A Comprehensive Study of Native Code Bugs in Python Applications
Python 应用程序在机器学习、科学计算等领域广泛使用，这些应用常集成基于 C 等低级语言编写的原生代码组件，以提升性能或实现互操作性。然而，原生代码中的 bug 往往隐蔽且难以发现，构成对整体质量的重大挑战。尽管已有相关研究，但对 Py
2026-09-01 归档
今日共收录 1266 条安全情报，包含 424 个 CVE，451 篇安全通告，以及 107 篇研究论文。
← 返回归档列表Context or Digits? Balancing Memorability and Efficiency in Virtual Reality Authentication
本论文提出了一种面向虚拟现实（VR）环境的基于自适应方向的身份认证方法（Adaptive Direction-Based Authentication, ADBA），旨在平衡密码的可记忆性与输入效率之间的权衡。传统的VR认证常采用6位数字P
Unlearning on Spatio-Temporal Graphs through Subgraph Virtual Edge Reconstruction
时空图（Spatio-Temporal Graphs）广泛用于建模复杂动态过程，如时间序列预测、分子动力学和医疗健康监控。随着 GDPR、CCPA 等隐私法规的出台，模型需要支持对未经授权数据的“遗忘”（unlearning），即从已训练模
Enhancing Web Application Firewalls with BERT-GNN for SQL Injection Detection
该研究针对 Web 应用安全中检测复杂 SQL 注入（SQLi）攻击这一关键难题，提出了一种基于 BERT 与图神经网络（GNN）的混合检测模型，并针对 Web 应用防火墙（WAF）场景进行优化。方法上，先将 SQL 查询进行分词处理，通过
Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
本文针对央行数字货币（CBDC）银行间结算系统在分布式账本技术（DLT）上运行时所面临的根本性权衡：区块链透明性虽能实现无需信任的验证，却会将商业敏感的双方交易流暴露给所有网络参与者。为化解这一矛盾，作者提出了一种面向许可型以太坊兼容网络的
DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination
该论文提出一个名为 DisCTI 的自动化网络威胁情报（CTI）分发系统，旨在解决当前 CTI 分发中缺乏行业感知（sector-aware）和及时性的问题。研究背景是：尽管 MISP 等平台提供了行业标签功能（如能源、金融、政府），但实际
Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence
CVE-2026-52730
Xibo is an open source digital signage platform with a web content management system and Windows display player software
oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs
CVE-2026-53507
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request
Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion
CVE-2026-14696
When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), eth_bridge_input_process() in subsys/net/l2/ethernet/bri
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
CVE-2026-53508
oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
CVE-2026-53553
Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability ex
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
CVE-2026-53552
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile,
Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
CVE-2026-14368
The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c copies a parsed JSON string into
I3C IBI work-node free-list data race between ISR and workqueue thread
CVE-2026-14367
The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_i
MCPHub: Path Traversal via Malicious MCPB Manifest Name
CVE-2026-79743
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
CVE-2026-79744
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
CVE-2026-79746
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
CVE-2026-79747
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
CVE-2026-79748
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
CVE-2026-79749
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end