On SSI-based Private Decentralized Bidding
该论文研究在去中心化环境中实现私密投标的问题。传统私密投标要求参与者在投标窗口期内提交密封报价，确保内容对其他投标人隐藏，以保证公平竞争。区块链虽然提供去中心化和公开可验证性，但在没有可信第三方（TTP）的情况下，现有方法难以验证投标者是否
2026-08-26 归档
今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to ...
CVE-2026-65091
NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection.
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients p...
CVE-2026-79786
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI wit
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.rout...
CVE-2026-55620
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the clean_found...
CVE-2026-55618
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well
Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the upload_sound me...
CVE-2026-55419
Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/p...
CVE-2026-79776
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication ru
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAP...
CVE-2026-78581
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Acce
Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PB...
CVE-2026-63076
Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was no
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ...
CVE-2026-63075
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not ack
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and ho...
CVE-2026-79662
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/s
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the ...
CVE-2026-79661
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or ra
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP...
CVE-2026-53561
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0
Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credentials when a resource uses stateless ...
CVE-2026-65633
Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as fu
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. e...
CVE-2026-75554
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private pac...
CVE-2026-75542
Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositor
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileg...
CVE-2026-16348
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative acces
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP...
CVE-2026-66908
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel:
Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.1...
CVE-2026-66907
Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Knative component Th...
CVE-2026-63621
Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Inject