Position Matters: Feature Inversion Attacks in ViT Split Inference with Token Reduction and Shuffling
本文研究视觉Transformer（ViT）在分割推理场景下的隐私泄露问题。在分割推理中，边缘设备将中间层的token表示传输给云端模型完成推理。为降低通信与计算开销，通常采用token缩减技术；为限制信息泄露，有人提出token乱序，打乱
2026-09-04 归档
今日共收录 1362 条安全情报，包含 399 个 CVE，552 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Sentinel-Based Failover for QKD-Augmented IPsec Tunnels
该论文研究量子安全 IPsec 隧道在实际部署中的高可用性问题。当前混合密钥建立机制（如结合经典算法与量子密钥分发 QKD）虽然能提供量子安全保护，但当 QKD 基础设施故障时，隧道建立可能中断，从而影响业务连续性。针对这一挑战，作者提出并
Differentially private federated learning with Byzantine-robust aggregation: A cross-domain framework for secure model training in banking and healthcare systems
本文提出一个面向银行、医院等受监管行业的联邦学习框架 DP-BR-FedAvg，旨在同时解决联邦学习在实际落地中的两大核心威胁：隐私泄露与 Byzantine 拜占庭鲁棒性。联邦学习允许多方在不共享原始数据的前提下协作训练共享模型，但客户端
Verifiable quantum advantage in extremely low depth
本文研究了一个可在极低深度量子电路中求解、同时能被经典计算机高效验证的采样问题，从而展示量子优势。作者构造了一个采样任务，该任务可由浅层量子电路解决，但在基于格（Lattice）的假设下对多项式时间经典算法是困难的，并且经典验证者可以高效验
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker...
CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5...
CVE-2026-67398
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8,
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distrib...
CVE-2026-85446
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node ident
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:1...
CVE-2026-49456
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/ro
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to ...
CVE-2026-85221
MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property w
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /f...
CVE-2026-56128
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firew...
CVE-2026-56127
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inje
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling req...
CVE-2026-80515
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST e
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/...
CVE-2026-85100
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentS
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/component...
CVE-2026-85022
A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash...
CVE-2026-85021
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(s
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged...
CVE-2026-84832
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow w
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password...
CVE-2026-84831
SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authenticati
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.
CVE-2026-84830
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated adminis
In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute ...
CVE-2026-80753
In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue
In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF SOCKMAP, set sk_us...
CVE-2026-80735
In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref s