gr-PHYSEC: Real-time Channel-based Key Generation for Physical Layer Secure Wireless Communications
该论文针对无线通信在动态、去中心化环境下的抗窃听需求，提出并实现了一个名为 gr-PHYSEC 的 GNU Radio 外部（out-of-tree, OOT）模块，用于实时物理层密钥生成。传统密钥分发要么依赖预共享秘密，要么依赖公钥密码的
2026-09-16 归档
今日共收录 2620 条安全情报，包含 1789 个 CVE，446 篇安全通告，以及 100 篇研究论文。
← 返回归档列表First Galileo SAS Authenticated Time Solution
民用 GNSS 接收机长期面临欺骗（spoofing）攻击的威胁，尤其在冲突地区周边，民航、海事作业与关键基础设施的定位与授时服务已受到日常性干扰。欺骗之所以可行，是因为传统民用 GNSS 信号的导航电文与测距码在结构上高度可预测，攻击者据
Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams
该论文针对网络入侵检测场景中事件流碎片化、异构的特点，提出了一种事件原生的符号-时序脉冲编码框架，用于让脉冲神经网络（SNN）能够直接在原始异构网络事件流上工作。研究背景是：SNN 依靠有状态处理实现稀疏、事件驱动的计算，天然契合低功耗边缘
Quantifying Observable High-Frequency Swapping on Arbitrum
该论文研究以太坊 Layer-2 rollup 时代出现的新型链上交易行为。作者指出，Arbitrum 等 rollup 以确定性排序、亚秒级出块和极低 gas 费取代了传统内存池竞争，虽抑制了经典 MEV，却催生了此前未被系统识别的行为模
Transparent Identity Verification Approach Using MPC and Efficient Credential Status Handling
该论文针对数字身份验证（eKYC）场景中隐私保护与效率难以兼顾的问题展开研究。作者指出，现有基于零知识证明（ZKP）的 eKYC 框架存在计算开销高、电路设计僵化、集成复杂以及链上验证成本昂贵等缺陷；同时，W3C 2021 提出的基于 Bi
Observational Indistinguishability and Integrity Blind Regions in Hybrid Quantum-Classical Workflows
该论文针对“混合量子—经典工作流”的完整性验证，提出一套“主张相对（claim-relative）”的证据/参照框架。核心问题是：当篡改或系统性偏差只改变标签通路（label path），而不改变可观测的特征/预测视图时，防御方能否仅凭观测
Trinqet: Private Triangle and Quadrangle Counting over Distributed Graphs
该论文关注分布式图分析中的隐私保护统计问题。三角形（triangle）与四边形（quadrangle）计数是图分析中的核心统计量，广泛用于社交网络分析、欺诈团伙识别、异常检测和网络结构刻画。然而现实中的图数据往往分散在多方手中，且边关系本身
A Graph-Based Framework for Extending Metric Differential Privacy Mechanisms
本文研究度量差分隐私（metric differential privacy, mDP）机制的可扩展构造问题。mDP 适合定义在结构化的秘密域上（例如路网、地理网格、坐标空间），因为它的隐私保证随秘密值之间的度量距离变化，比标准差分隐私更贴
Exploiting and Securing Docker containers and Kubernetes pods from a MitM attack
该论文研究如何保护容器化工作负载(如 Docker 容器与 Kubernetes Pod)免受中间人(Man-in-the-Middle, MitM)攻击。作者首先指出一个常被忽视的事实：容器化环境虽然提供隔离与编排便利，但其内部工作负载仍
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm us...
CVE-2026-86109
该漏洞存在于 VMware/Broadcom VeloCloud Edge 的软件更新工作流中。Edge 设备在安装更新包前会进行签名验证,但该验证流程并未限制用于工件校验的摘要算法(digest algorithm)。由于算法选择未被约束
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-85893
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-69486
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a net
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. At...
CVE-2026-92256
NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_s
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the netw...
CVE-2026-82567
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a conn
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_config_show.cgi, and l...
CVE-2026-76871
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can exploit this flaw v...
CVE-2026-76859
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi c
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network s...
CVE-2026-73444
On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unau
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability...
CVE-2026-88065
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions
Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affe...
CVE-2026-83419
Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communicat
Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affe...
CVE-2026-83418
Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communicat