Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a
2026-08-22 归档
今日共收录 1353 条安全情报，包含 493 个 CVE，458 篇安全通告，以及 108 篇研究论文。
← 返回归档列表AEGIS: Attention-Embedding Gradient Isolation Shield - Triple-Channel Gradient Masking for Privacy-Preserving Federated LLM Fine-Tuning
本文提出一种名为 AEGIS（Attention-Embedding Gradient Isolation Shield）的轻量级防御方法，用于保护联邦学习场景下大语言模型微调过程中的梯度隐私。研究背景是梯度反演攻击能够从共享梯度中恢复私有
KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation
本论文提出 KeyPooling，一种针对大语言模型（LLM）API 中继（relay）路径的缓存隔离测量方法。研究背景是：LLM API 中继通常对客户进行独立认证，但转发请求时往往使用共享的提供商凭据。提供商将提示缓存（prompt c
TrustRAG: Blockchain-Enhanced RAG via Committee-Based Credibility Scoring
该论文针对检索增强生成（RAG）系统中普遍存在的信任与可验证性问题，提出了一种基于区块链和委员会机制的RAG系统——TrustRAG。传统RAG系统依赖集中式数据库，文档来源不透明、存在被篡改风险，且缺乏对文档可信度的有效评估，在医疗、金融
HARP: Hierarchical Adaptive Ranking with Preference-Adaptive Fusion for Query-Based CVE Prioritization
漏洞优先级排序是安全管理的关键环节，但不同组织由于运营偏好不同，对同一CVE的处置优先级可能不同。现有评分系统（如CVSS）和排序方法通常假设固定标准，忽略了偏好的可变性。然而在实际中，组织往往已经处于某种偏好场景下，但这种偏好通常是隐性的
From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation
本文提出 AUTOSIGMA，一种将非结构化的网络威胁情报（CTI）报告自动转化为 Sigma 规则的解决方案。随着高级持续性威胁（APT）的快速演变，安全团队需要将威胁情报动态转化为可操作的检测能力。Sigma 规则作为一种与平台无关的检
FedLNS: Leverage LayerNorm Signature Modeling to Mitigate Adversarial Manipulation in Federated LLMs
本文提出了一种名为 FedLNS（Federated Learning with Normalization Signatures）的服务器端框架，用于在联邦学习环境中检测和缓解恶意客户端提交的异常模型更新。在联邦训练中，服务器无法直接验证
CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence
该论文针对网络威胁情报（CTI）消费方式的范式转变提出创新性解决方案。当前，CTI 的消费主体正从人类分析师转向能够自主编排多步调查的 LLM 智能体。尽管智能体的'工具侧'（如规划循环、工具协议、上下文管理）已快速成熟，但'语料侧'仍停留
AdaRare: Telemetry-Guided Joint Profile Control for Greybox Fuzzing
本文提出 AdaRare，一个基于 AFL++ 的灰盒模糊测试扩展，旨在协调模糊器中多个内部控制面，以提升边覆盖效率。传统灰盒模糊器通常包含交互队列、变异、字典、能量调度和比较求解等多个控制面，但先前的自适应系统往往只优化其中的某个决策对象
Wagtail: Improper restriction handling on Page translation API endpoint
### Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoi
Wagtail: Improper permission handling when copying snippets
### Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an e
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
### Impact The Documents and Images [API V2](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorre
Wagtail: Identification of documents by SHA1 hash
### Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whethe
Cloud & Application Security
Cloud & Application Security
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise
Next-Gen Identity Security
Next-Gen Identity Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Named an Innovation and Growth Leader in the 2026 Frost Radar™: Cloud and Application Runtime Security
CrowdStrike Expands Identity Leadership with OpenID and IDPro
CrowdStrike Expands Identity Leadership with OpenID and IDPro
cloud architecture assessment
cloud architecture assessment
ransomware and multifaceted extortion defense
ransomware and multifaceted extortion defense