Bridging the Opacity: Evidence-Backed Cross-Chain Transaction Correspondence Reconstruction Across Heterogeneous Blockchains
跨链桥实现了异构区块链之间的互操作性，但同时也切断了追踪非法资金所依赖的交易链路：资金从源链经桥转移到目的链后，原本连续的交易记录被拆散。第三方调查机构通常无法访问桥后端所维护的"源链交易到目的链交易"映射关系，作者对 131 个跨链桥的调
2026-09-20 归档
今日共收录 942 条安全情报，包含 169 个 CVE，438 篇安全通告，以及 68 篇研究论文。
← 返回归档列表Reachability, Not Observation: Containing Systems Whose Wiring Changes
这篇论文 (cs.NI) 讨论一个被普遍忽视的安全度量偏差: 围堵 (containment) 决策——防火墙放在哪里、监控哪些链路、程序能触及什么——通常基于对系统结构的某一次观测快照来计算, 而真实的连接关系 (wiring) 会随时间
Characterizing Network Centralization and Observability in the Remote MCP Ecosystem
该论文聚焦于 Model Context Protocol（MCP）从本地进程执行向远程 Streamable HTTP 部署演进过程中，整个生态在规模化后暴露出的架构集中度与安全可观测性问题。作者认为，MCP 已成为自治智能体连接外部数据
JANUS: Denial-of-Service Attack Against Beam Hopping in LEO Satellite Networks
该论文研究低地球轨道(LEO)卫星网络中的波束跳变(beam hopping)机制所引入的安全风险。LEO 星座被越来越多地用于提供全球范围的连接服务, 但每颗卫星的星上资源(波束、功率、带宽)十分有限, 而地面业务需求在地理上和时间上都高
XIR: A Framework for Interoperability across Cross-Chain Protocols Based on a Verifiable Intermediate Representation
该论文研究跨链协议在点对点（point-to-point）组网模式下的可达性瓶颈，并提出名为 XIR 的互操作框架。研究背景是：当前跨链消息传递普遍依赖源链与目标链之间的直连通道，一条通道只能覆盖一对区块链，导致链与链之间的可达范围受限于已
Sybil-TraceGuard: Traceability-enhanced Sybil Guardian for Connected and Autonomous Vehicles Using Dynamic Semi-supervised GNN
该论文关注车联网与自动驾驶车辆（CAVs）面临的 Sybil 攻击问题：攻击者利用隐私保护的假名切换机制，在交替使用多个假名的同时伪造基本安全消息（BSM），从而制造出时间上碎片化的多个虚假身份。现有方案大多只能标记可疑行为，但传统单点检测
Detecting Logic Vulnerabilities Across the Contract and Device Layers of Blockchain-Enabled IoT With Multi-Agent Heterogeneous Graph Attention
该论文聚焦区块链赋能的物联网（Blockchain-enabled IoT）系统中的逻辑漏洞检测问题。这类系统把链上智能合约与链下嵌入式设备固件结合起来，用于去中心化的设备管理与访问控制，因此其安全性同时取决于合约逻辑与固件逻辑：任一层的逻
SEEK: Secure and Efficient Encrypted Keyword Search For Privacy-Preserving Messaging Protocols
端到端加密通信在保护用户隐私的同时，也让平台难以发现其中传播的有害或违法内容，形成“内容检测”与“端到端隐私”之间的根本矛盾。针对该矛盾，作者提出 SEEK——一种面向隐私保护消息协议的高效加密关键词搜索协议，将同态加密（HE）与安全两方计
Locus: A Framework for Exploring and Optimizing Point Addition Hardware for Zero-Knowledge Proofs
该论文聚焦零知识证明（ZKP）在实际部署中面临的性能瓶颈问题。ZKP 是实现隐私保护计算与可验证计算的关键技术，但其底层密码学原语计算开销极高。椭圆曲线上的点加（Point Addition, PADD）正是其中最基础、被调用最频繁的原语之
Scaling Zero Knowledge UNSAT Verification via Normalized Chaining
该论文关注形式化验证与软件保障中的基础原语——UNSAT 证明（不可满足性证明）。在实际工程中，SAT/SMT 求解器生成的证明往往编码了专有逻辑、内部约束或安全敏感信息，直接公开披露会导致知识产权泄露或攻击面暴露。零知识 UNSAT 认证
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user i...
CVE-2026-18346
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8....
CVE-2026-9832
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptograph
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin...
CVE-2026-7527
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all version
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of se...
CVE-2026-93894
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
CVE-2026-88097
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
CVE-2026-82560
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting d
rclone serve docker Path Traversal via Volume Name
CVE-2026-93987
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin.
rclone before 1.75.1 Path Traversal via Directory Listing Names
CVE-2026-93986
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allow
hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
CVE-2026-93981
hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a stri
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
CVE-2026-78030
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.