First Galileo SAS Authenticated Time Solution
该论文面向民用 GNSS 接收机在欺骗攻击下缺乏测距信号真实性保障的问题，报告了首个基于经认证的民用 GNSS 信号计算出的定时（授时）解算方案。背景是：针对民用 GNSS 接收机的欺骗攻击日益普遍，尤其在冲突地区附近，已对民航、海事和关键
2026-09-17 归档
今日共收录 2425 条安全情报，包含 1381 个 CVE，651 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Closing the Loop: Bidirectional Fully Encrypted Protocols
该论文研究双向全加密协议（BiFEP）的形式化安全定义与构造。全加密协议（FEP）指协议产生的所有字节在计算上与均匀随机字符串不可区分。此前工作主要关注单向 FEP（一方只发、一方只收），但多数应用需要双向通信。网络攻击者可同时观察两个方向
Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams
该论文聚焦于将脉冲神经网络（SNN）用于网络入侵检测时面临的一个关键工程与建模矛盾：SNN 依赖稀疏、事件驱动的有状态计算，天然契合低功耗边缘神经形态硬件，也契合异步到达、恶意行为多体现为时序模式的网络监控数据；但真实赛博数据流并非由连续数
FoundAna: A GNN-assisted Foundation Model for Graph Anomaly Detection
图异常检测旨在识别图中显著偏离预期模式的节点、边或子图，广泛支撑欺诈检测、垃圾信息识别、网络入侵发现等关键应用。然而现有方法普遍采用“一个数据集训练一个模型”的范式，受任务异构、标签稀缺和领域差异影响，难以迁移到多样化的真实场景。为此，论文
Observational Indistinguishability and Integrity Blind Regions in Hybrid Quantum-Classical Workflows
该论文针对混合量子-经典工作流（如量子机器学习、变分算法与经典后处理级联）的完整性问题，提出了一套“相对声明（claim-relative）的证据/参考框架”。核心洞察是：观测不可区分性（observational indistinguis
Locus: A Framework for Exploring and Optimizing Point Addition Hardware for Zero-Knowledge Proofs
该论文研究零知识证明（ZKP）中的核心性能瓶颈——椭圆曲线上的点加（PADD, point addition）运算的硬件加速问题。ZKP 是隐私保护与可验证计算的关键技术，但其密码原语计算开销极高，PADD 便是其中最频繁、最耗时的运算之一
SEEK: Secure and Efficient Encrypted Keyword Search For Privacy-Preserving Messaging Protocols
该论文针对端到端加密通信中的核心矛盾展开研究：加密机制在保护用户敏感数据的同时，也使得平台或监管方难以发现有害或违法信息，从而在「检测危险消息」与「保护终端用户隐私」之间形成难以调和的取舍。现有基于同态加密（HE）的加密关键词搜索方案在长消
Detecting Logic Vulnerabilities Across the Contract and Device Layers of Blockchain-Enabled IoT With Multi-Agent Heterogeneous Graph Attention
该论文聚焦于区块链赋能的物联网（Blockchain-enabled IoT）系统中的逻辑漏洞检测问题。此类系统将链上智能合约与链下嵌入式设备固件结合，用于实现去中心化的设备管理与访问控制，因此其安全性同时取决于合约逻辑与设备固件逻辑两个层
gr-PHYSEC: Real-time Channel-based Key Generation for Physical Layer Secure Wireless Communications
该论文提出并实现了 gr-PHYSEC，一个基于 GNU Radio 的 out-of-tree（OOT）模块，用于在真实无线环境中实时生成物理层对称密钥，以对抗窃听。传统密钥分发依赖预共享秘密或计算复杂度（如公钥密码），在动态、去中心化的
Exploiting and Securing Docker containers and Kubernetes pods from a MitM attack
该论文聚焦容器化环境（Docker 容器与 Kubernetes Pod）中的中间人（MitM）攻击防护问题。作者指出，容器内工作负载与传统非容器环境一样面临钓鱼、应用层漏洞利用与网络入侵等威胁，但由于容器网络叠加层、服务网格、动态调度与多
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU after onl...
CVE-2026-89968
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmet_t
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eis...
CVE-2026-89964
In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invali
In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332_set_value() enables the Vcc regulator on e...
CVE-2026-89936
In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imb
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qla_chk_edif_rx_sa_delete_pending() obtai...
CVE-2026-89863
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX S
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability imp...
CVE-2026-86107
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments betwee
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The aff...
CVE-2026-14916
A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports t...
CVE-2026-84906
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is appli
A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper...
CVE-2026-92220
A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm us...
CVE-2026-86109
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures becau
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration val...
CVE-2026-86108
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may al