Johnny Still Receives Spam SMS: Assessing the Robustness of SMS Spam Detection
本文系统评估了实际部署中短信垃圾信息检测系统在对抗攻击下的鲁棒性。作者指出，现有检测系统在受控环境中准确率很高，但在面对真实世界复杂多变的垃圾短信与对抗性扰动时，性能显著下降。研究涵盖了三类被终端用户实际依赖的检测系统：商业即时通讯应用、第
2026-09-05 归档
今日共收录 1726 条安全情报，包含 665 个 CVE，657 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Griotte: Verified Compartmentalisation via Capabilities
本文提出 Griotte 和 Griotte OS，这是对 CHERIoT 硬件能力机器与 CHERIoT RTOS 的抽象化但忠实的建模，旨在为 CHERIoT 的分区隔离（compartmentalisation）安全保证提供形式化验证
Supersingular Elliptic Curves Without Inseparable Small Degree Endomorphisms
本文研究超奇异椭圆曲线与其 Frobenius 共轭曲线之间同源（isogeny）存在性的最小次数问题。对于固定特征 p，定义 δ(p) 为保证从任意超奇异曲线 E 到其 Frobenius 共轭 E^{(p)} 存在同源所需的最小次数。作
Verification of $K$- and Infinite-Step Strong/Weak Anonymity Using Concurrent Compositions
本文研究部分可观测离散事件系统中的匿名性验证问题。匿名性是一种信息流安全属性，其核心思想是：在外部观察者通过系统输出（观测）推断系统内部状态时，系统不应让某一时刻的状态被唯一确定，从而保护用户隐私。在离散事件系统框架下，已有 K-步匿名性和
Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations
本论文针对区块链智能合约的安全漏洞研究缺乏结构化真实数据的问题，基于公共 CVE 数据库构建了一个专门面向以太坊智能合约的漏洞数据集 CVE-Smart-Contracts。作者从 CVE 记录中筛选出截至 2026 年 7 月与以太坊智能
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue ha...
CVE-2026-52777
CVE-2026-52777 是 YesWiki（一个基于 PHP 开发的 wiki 系统）中存在的已认证 PHP 对象注入漏洞。在 4.6.6 版本之前，BazarImportAction 功能在数据处理过程中使用了不安全的 unseri
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteU...
CVE-2026-52775
CVE-2026-52775 是 YesWiki（一个 PHP 实现的 Wiki 系统）中被发现的一处 SQL 注入漏洞。在 4.6.6 版本之前，包括最新开发分支在内的所有版本中，ReactionManager::deleteUserRe
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body cont...
CVE-2026-52772
YesWiki是一个基于PHP的开源wiki系统，用于团队协同编辑与知识管理。在4.6.6版本之前，其Bazar表单字段模板在处理字段标签（field.label）和字段提示（field.hint）时，错误地继续使用`|raw('html'
YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELET...
CVE-2026-52771
YesWiki 是一个用 PHP 实现的 wiki 系统，其 4.2.0 至 4.6.6（不含）版本存在一个高危 SQL 注入漏洞。问题出在 ApiController::deletePage() 方法中：程序从数据库读取页面标签（tag）
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accept...
CVE-2026-52769
YesWiki是一个基于PHP的wiki系统。该漏洞（CVE-2026-52769）影响从4.6.2版本到4.6.6之前的所有版本。问题出在POST /api/forms/{formId}/actor/inbox路由上，该路由的ACL被设置
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a l...
CVE-2026-52767
CVE-2026-52767 是 YesWiki（一个基于 PHP 的 Wiki 系统）中存在的一处签名验证绕过漏洞。受影响版本为 4.6.2 至 4.6.6（不含 4.6.6）。漏洞根因位于 HttpSignatureService::v
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter space...
CVE-2026-52763
CVE-2026-52763 是 YesWiki（基于 PHP 的 wiki 系统）4.6.6 之前版本中存在的一个存储型 SQL 注入漏洞。该漏洞位于 recentchanges 动作（actions/recentchanges.php）
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, co...
CVE-2026-82684
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs bec...
CVE-2026-76925
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatp
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances o...
CVE-2026-46636
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() u
An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modif...
CVE-2026-85787
An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before ve
A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server...
CVE-2026-85704
A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This i
A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backen...
CVE-2026-85703
A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this iss
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file serve...
CVE-2026-85702
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.
A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4...
CVE-2026-85701
A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue