Do Speech Tokens Leak Voiceprints? Speaker Inversion Attacks Against End-to-End Speech Language Models
本文研究端到端语音语言模型中语音令牌（speech tokens）泄露用户声纹的风险。传统级联架构（ASR-LLM-TTS）将语音转文本再合成，而端到端模型直接使用离散语音令牌表示语音，虽降低了延迟并提升了表现力，但这些令牌可能保留说话人的
2026-07-22 归档
今日共收录 2277 条安全情报，包含 1464 个 CVE，419 篇安全通告，以及 96 篇研究论文。
← 返回归档列表How Do You Choose Your AI Component? An Interview Study of Secure AI Integration in Practice
本研究通过半结构化访谈的方式，深入调查了22名软件开发者、架构师和AI从业者在集成大语言模型（LLM）作为AI组件时的决策过程和安全考量。研究发现，从业者在选择AI模型时主要受功能标准驱动，如性能、准确率、成本和特定功能（例如工具调用或多模
Synchronization-Free Algebraic Fingerprints for Large Language Models: From Autoregressive to Diffusion Models
本论文提出了一种针对大型语言模型（LLM）的新型免同步水印方案，可同时应用于自回归模型和扩散模型。方案的核心创新在于每个水印由单个二元同余构成，该同余由相邻的两个token生成。具体地，对于每对相邻token，通过密码学哈希确定一个里德-所
Federated Learning and LLM-Driven Threat Intelligence for Zero Trust IoT Architecture
该论文针对物联网（IoT）设备在关键任务环境中的安全与隐私挑战，提出了一种联邦学习（FL）与大型语言模型（LLM）驱动的威胁情报框架，用于构建零信任物联网架构。传统IoT设备常因资源受限而无法更新，易受病毒、数据泄露和未授权访问等威胁。现有
A Systematic Evaluation of Traditional Privacy Policy Analysis Tools Against LLMs
该论文首次系统评估通用大型语言模型（LLM）能否替代传统的隐私政策专用分析工具。研究覆盖三类主要功能：矛盾检测、合规性分析、隐私政策摘要与聚合，以及三项中间任务：基于元组的结构化数据提取、语义角色标注（SRL）和手动隐私政策标注。作者选取了
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in th
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
### Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration pa
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
### Summary `Repo.clone_from()` passes the caller-supplied remote URL through `Git.polish_url()`, which on every non-Cyg
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
## Summary A WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` h
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization eng
TypeORM: migration:generate template-literal code injection
### Summary `typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backtic
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
## Summary The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXM
Nginx远程代码执行漏洞分析与利用（CVE-2026-42530）
CVE-2026-42530
Nginx远程代码执行漏洞分析与利用（CVE-2026-42530）
WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)
CVE-2026-63030
Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulnerability was i
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
CVE-2026-50522
A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under act
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
CVE-2026-63030 · CVE-2026-60137
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthent
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
CVE-2026-6875
Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according
Exploitation of ServiceNow Vulnerability Seen Days After Disclosure
CVE-2026-6875
The ServiceNow AI platform vulnerability tracked as CVE-2026-6875 can be exploited for remote code execution. The post E
CutBackdoor: A Circuit Cut Triggered Backdoor Attack on Variational Quantum Algorithms
变分量子算法（VQAs）是近期量子计算的主流范式，广泛应用于量子化学、组合优化和量子机器学习。实际部署中，由于量子电路规模常超出硬件容量，量子电路切割（如CutQC）已成为必要执行策略。同时，预训练参数通过公共仓库分发，带来了供应链安全风险
Isolation Failure From Shared Storage: Characterizing and Exploiting Page-Cache SCA Leakage Across Containers and VMs
该论文系统性地研究了现代云平台中，由于共享存储导致的页面缓存侧信道泄漏问题。尽管容器（如Docker）和虚拟机（如QEMU/KVM）以及沙箱运行时（如gVisor、Kata Containers）提供了不同强度的软件隔离，但当租户访问宿主机