When Do PEFT Adaptations Leak Structure? Measuring Black-Box Structural Bounds in Public-Base Model Services
随着越来越多模型服务以“公共基础模型 + 私有参数高效微调（PEFT）适配”的方式部署，一种新型的差分信息泄露风险逐渐显现：审计者或攻击者可以在本地运行公开的基础模型，并对比受害者服务的输出，从而推断出私有 PEFT 适配的结构。本文提出
2026-08-09 归档
今日共收录 815 条安全情报，包含 75 个 CVE，398 篇安全通告，以及 81 篇研究论文。
← 返回归档列表Towards Decentralized Searcher Competition in MEV Markets
该论文研究区块链最大可提取价值（MEV）市场中的中心化问题，尤其关注搜索者（searcher）竞争层面的中心化。现有研究多聚焦于构建者、验证者和区块构建市场，本文则从搜索者角度出发，建立了一个异质性模型，其中搜索者在机会覆盖范围和执行效率上
HoRFFI: High-Openness RF Fingerprint Identification with a Similarity-Enhanced Variational Information Bottleneck
该论文针对射频指纹识别（RFFI）在高开放性场景下的实际部署难题展开研究。在真实环境中，RFFI 系统不仅要识别已注册的授权设备，还需要拒绝从未见过的未知设备，且训练阶段往往只能使用少量带标签的已知设备类别，这种约束被称为高开放性 RFFI
Hidden Ciphers and Where to Find Them: Static Discovery and Assessment of Cryptographic Assets in Software
该论文针对现代软件系统中加密资产缺乏结构化可见性的问题，提出了一种静态发现与评估方法。作者首先提出了加密材料、加密工件和加密调用的分类体系，并据此推导出可扩展的、与扫描器无关的规则库。然后实现了一个静态扫描器，应用这些规则生成面向CBOM（
Web Cache Overflow: Exploiting Imprecise Keys for Cache Degradation and Beyond
本文研究Web缓存系统中的一个被忽视的安全问题：缓存键定义不精确所导致的缓存降级与拒绝服务攻击。Web缓存通过存储频繁访问的对象来提升应用扩展性，其核心机制是基于HTTP请求字段组成的缓存键来索引对象。然而，网站运营者常常将非必要的请求元素
Adaptive Intrusion Detection System using Transformer-Based Neural Networks and Continual Learning Approach with Adversarial Investigation
本研究提出了一种基于Transformer的自适应入侵检测系统（IDS）框架，旨在解决网络安全环境中威胁分布不断变化所导致的模型性能衰退问题。传统IDS在固定流量快照上训练，部署后会因数据分布偏移而性能下降；针对新攻击进行微调会导致灾难性遗
UC, Categorically: Rigorous Diagrammatic Proofs
这篇论文将范畴论应用于密码学中的通用可组合性（UC）框架，以建立安全组合的严格数学理论。UC框架由Canetti提出，用于评估协议在并发环境中的安全性，但传统形式化依赖于交互式图灵机和复杂的概率论证明，难以扩展和验证。作者针对静态参与方和会
ASTELD: A Six-Axis Classification Framework for Autonomous AI Agents - Design, Evaluation, and an OpenClaw Case Study
本文提出 ASTELD，一个用于自主 AI 智能体平台分类的六轴操作框架。当前自主 AI 智能体平台在架构、安全性、工具集成、执行方式、自主性和部署等方面差异显著，但缺乏统一的分类体系来比较这些设计选择。ASTELD 框架的六个轴分别为：架
Season: Spectrum-Aware Orthogonal Gradient Refinement for Transfer-Based Adversarial Attacks
本文提出一种名为 Season 的频谱感知正交梯度细化框架，用于提升基于迁移的对抗样本攻击在异构模型间的迁移性。研究背景是：卷积神经网络（CNN）偏向于利用局部纹理特征，而视觉Transformer（ViT）依赖全局形状特征，导致在CNN上
dfence: Fine-Grained Speculation Barriers for Efficient and Effective Hardware-Software Protection in the Spectre Era (Extended Version)
该论文针对现代处理器中推测执行攻击（如 Spectre-PHT 和 Spectre-STL）提出了一种新型硬件指令 dfence。当前软件缓解措施如 Speculative Load Hardening (SLH) 能有效防御 Spectr
Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud I...
CVE-2026-67620
Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-pe...
CVE-2026-42170
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS f
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/s...
CVE-2026-19288
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This
A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Affected by this issue is some unknown functionality of the component HistoryService. This manipulation of the argument ...
CVE-2026-19287
A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Affected by this issue is some unknown functionality of the com
A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryStorage.createDomai...
CVE-2026-19285
A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vu
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Proj...
CVE-2026-19284
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProje
A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitH...
CVE-2026-19282
A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts
A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the comp...
CVE-2026-19281
A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generate
A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument pdfPat...
CVE-2026-19279
A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the fi
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockers() in cls_lock_client.c contains two...
CVE-2026-68082
In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lock