Characterizing Network Centralization and Observability in the Remote MCP Ecosystem
该论文首次对远程 Model Context Protocol（MCP）服务器生态开展大规模经验性测量与刻画。MCP 已成为自主智能体连接外部数据源与执行环境的主流接口，生态正从本地进程执行迁移到远程 Streamable HTTP 部署，
2026-09-18 归档
今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。
← 返回归档列表XIR: A Framework for Interoperability across Cross-Chain Protocols Based on a Verifiable Intermediate Representation
该论文研究跨链协议之间的互操作性问题。当前大多数跨链通信采用点对点配置，即源链与目标链之间必须存在直接连接，这严重限制了区块链的可达范围，并在需要接入更多链时带来大量额外配置成本。为量化这一问题，作者收集了 2025 年 1 月至 10 月
JANUS: Denial-of-Service Attack Against Beam Hopping in LEO Satellite Networks
低轨（LEO）卫星网络正被广泛用于提供全球连接，但单星资源有限，而业务需求在地理与时间上高度不均。波束跳变（beam hopping）把卫星服务区划分为若干地理小区，不再同时照亮全部小区，而是依据观测到的流量需求，动态将有限波束分配给被选中
Sybil-TraceGuard: Traceability-enhanced Sybil Guardian for Connected and Autonomous Vehicles Using Dynamic Semi-supervised GNN
该论文聚焦车联网与自动驾驶汽车（CAV）环境中的 Sybil 攻击问题。攻击者利用隐私保护机制所允许的伪名（pseudonym）切换能力，不断更换身份并伪造基本安全消息（BSM），使同一攻击源在系统中呈现为多个看似无关的碎片化身份。已有方案
Investigating Adversarial Robustness of Heterogeneous Cooperative Perception
该论文研究异构协同感知（heterogeneous cooperative perception, CP）的对抗鲁棒性问题。在异构 CP 场景中，搭载不同传感器配置的联网车辆通过紧凑特征图共享空间感知信息，接收方车辆借助学习到的翻译模块（t
Closing the Loop: Bidirectional Fully Encrypted Protocols
该论文关注「全加密协议」(Fully Encrypted Protocols, FEP)：这类协议在信道上产生的所有协议字节在计算上都与均匀随机串不可区分，使网络观察者无法依靠载荷特征、长度模式或握手指纹识别协议。此前研究主要给出单向 FE
SEEK: Secure and Efficient Encrypted Keyword Search For Privacy-Preserving Messaging Protocols
该论文关注端到端加密通信中的一个核心矛盾:加密保护了用户隐私,但同时使平台和服务方难以发现有害或非法内容(如儿童性剥削素材、欺诈、恐怖主义宣传等),从而形成"检测危险信息"与"保护终端用户隐私"之间的权衡。现有基于同态加密或可搜索加密的解决
Locus: A Framework for Exploring and Optimizing Point Addition Hardware for Zero-Knowledge Proofs
零知识证明(ZKP)是隐私保护与可验证计算的关键技术，但其密码学原语带来极高的计算开销，椭圆曲线上的点加(PADD)正是其中一类核心原语。此前已有研究在硬件上实现PADD，但通常只针对少数特定椭圆曲线与少数设计点，一方面使庞大的设计空间长期
Detecting Logic Vulnerabilities Across the Contract and Device Layers of Blockchain-Enabled IoT With Multi-Agent Heterogeneous Graph Attention
该论文聚焦区块链赋能的物联网（Blockchain-enabled IoT）系统中的跨层逻辑漏洞检测问题。此类系统将链上智能合约与链下嵌入式设备固件协同使用，以实现去中心化的设备管理与访问控制；因此其安全性同时取决于合约逻辑与设备固件逻辑。
Scaling Zero Knowledge UNSAT Verification via Normalized Chaining
本文研究「零知识 UNSAT 认证」这一形式化验证与软件保障中的基础原语的可扩展性问题。UNSAT 证明（即证明某个约束系统不存在可满足赋值）在硬件等价性检查、程序验证、配置/依赖求解等场景中被广泛使用，但在许多真实场景中，证明本身会泄露专
Observational Indistinguishability and Integrity Blind Regions in Hybrid Quantum-Classical Workflows
该论文研究量子-经典混合计算流水线（hybrid quantum-classical workflow）中的完整性验证问题，作者是 Roberto Fernández-Barrios 等人，属于 quant-ph 方向。核心问题是：在混合流
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicalda...
CVE-2026-54608
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/Syste
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs ho...
CVE-2026-54565
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox e
Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to discover_feed(feed_url...
CVE-2026-54339
Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passe
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow authenticated users execute arbitrary OS ...
CVE-2026-52483
The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by s...
CVE-2026-93337
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection crea
MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/...
CVE-2026-54504
MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging...
CVE-2026-54677
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot acc...
CVE-2026-54676
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid CRC corruption due to parallel claim add batadv_bla_add_claim() is used to add claim...
CVE-2026-93203
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid CRC corruption due to parall