GateDrain: Availability Attacks and Admission-Side Defense for Confidence-Gated Edge-Cloud Inference
该论文研究的是「置信度门控（confidence-gated）边缘-云协同推理」这一常见部署范式中的可用性安全问题。其基本机制是：边缘侧模型先对输入做本地预测，若校准后的置信度高于阈值，就直接在边缘返回结果；若低于阈值，则将请求升级（off
2026-09-29 归档
今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Zero Knowledge Proofs in Quantum Networks
该论文研究的是量子网络环境下的零知识证明（Zero-Knowledge Proof, ZKP）问题。零知识证明是一种基础密码学原语，允许证明者向验证者证明某个陈述为真，同时不泄露除「该陈述有效」之外的任何信息。作者指出，现有绝大多数 ZKP
Efficient TCitH-Based Alternatives to SLH-DSA: Cross-Layer ASIC Design of Mirath
研究背景：量子计算对现行公钥密码体系构成现实威胁，NIST 已完成三类后量子签名标准的制定——ML-DSA 与 FN-DSA 基于格困难问题，SLH-DSA 则基于哈希假设。为保持密码敏捷性（crypto agility），避免某一数学假设
Bluehood: Missing authentication on Bluehood API routes when web auth is enabled
CVE-2026-49994
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
CVE-2026-101913
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside...
CVE-2026-101912
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSub
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
CVE-2026-101911
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
CVE-2026-101910
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, th
@xhmikosr/decompress: Path traversal via symlink chain
CVE-2026-101894
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output)
Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
CVE-2026-101080
A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the
Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
CVE-2026-88804
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripti
Session Not Revoked Server-Side on Logout in Rancher
CVE-2026-88805
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the acco
Langflow Code Execution via eval() in Component Input Schema
CVE-2026-101861
Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows a
agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision
CVE-2026-101079
A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function i
Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
CVE-2026-88808
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
CVE-2026-93539
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is no
Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
CVE-2026-93538
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cl
Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
CVE-2026-93537
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push acce
LXD client recursive file pull allows directory escape via malicious VM agent
CVE-2026-87798
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to
Arbitrary file write on LXD host via symlink in migration stream
CVE-2026-87799
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,