SpexPay: A Privacy-Preserving Pay-As-You-Go System for Dynamic Spectrum Sharing
该论文提出了SpexPay，一个面向动态频谱共享（DSS）的隐私保护、可审计的按需付费（pay-as-you-go）频谱使用框架。针对现有频谱接入系统（如Google的SAS）依赖中心化管理员导致运营元数据泄露和缺乏加密交易问责的问题，Sp
2026-07-21 归档
今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。
← 返回归档列表Federated Lightweight Intrusion Detection in Drone Swarms with Knowledge Distillation
本文针对无人机蜂群网络面临的网络安全挑战，提出了一种基于联邦学习（FL）和知识蒸馏（KD）的轻量级入侵检测系统。无人机蜂群在监视、灾难响应等关键任务中广泛使用，但开放的通信信道和有限的计算资源使其易受攻击。传统的基于机器学习的入侵检测系统（
Adaptive Incident Prioritization for Security Operations at Scale
本文提出了一种自适应安全事件优先级排序算法（Adaptive Incident Prioritization, AIP），旨在解决大型安全运营中心（SOC）中分析师面临的事件队列过长、排序混乱的问题。当前主流的事件排序方法依赖于到达时间、粗
Auditable Session Admission for Cross-Silo Federated Learning
该论文针对跨组织联邦学习（cross-silo FL）中跨边界会话操作准入的审计难题，提出了一种可审计的会话准入网关（Session Admission Gateway）。当前常见的准入方式依赖中心化策略服务、平台配置或临时检查，这些方式随
Signal-based Model Access Risk Analysis for AI System Operations Security
本文针对AI系统在安全、金融、医疗等领域广泛部署后所面临的模型逃逸攻击问题，指出传统基于攻击者知识（白盒、灰盒、黑盒）的分类方法忽视了不同部署接口实际暴露信息信号（如仅输出最终决策、置信分数、中间表示或完整参数）对攻击能力的影响。作者提出了
Beyond Detection: Agentic Attack Synthesis and Simulation for Smart Contracts
本文提出了一种名为 KASS（知识增强攻击合成与仿真）的多智能体框架，旨在解决现有智能合约安全工具仅停留在漏洞检测、无法验证漏洞可利用性及攻击过程的问题。KASS 将自动利用生成分解为规划、生成和测试三个阶段，并融合三种互补机制：基于检索增
Gasp: A DeFi Application Specic Rollup as a Consolidation Layer for All Assets
Gasp 是一个基于应用特定 Layer 2 (L2) 滚动架构的去中心化交易所，旨在作为所有加密资产的聚合层。它利用 EigenLayer 的再质押 ETH 来确保计算正确性和最终确认，采用乐观滚动技术实现无 Gas 的原生跨链交换，无需
Critical ServiceNow code execution flaw now exploited in attacks
CVE-2026-6875
Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to thr
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
CVE-2026-63768
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows at
Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
CVE-2026-63770
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthentic
Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
CVE-2026-63771
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by
FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
CVE-2026-64619
FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated a
RT: Stored Cross-Site Scripting via insufficient template escaping
CVE-2026-44228
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, conta
FreeScout Allows Unauthenticated Access to Legacy Attachment Files
CVE-2026-48812
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's
FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint
CVE-2026-45295
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tr
xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)
CVE-2026-55639
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Se
xrdp: No authentication required with Xvnc backend on RHEL 9
CVE-2026-55626
xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using
xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads
CVE-2026-55238
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Co
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning
CVE-2026-58484
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()`
xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER
CVE-2026-54538
xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to pr