Alert for CVE-2024-21287
CVE-2024-21287
Alert for CVE-2024-21287
2026-09-06 归档
今日共收录 918 条安全情报，包含 147 个 CVE，434 篇安全通告，以及 81 篇研究论文。
← 返回归档列表Alert for CVE-2022-21500
CVE-2022-21500
Alert for CVE-2022-21500
Alert for CVE-2021-44228
CVE-2021-44228
Alert for CVE-2021-44228
Linux 内核提权 CVE-2026-31431(copy-fail)
CVE-2026-31431
Linux 内核提权 CVE-2026-31431(copy-fail)
Alert for CVE-2026-35273
CVE-2026-35273
Alert for CVE-2026-35273
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
## Summary `validateCertificatePath()` does not verify that an attestation's certificate chain actually terminates at a
Population-Calibrated Graph Screening at 835-Million-Address Scale, with Label-Free Transfer to New Chains
本文介绍了一套已部署的区块链地址合规筛查系统，其核心思路是将地址判定从传统的制裁名单查询与聚类启发式，转变为基于其在多链交易图中的位置进行打分。系统底层构建了一个包含 835,330,427 个地址与 15,826,261,934 条边、跨
Preprocessing Failure and Adversarial Detection in Depthwise-Separable Edge Vision Systems
本文针对边缘视觉系统中深度可分离卷积网络（如移动端常见架构）在对抗攻击面前使用基于预处理的防御时的有效性评估缺口展开研究。以往关于预处理防御（例如图像压缩、去噪等输入变换）的评测主要基于残差类网络（如 ResNet）或 Inception
SecDT: A Profile-Based Security Layer for TRDP Communications
该论文提出了 SecDT，一种用于列车实时数据协议（TRDP）通信的轻量级安全层。TRDP 广泛用于铁路车辆（rolling stock），但其原生设计几乎不支持密码学保护。特别是 TRDP 过程数据使用的组播流量配置，用于在车载子系统间交
A Black Box for Agentic Processes: Blockchain-Anchored Evidence for AI Agent Communication, Human Oversight, and GRC Audits
本文由 Arslan Brömme 撰写，是一篇立场与架构论文，针对自主AI代理在相互通信、调用工具、交换中间结果及请求人工审批等流程中产生的全新审计难题。核心背景是 2026 年 OpenAI/Hugging Face 事件所暴露出的痛点
Security and Privacy in the Musical Metaverse: Threat Analysis and Design Implications
本文面向音乐元宇宙（Musical Metaverse, MM）这一新兴领域，系统分析了其独特的安全与隐私威胁，并提出设计启示。MM是指用于实时协作音乐创作的沉浸式虚拟环境，具有超低延迟、连续多模态数据流、异构设备等特征，其安全与隐私问题显
Long-Range Indirect Control-Flow Prediction in Stripped Binaries via Dual Virtual Hubs and Multi-Task Graph Learning
本文针对剥离二进制中恢复间接控制流（ICF）边的问题。现有方法难以处理长距离依赖，隔离不同ICF类型，并常在易受标签噪声和数据泄漏影响的协议下评估。作者提出ICFlowNet，一个统一框架，用于剥离二进制的长程间接控制流预测。ICFlowN
After Cheap Discovery: From unknown to known-and-unfixed
自动化漏洞发现技术已经大大降低了寻找漏洞的专业门槛，使得以往依赖专家稀缺注意力的“保护”不再有效。当前行业重点放在漏洞的发现与修复上，且两者的成本都在下降。本文作者认为，决定系统暴露程度的关键并非单纯的成本曲线，而是发布决策时的“修复覆盖率
Differentially private federated learning with Byzantine-robust aggregation: A cross-domain framework for secure model training in banking and healthcare systems
该论文聚焦于联邦学习在银行、医院等受监管机构中的实际应用痛点。尽管联邦学习允许各方在不共享原始数据的前提下协同训练模型，但仍有两大安全隐患：一是客户端交换的参数更新仍可能通过梯度反演或成员推断攻击泄露本地记录信息；二是诸如 FedAvg 这
Privacy Leakage in Federated Learning: Gradient-Based Client Identity Inference and Defenses for Inertial Sensing in Vehicular Edge Networks
本文研究车联网边缘智能场景下联邦学习（FL）的隐私泄露问题。虽然FL被普遍视为保护原始传感器数据的隐私方案，但客户端上传的模型更新（梯度/权重增量）仍可能泄露客户端身份，破坏V2X安全关键应用所依赖的匿名性，并增加对抗机器学习、模型中毒和后
Removing Speech, Keeping Activities: A Privacy Firewall for Acoustic Sensing in Assisted Living
针对辅助生活场景中老年人日常活动监测的声学传感技术,语音隐私泄露是阻碍其实际部署的关键壁垒。本文提出了一种基于U-Net编码器-解码器结构的隐私防火墙管道,完全使用合成数据训练,能够从环境音频中移除语音成分,同时保留与日常活动相关的环境声音
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be...
CVE-2026-86060
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited chara
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for...
CVE-2026-67281
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a sess...
CVE-2026-67279
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never att
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting a...
CVE-2026-67278
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes