The Security Feature Location Problem
该论文提出并定义了“安全特性定位”（Security Feature Location）问题，旨在解决软件安全工程中的一项基础性难题：给定一个软件系统，它实际实现了哪些安全特性（如身份认证、加密、访问控制等），以及这些特性具体对应到代码中的
2026-09-08 归档
今日共收录 1006 条安全情报，包含 268 个 CVE，456 篇安全通告，以及 21 篇研究论文。
← 返回归档列表ReCAST: Restoration-aware Cascaded Stage-wise Training for Obfuscated SMS Risk Classification
该论文提出 ReCAST（Restoration-aware Cascaded Stage-wise Training）框架，用于解决中文短信中混淆文本的风险分类问题。研究背景是：欺诈短信通过精心设计的混淆策略（如谐音、形近字、插入符号等）
Federated Attack Campaign Detection via Contrastive Encoding of Threat Indicators in Gradient Updates
针对传统网络攻击活动检测依赖跨组织共享敏感遥测与威胁情报、带来隐私与合规障碍的问题，本文提出一种基于联邦学习的模块化框架 FedIoC，用于在不直接传输 IoC（威胁指标）的情况下恢复跨组织的协同攻击活动模式。其核心思路是：各参与客户端在本
Memory-Efficient Designs for Word-Wise Universal Fully Homomorphic Encryption
全同态加密（FHE）允许在加密数据上直接进行计算，从而在数据分析全过程中保护隐私。然而，FHE 的执行速度远慢于明文计算，且近年来计算加速取得进展后，性能瓶颈逐渐转向内存层级——FHE 会将数据规模放大数个数量级，导致算术强度极低。针对这一
Has MIMO decoding been proved hard from lattice problems?
MIMO（多输入多输出）技术是现代无线通信的基础。物理层安全旨在利用噪声信道的物理特性保护传输信息，而无需上层加密。Dean 和 Goldsmith 曾通过借鉴 Regev 对 LWE（带噪声学习问题）的归约，提出将格问题（如最短向量问题、
Operational Roles of QRNG-Derived Quantum Entropy in Bitcoin Proof-of-Work Architectures
本文研究将量子随机数生成器（QRNG）产生的量子熵引入比特币工作量证明（PoW）架构后的运营作用。核心结论是：在候选区块头保持不同的前提下，用量子熵替换经典熵并不会改变诚实节点成功挖出区块的概率。作者指出，过去关于QRNG提升PoW的讨论多
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL r...
CVE-2026-16003
CVE-2026-16003 是ASUS Armoury Crate 驱动程序中的一个安全漏洞。Armoury Crate 是华硕为其主板、显卡及外设提供的系统管理/灯效控制软件，其内核驱动程序负责与硬件通信并提供某些受信任的操作。该漏洞的
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a craft...
CVE-2026-12962
Armoury Crate 存在不安全的跨域策略，允许不受信任的远程网页向本地服务端点发送包含 UNC 路径的请求。攻击者可通过诱导用户访问恶意网页，使该请求携带用户本机的 NTLM 哈希，并将其泄露给远程攻击者。该问题属于客户端交互型漏洞
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences ...
CVE-2026-82710
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a maliciou
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing rest...
CVE-2026-76977
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated at
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound re...
CVE-2026-76971
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or inter...
CVE-2026-76968
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacke
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on t...
CVE-2026-76967
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system ...
CVE-2026-76963
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated att
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially...
CVE-2026-76962
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functional
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privile...
CVE-2026-76961
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privile...
CVE-2026-76960
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileg...
CVE-2026-76959
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on c
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit s...
CVE-2026-76958
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal c
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered...
CVE-2026-66767
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted p