BenX: Resource-Sharing Permutations for Computational Integrity
本文针对计算完整性（computational integrity）证明系统中所使用的、定义在素域 F_p 上的密码学哈希函数，提出了一种名为 BenX 的新型置换（permutation）设计与哈希构造。研究背景是：在以零知识证明为代表的
2026-09-28 归档
今日共收录 884 条安全情报，包含 147 个 CVE，402 篇安全通告，以及 73 篇研究论文。
← 返回归档列表Peregrino: A Full-Hardware Accelerator for the Complete Falcon Post-Quantum Digital Signature Scheme on Resource-Constrained Edge Devices
该论文面向后量子密码在资源受限边缘设备上的落地难题，提出了名为 Peregrino 的硬件加速器。背景在于：量子计算机的出现威胁经典公钥密码的安全性（量子算法可破解在传统攻击下仍安全的方案），NIST 因此标准化了一批后量子密码算法，其中
Werracle: Sub-Cent Intra-Block AI Reflex Oracles and Flash-Loan Circuit Breakers for EVM Smart Contracts
该论文针对链上 AI 推理在 EVM 环境中的根本性瓶颈展开研究。背景问题是:以太坊虚拟机存储按 gas 计费,若把静态浮点神经网络权重矩阵写入链上存储,成本高达数百万 gas,使直接链上推理在工程上不可行;而零知识机器学习(ZK-ML)虽
Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
CVE-2026-101046
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities
pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings
CVE-2026-101043
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the htt
Heym before 0.0.53 Authentication Bypass via Telegram Webhook
CVE-2026-100865 · CVE-2026-101049 · CVE-2026-101050
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credent
Heym before 0.0.53 Slack Webhook Signature Verification Bypass
CVE-2026-100865 · CVE-2026-101050 · CVE-2026-101049
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing
KitchenOwl through 0.7.10 IDOR via unchecked category ID
CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati
navi through 2.24.0 OS Command Injection via Cheatsheet Variables
CVE-2026-101032
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Atta
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
CVE-2026-100870
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the r
spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection
CVE-2026-100867
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before renderi
onefetch through 2.28.1 Terminal Escape Sequence Injection
CVE-2026-100866
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters,
Heap use-after-free on read during bidirectional (D)TLS shutdown
CVE-2026-15442
In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS
OCSP stapling v2 multi accepts non-CA chain certificates as issuers
CVE-2026-89102
In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response s
NameConstraints not enforced across unconstrained intermediate CA
CVE-2026-89133
wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly e
Subject CN name-constraint check bypassed when non-DNS SAN present
CVE-2026-89134
A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN
Failed X509_verify_cert leaves unverified CA in shared CertManager
CVE-2026-89135
A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certifi
Client accepts unsolicited RawPublicKey server certificate type
CVE-2026-89136
When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited s
Trusted peer certificate match ignores public key, allowing forged CA clones
CVE-2026-93302
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any
Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY
CVE-2026-94418
Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse t