Ouroboros: Self-Referential Backdoor Attacks on Speech Enhancement via Clean Audio Triggers
本文提出了一种名为 Ouroboros 的新型后门攻击框架，专门针对语音增强（Speech Enhancement）模型。语音增强模型通常作为实时语音服务的前端模块，用于降噪和语音质量提升，但以往的后门攻击研究主要集中于分类任务，且依赖主动
2026-09-02 归档
今日共收录 1494 条安全情报，包含 600 个 CVE，479 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Reducio: Optimized Confidential Serverless Cloud Deployments for Enterprise Customers
本文提出了一种名为 Reducio 的机密无服务器云部署优化方案，面向企业客户对数据隐私与低延迟的双重需求。近年来，基于机密虚拟机（Confidential Virtual Machines, CVM）的无服务器平台被提出，旨在解决无服务器
ActReal: System-Level Mobile Agents Challenge Mobile Automation Detection
该论文提出 ActReal，一个针对系统级移动智能体的物理动作攻击框架。研究背景是：系统级移动智能体（如手机自动化代理）已从固定脚本演变为自适应系统，能持续观察界面、推理并调整动作，从而可能被用于自动化攻击，在动态 UI 中导航并完成复杂任
A New Algebraic Algorithm for LWE
本文提出一种求解搜索型LWE问题（Search-LWE）的新代数算法。LWE问题由Regev于2005年引入，是现代密码学与后量子安全的核心假设。目前求解Search-LWE的算法大致分为代数类、组合类和格基类。该工作属于代数方法：其高层思
HSMLog: Small Language Model-Assisted Hardware Security Module Log Anomaly Detection with Behavioral Analysis
该论文提出了一种面向硬件安全模块（HSM）日志的异常检测框架 HSMLog，旨在解决传统方法仅关注孤立事件而忽略跨事件序列、密钥状态、会话及时间模式之间关联性的问题。HSM 是负责密钥管理和加密操作的硬件设备，其日志包含安全关键行为，但异常
Building the Truman Show: A TrustZone-Based Framework for Lightweight Out-of-band Kernel Security Monitoring
本文针对操作系统内核级安全威胁（如 rootkit）日益增多、传统内核内防御机制因与内核同权限运行而共享攻击面、一旦内核被攻破即可被绕过的痛点，提出了一种基于 ARM TrustZone 的轻量级带外内核安全监控架构 LOOM。LOOM 利
SVP Is NP-Hard for Some Rank-2 Cyclotomic Modules
本文研究分圆模上的最短向量问题（SVP）的计算复杂性。设 q 为模 4 余 3 的素数，ζ_q 为本原 q 次单位根，K=ℚ(ζ_q) 为分圆域，其整数环为 O_K=ℤ[ζ_q]。作者证明了在 O_K^2 的满秩自由子模上，以 ℓ2 范度量
Unconditional Certified Randomness without Structure
该论文提出了一种在量子随机预言机模型（QROM）下实现无条件安全认证随机性的协议。该协议是非交互式的，且可由经典验证者公开验证，其设计基于 Yamakawa 和 Zhandry 在 JACM'24 上提出的量子性证明（proof of qu
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This...
CVE-2026-3851
该漏洞影响 WordPress Divi 主题的所有版本直至 4.27.6，属于存储型跨站脚本（XSS）。漏洞核心在于动态内容（Dynamic Content）功能对旧版 JSON 格式的处理存在两处耦合缺陷：(1) 保存时净化过滤器 et
A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of t...
CVE-2026-84442
CVE-2026-84442 是存在于 Android 平台 MapQuest Get Directions 应用 10.16.1 版本中的一个路径遍历漏洞。漏洞位于组件 com.mapquest.android.ace 的 ExpoSha
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when p...
CVE-2026-14957
Libreswan 在 FIPS 模式下处理 X.509 证书时存在拒绝服务漏洞。具体而言，add_decoded_cert() 函数调用 CERT_ExtractPublicKey() 提取公钥，并断言结果非空。但当公钥提取失败（例如 R
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without conten...
CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accept
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell me...
CVE-2026-84694
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on man
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the compone...
CVE-2026-84430
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a man...
CVE-2026-84427
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools
A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser Tool. ...
CVE-2026-84425
A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tool
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML ...
CVE-2026-84359
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the rende
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a ...
CVE-2026-84358
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had com
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted netw...
CVE-2026-84357
Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social
UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-84356
UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address ba