Secure Long-Range Autonomous Valet Parking: A Reservation Scheme With Three-Factor Authentication and Key Agreement
远程自主代客泊车（LAVP）系统旨在缓解城市交通拥堵与停车困难，但大规模停车需求下的预约服务面临身份合法性和通信安全方面的挑战。现有方案大多聚焦于停车请求验证和入场检查，未能充分保护乘客上下车过程中的身份认证与会话安全。针对这一问题，论文提
2026-08-08 归档
今日共收录 1332 条安全情报，包含 443 个 CVE，483 篇安全通告，以及 115 篇研究论文。
← 返回归档列表CAN Disabler: Hardware-based Prevention method of Unauthorized Transmission in CAN and CAN-FD networks
本文针对当前车载控制网络中控制器局域网（CAN）总线面临的安全威胁，提出了一种基于硬件修改的 unauthorized 传输阻断方法。近年来，针对 CAN 总线的攻击案例层出不穷，而现有车载 ECU 并未内置安全功能，因此需要低成本且有效的
A Challenge-Nonce Freshness Gap in Project Veraison's TPM Reference Schemes, Found by Appraising Application-Layer Action Evidence End-to-End
本文针对远程证明（Remote Attestation）体系中一个被忽视的安全缺口进行了端到端验证。背景是：当自动化代理（如 AI Agent）执行重要操作时，其留下的记录由自身软件栈生成，而该软件栈的可信性恰恰是待验证的。签名日志只能证明
When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning
本文针对多模态对比学习（MCL）中的后门攻击检测问题展开研究。MCL 模型（如 CLIP）被广泛用于预训练，但其容易受到后门攻击的影响，现有基于检测的防御手段主要依赖 CLIPScore 指标，假设中毒图像-文本对具有较低的语义相似度。然而
Provably Learning Multi-Head Attention with Queries
本文研究从黑盒输入输出访问中学习多头softmax注意力机制的问题。在给定查询token序列的情况下，学习者只能观察到最终token的标量输出。以往的工作提出了使用O(d^2)次值查询恢复单头注意力参数(W,v)的算法，但对于多头注意力，已
Beyond the QBER Threshold: A Temporal QBER Based Machine Learning Framework for Multi Attack Detection in BB84 QKD
本文针对传统 BB84 量子密钥分发（QKD）系统中固定 11% 量子误码率（QBER）阈值检测窃听方案的不足，提出了一种基于时间维度 QBER 的机器学习框架，用于多类型窃听攻击的检测与分类。传统方法仅依赖会话级平均 QBER，而隐蔽攻击
FedGSA: Geometry-Consistent Subspace Aggregation for Differentially Private Federated LoRA
本文提出 FedGSA，一种面向差分隐私联邦 LoRA 的几何一致子空间聚合框架。LoRA 通过低秩分解显著降低了联邦微调预训练语言模型的通信开销，但引入差分隐私后存在两个关键问题：对两个低秩矩阵分别扰动和聚合会导致聚合失配以及二次噪声项。
Dimension Rigidity and Projective Geometry of Trace-Product Switchings of the Gold Cube
该论文研究了Gold几乎完全非线性（APN）函数 x→x^3 的一种自然标量迹积切换（trace-product switching）在所有偶数维度下的完整分类。APN函数在密码学中具有重要地位，常用于构造S盒以抵抗差分密码分析。作者证明了
Quantum One-Way Functions and Related Cryptographic Primitives
该论文是一篇关于量子单向函数及相关量子态原语的综述性文章，由 Georgios M. Nikolopoulos 撰写，涉及量子密码学中除密钥分发之外的基础原语。文章首先指出，经典密码学中的单向函数几乎支撑了所有标准密码协议，因此寻找有意义的
Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST A...
CVE-2026-52880
Klever-Go 是 Klever 区块链协议的 Go 实现，其 REST API 使用 Gin 框架的 `Engine.Run` 便捷方法启动。该方法依赖于 Go 标准库的 `http.Server`，但未设置 `ReadHeaderT
Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every inco...
CVE-2026-52879
Klever-Go是Klever区块链协议的Go实现。在版本1.7.14至1.7.17中，其直接消息入口处理器在处理每个传入的直接消息时，会在处理器层面的防洪水层做出接纳决定之前，就为每条消息新建一个goroutine，且没有信号量、节流器
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override...
CVE-2026-48122
CVE-2026-48122 影响 Ruby LSP 的 Visual Studio Code 扩展（版本 0.10.4 之前）。Ruby LSP 是 Ruby 语言服务器协议的一种实现，用于提供智能编辑功能。该扩展存在的漏洞是：多个工作区
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise editio...
CVE-2026-48026
lakeFS 是一款将对象存储转换为类 Git 仓库的开源工具。其 Web UI 在渲染来自仓库对象的 Markdown 文件时，未对生成的 HTML 进行消毒处理，导致存储型跨站脚本（Stored XSS）漏洞。具体而言，在开源版 1.8
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification counts the unused padding bits of the PubKeysBitmap toward t...
CVE-2026-58262
CVE-2026-58262 是 Klever-Go（Klever 区块链协议的 Go 实现）中存在于 1.7.20 之前版本的一个共识安全漏洞。漏洞根因在于区块头签名验证逻辑错误地将 PubKeysBitmap 中未使用的填充位计入了验证
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leak...
CVE-2026-45808
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide
The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length on its read and write paths with the test (offset + size) ...
CVE-2026-11743
The SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c) validated the flash offset and length o
The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag byte and, for items enqueued via k_qu...
CVE-2026-11742
The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, read
An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handlin...
CVE-2026-9031
An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied da
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safel...
CVE-2026-9030
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction han
Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could have leverage...
CVE-2026-71381
Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a