UI DoS attack
CVSSv3 Score: 5.0 An Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiOS m
2026-08-13 归档
今日共收录 1881 条安全情报，包含 959 个 CVE，493 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Trigger the Straggler: Load Hijack on Mixture-of-Experts LLMs
该论文针对基于专家并行（Expert Parallelism, EP）的大规模混合专家（Mixture-of-Experts, MoE）模型提出了一种新型负载劫持攻击“Load Hijack”。在典型的 MoE 服务系统中，多个 GPU 上
Knowledge-Graph-Guided Retrieval-Augmented LLMs for Explainable Root Cause Analysis in Automotive HiL Validation
硬件在环（HiL）验证是汽车软件系统开发中的关键环节，但生成的多元时间序列数据通常庞大且复杂，人工分析耗时且往往局限于异常检测与故障分类，难以进行根因分析。现有深度学习方法在故障检测与分类上表现良好，但通常需要针对新故障位置、新系统或新运行
A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem
本文报告了一种面向企业级 Model Context Protocol (MCP) 环境的集中式网关架构，旨在解决因 MCP 服务器快速扩散而导致的认证与治理碎片化问题。随着大型组织在一年内从零部署到数十个内部 MCP 服务器，每个团队独立
Logit-Boundary Geometric Belief Interfaces and Sparse Sheaf-Enclave Protocols: A Self-Contained Substrate for Secure Network Electronic Health Record (EHR) Interoperability
本文提出一种面向医疗健康信息互操作性的数学与工程架构，核心解决电子健康记录（EHR）跨系统交换时的“边界问题”。作者指出，传统系统、生成式模型、术语服务、身份系统及人工审查者各自暴露复杂的内部状态，而实际操作需要在窄接口上交换带类型的声明、
STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework
本文针对网络攻击后事件响应规划中的静态依赖问题，提出了一种端到端代理规划框架 STAIR。传统事件响应依赖专家编写的 playbook，但静态工作流难以适应不断变化的事件状态、恢复目标变化以及执行反馈。虽然近年基于大语言模型（LLM）的规划
Memoir: Learning, Verifying, and Evolving False-Positive Memories for Static Application Security Testing Tools
本文关注静态应用安全测试（SAST）工具的高误报率问题。SAST工具在现代安全软件开发中不可或缺，但生成的误报（FP）告警会带来大量人工审查成本，并降低开发者信任。现有误报缓解方法面临两大挑战：一是不同SAST工具与漏洞类别间差异大，难以学
SLAC: Access-Driven CPU-to-GPU Side-channel Attacks via System-Level Cache on Apple Silicon
本文研究了苹果 M1 芯片等异构系统级芯片（SoC）中 CPU 与 GPU 共享系统级缓存（SLC）所引入的新型跨域攻击面。作者发现，GPU 的内存访问会在共享 SLC 中留下集合级别的足迹，这些足迹可被无特权的 CPU 进程观测到。基于这
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticate...
CVE-2026-71193
OpenStack Designate 22.0.1之前版本存在一个严重漏洞。该漏洞源于区域创建时的检查逻辑（_is_subzone、_is_superzone以及重复区域数据库约束）仅针对目标池（target pool）范围内生效。已认证
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthentic...
CVE-2026-73519
WolfStack 是一款容器管理平台，在 25.9.2 之前的版本中存在一个高危硬编码凭据漏洞。该漏洞源于每个构建版本中都编译进了一个固定的集群认证密钥，并作为常量发布在源代码文件 src/auth/mod.rs 中。由于该密钥对所有构建
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content on-demand
Google Cloud Next 2026Catch-up sessions on the keynotes and select sessions are now available on demand.Explore content
The Identity Problem Hiding in AI Agent Deployments
The Identity Problem Hiding in AI Agent Deployments
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey
94% of Organizations Report Cloud Breaches: CrowdStrike State of CDR Survey