从而提升隐私保护。然而，FL训练过程中交换的梯度仍易受到梯度反转攻击（GIA）的威胁，攻击者可以重建客户端本地数据，破坏FL的隐私承诺。GIA可由被动或主动的服务器发
Prrr: Personal Random Rewards for Blockchain Reporting.
这篇论文研究了区块链智能合约中的报告机制问题。智能合约作为运行在区块链上的状态程序，通常依赖外部报告（例如价格预言机、随机源等）。为了激励参与方及时提交报告，系统会支付奖励给报告发布者。然而，现有的解决方案面临安全性与性能之间的权衡：如果依