Alert for CVE-2022-21500
CVE-2022-21500
Alert for CVE-2022-21500
2026-07-21 归档
今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。
← 返回归档列表Alert for CVE-2021-44228
CVE-2021-44228
Alert for CVE-2021-44228
Linux 内核提权 CVE-2026-31431(copy-fail)
CVE-2026-31431
Linux 内核提权 CVE-2026-31431(copy-fail)
Alert for CVE-2026-35273
CVE-2026-35273
Alert for CVE-2026-35273
【安全通告】WordPress "wp2shell" 远程代码执行漏洞风险通告（CVE-2026-63030, CVE-2026-60137）
CVE-2026-63030 · CVE-2026-60137
【安全通告】WordPress "wp2shell" 远程代码执行漏洞风险通告（CVE-2026-63030, CVE-2026-60137）
Guzzle: Host-only cookie scope is not preserved
### Impact In affected versions, `CookieJar` does not preserve whether a response cookie was set without a `Domain` att
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
## Summary In the composable `astro/hono` pipeline, the `security.checkOrigin` protection is only installed by the `mid
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
## Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.p
Axios form serializer maxDepth bypass via {} metatoken
## Summary Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in
Axios: Nested axios option objects can consume polluted prototype values
## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process alread
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
## Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforceme
Axios: Prototype pollution gadgets can alter axios request construction
## Summary axios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been pollut
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
## Summary Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when
CCSW '22: The 2022 Cloud Computing Security Workshop.
本文是2022年云计算安全研讨会（CCSW '22）的会议介绍。该研讨会旨在汇集云计算安全领域的最新研究成果，涵盖数据保护、身份与访问管理、可信执行环境、密文计算、云网络安全、合规性与治理等多个方向。受录用的论文包括但不限于：针对云中敏感数
RRAM-DP: Device-Calibrated Differential Privacy for In-Memory Edge Learning
该论文提出了一种名为 RRAM-DP 的硬件-算法协同设计方法，用于在电阻式随机存取存储器（RRAM）上实现具有差分隐私保护的边缘学习训练。边缘AIoT系统通常就地收集敏感数据，隐私保护至关重要。RRAM 因其多位存储和存内计算（CiM）能
RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control
本文针对自托管计算机使用代理（Self-Hosted Computer-Use Agent, SHCUA）直接应用于无人机（UAV）控制时存在的结构不匹配问题，提出了一种面向实时性和安全性的重构方案RT-SHCUA。传统SHCUA设计用于交
Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models
本文研究视觉-语言-动作（VLA）模型在加入推理步骤后对扰动的鲁棒性。直觉上，在行动前进行推理的策略应比直接映射观测到动作的策略更能吸收扰动。作者在LIBERO和SimplerEnv环境中，对三种不同推理设计的模型（无推理、文本链式推理、潜
Protecting Floating-Point Computation for DNN Binaries with MBA Obfuscation
深度神经网络（DNN）已成为现代计算系统的基础组件，广泛应用于计算机视觉、边缘智能等领域。为降低延迟并保护数据隐私，DNN模型越来越多地被编译为可执行文件部署在本地设备上，但这使得模型面临被逆向工程窃取的风险。现有的代码混淆技术主要针对传统
Quantum-Resilient Banking Transaction Security using DW-HKEM: A Hybrid RSA/ML-KEM Cryptographic Gateway with Real-Time
随着在线银行和金融服务在公网上的广泛部署，密码协议的安全性问题变得日益严峻。当前绝大多数交易依赖RSA-2048密钥长度，然而“先收割，后解密”（HNDL）攻击模式已构成现实威胁：敌手可以持续收集加密流量，待未来量子计算机成熟后批量破解。量
Salience Induction against Multi-Hop RAG Agents: Threat and Defense
本文针对多跳检索增强生成（RAG）代理系统提出了一种新的攻击面——显著性通道（salience channel）。与现有的内容投毒（注入虚假事实）和提示注入（嵌入指令）不同，显著性诱导攻击通过调整证据片段中事实的位置、强调方式、框架和语义邻