Unconditional Certified Randomness without Structure
本文提出一种在量子随机预言机模型（Quantum Random Oracle Model, QROM）下实现可认证随机性（Certified Randomness）的新协议。该协议基于 Yamakawa 和 Zhandry 的“量子性证明”
2026-09-01 归档
今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。
← 返回归档列表False-CSI Attacks in Power-Domain NOMA for 6G: A Threat Taxonomy and System-Level Impacts
本文针对 6G 网络中功率域非正交多址接入（PD-NOMA）系统所面临的虚假信道状态信息（CSI）攻击威胁进行了系统研究。NOMA 技术通过非正交资源分配提升频谱效率和海量连接能力，是 5G 演进与 6G 的关键候选技术，但其功率分配、用户
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary Fil...
CVE-2026-75921
该漏洞存在于 WordPress 插件 Master Addons for Elementor（包括 3.1.9 及之前所有版本）中，具体位置是处理模板套件上传的 AJAX 回调函数 upload_template_kit()。该函数在权限
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versi...
CVE-2026-19952
CVE-2026-19952 涉及 WordPress 插件 Frontend Admin by DynamiApps 的一个高危漏洞。该插件广泛用于前端内容管理，但所有版本（至 3.29.12 及之前）中的 move_folders 函数
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute of the dslc_modules_...
CVE-2026-13203
CVE-2026-13203 是 WordPress 插件 Live Composer – Free Website Builder 中存在的存储型跨站脚本（Stored XSS）漏洞，影响版本包括 2.1.19 及之前的所有版本。该漏洞源
Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies th...
CVE-2026-82748
该漏洞位于 ash-project 的 Ash 框架中，涉及聚合（Aggregate）操作的授权检查。在 Ash.Actions.Aggregate 的实现中，系统将多个聚合按照其 {authorize?, read_action} 参数分
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced pr...
CVE-2026-82745
Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash...
CVE-2026-82744
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controll
Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actio...
CVE-2026-82743
Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory....
CVE-2026-82742
Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a fi
Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_w...
CVE-2026-82741
Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid in...
CVE-2026-82740
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nest
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmat...
CVE-2026-82739
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attrib...
CVE-2026-82738
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by
Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535...
CVE-2026-82737
Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match ...
CVE-2026-82736
Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-in
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should ha...
CVE-2026-82735
Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expr
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constrai...
CVE-2026-82734
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-f
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deseriali...
CVE-2026-19032
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI sch
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data fro...
CVE-2026-82733
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unaut