Natural Backdoor Attacks on Speech Recognition Models
该研究聚焦于语音识别模型的后门攻击，提出了一种利用自然或日常生活中的声音（如雨声、鸟鸣等）作为触发器的自然后门攻击方法。与传统的后门攻击不同，自然触发器不需要人工合成噪声，而是直接使用环境中存在的、看似正常的音频信号，从而攻击更具隐蔽性和危
2026-07-21 归档
今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。
← 返回归档列表A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic
本文聚焦于网络入侵检测系统（NIDS）面临的对抗攻击威胁，提出了一种多模型混合防御方法。NIDS是保护网络免受未知攻击的关键工具，但其对对抗样本的脆弱性可能导致误分类（例如将恶意流量判为良性）。作者针对两种强大的白盒对抗攻击——快速梯度符号
Identity-Bound Academic Credentials on Blockchain: On-Chain Issuer Accreditation with ERC-3643 and OnchainID
该论文针对学术证书验证长期存在的难题——个人机构独自保管记录导致验证缓慢、手动、且假证书横行——提出了一种基于区块链的身份绑定学术证书注册系统。现有区块链证书方案通常仅锚定证书哈希，不绑定可验证身份，缺乏明确的发行机构认证机制，且不支持证书
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow ...
CVE-2026-6952
CVE-2026-6952 是 Zyxel AX7501-B1 路由器固件（版本至 5.17(ABPC.7.2)C0）中 syslog 组件的一个后认证命令注入漏洞。该漏洞存在于 syslog 配置的 'LogServer' 字段中，允许已
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows at...
CVE-2026-63729
CVE-2026-63729 是 TeX Live 中 SyncTeX 解析器（synctex_parser.c）的一个堆释放后使用（use-after-free）漏洞。该解析器被 TeX Live 本身以及下游软件（如 GNOME Evi
A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Fileda...
CVE-2026-16332
CVE-2026-16332 是 D-Link DNS-320 网络存储设备（固件版本 1.0.2）中的一个高危漏洞，位于 /mydlink/multi_uploadify.php 文件中。该漏洞源于对参数 Filedata[] 的不当处理
A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argu...
CVE-2026-16330
CVE-2026-16330 是 D-Link DNS-320 网络存储设备 1.0.2 版本中的一个文件上传漏洞。漏洞位于 /web/jquery/uploader/uploadify.php 文件中，攻击者可以通过操纵 https:/u
A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious H...
CVE-2026-16329
CVE-2026-16329 是一个影响 D-Link DNS-320 网络存储设备（固件版本 1.0.2）的任意文件上传漏洞。该漏洞位于 /photo_center/php/uploadify.php 文件中，攻击者可以通过操纵名为 'M
Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables a...
CVE-2026-63728
Gitleaks 是一款用于检测 Git 仓库中硬编码密钥和凭证的开源工具。该漏洞影响 8.30.1 之前的版本，存在于报告模板处理中。Gitleaks 使用 Go 模板引擎，并引入了非封闭的 Sprig 模板函数库。攻击者如果能够控制或影
A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument...
CVE-2026-16327
CVE-2026-16327 是一个影响 D-Link DNS-320 网络存储设备（固件版本 1.0.2）的严重安全漏洞。该漏洞位于 /web/web_file/upload.php 文件中，攻击者可通过操纵“File”参数实现任意文件上
Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit...
CVE-2026-15904
CVE-2026-15904 是一个存在于 Google Chrome（Linux 版本）中的高危漏洞，影响 Ozone 组件。该漏洞是由于在操作过程中未正确管理内存引用，导致 use-after-free（释放后使用）问题。攻击者可以通过
Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security s...
CVE-2026-15901
CVE-2026-15901 是 Google Chrome 浏览器中 Network 组件的一个释放后使用（Use-After-Free）漏洞，影响版本早于 150.0.7871.128。攻击者可以通过构造恶意的 HTML 页面，在用户访
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers ca...
CVE-2026-64624
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the e
Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting...
CVE-2026-57852
Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote att
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/...
CVE-2026-57495
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39,
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate a...
CVE-2026-57494
AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-p
NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restri...
CVE-2026-55550
NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide
NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network usin...
CVE-2026-55544
NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose
An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file
CVE-2026-52656
An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an a
An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _fetch_ht...
CVE-2026-51385
An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code v