Between Safe Boundaries: Exploiting Temporal Consistency for Jailbreaking Text-To-Video Generation Models
本文针对文本到视频（T2V）生成模型的越狱攻击问题展开研究。现有越狱方法多从文本到图像攻击迁移而来，但未能充分利用视频生成固有的时间一致性特性，且需要大量视频查询优化，不适用于实际黑盒场景，其对抗性提示搜索也依赖启发式局部信号，缺乏结构化探
2026-07-23 归档
今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Fast and Private Max-Sum Diversification
该论文首次在差分隐私框架下研究结果多样化问题，聚焦于最大和多样化（MSD）模型。MSD旨在选择一组项目，最大化一个线性组合：子模函数（衡量相关性）与所选项目间成对距离之和（衡量多样性）。现有非私有方法在处理敏感数据时存在隐私泄露风险。作者提
DSA Nonce Vulnerabilities: An Interactive Analysis
本文提出一个面向CTF竞赛的DSA签名分析与可视化平台，旨在帮助初学者理解DSA算法及其相关的nonce漏洞攻击。DSA基于数论、模运算和大整数计算，传统工具仅展示输入输出，使得签名、验证和密钥恢复攻击的中间过程不透明。该平台提供三大功能：
Multi-Level Privacy-Preserving Dementia Detection from Speech via Targeted Adversarial Obfuscation and Representation Learning
该论文提出了一种多级隐私保护框架，用于从语音中进行痴呆症检测，同时防止说话人身份泄露。现有方法通常只解决单一威胁（如仅信号级或特征级），且难以平衡隐私保护与检测效用。本文设计的框架针对两种窃听向量：在信号级，提出累积信号攻击（CSA），通过
Taming the Security-Energy Paradox: A Green AI Approach to Optimized Android Malware Detection
本文研究了 Android 恶意软件检测中安全性能与能耗之间的权衡问题。随着深度学习模型在移动设备上的部署，强大的检测模型往往导致电池快速耗尽。作者系统评估了多种多层感知机（MLP）模型配置，包括标准 FP32 模型和经过 INT8 量化的
End-to-End Differential Privacy in Training Deep Neural Network Classifiers
本文提出了一种新的端到端差分隐私训练框架，旨在解决现有差分隐私机器学习方法中同时对训练输入和标签进行隐私化可能过于保守的问题。在现实场景中，标签往往可以公开或安全地公开，因此作者提出仅对训练输入施加差分隐私保护，而保持标签公开。该框架针对具
A Multi-Model Hybrid Defense Approach Against White-box Adversarial Attacks in Computer Network Traffic
该论文针对网络入侵检测系统（NIDS）面临的对抗性攻击威胁，提出了一种混合防御方法。NIDS是保护网络免受未知网络威胁的关键工具，但它容易受到对抗性攻击，攻击者通过构造对抗样本欺骗NIDS，将恶意流量误分类为良性。研究聚焦于两种强大的白盒对
A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handler. Performing a ma...
CVE-2026-16628
A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec o
Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
CVE-2026-64798
Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapp...
CVE-2026-64797
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and P...
CVE-2026-64796
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did
Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in vi...
CVE-2026-64795
Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restr...
CVE-2026-64794
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose
Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who ...
CVE-2026-64793
Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A con
Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could conseq...
CVE-2026-64792
Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public gue
Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF...
CVE-2026-64791
Administrator routes and install/update/uninstall processing did not consistently enforce component-management and insta
Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform dat...
CVE-2026-63685
Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An u
Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks ...
CVE-2026-63684
Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-valid
IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.
CVE-2026-63683
IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.
Stored condition values could also execute HTML/JavaScript in administrator summaries.
CVE-2026-63281
Stored condition values could also execute HTML/JavaScript in administrator summaries.