Verifiable Quantum Advantage and Computation via Quantum Circuit Obfuscation
本文研究如何借助量子不可区分混淆（qiO）构造可经典验证的量子优势与 BQP 计算验证协议。核心问题是：在经典客户端只有多项式能力的前提下，能否验证量子设备确实完成了经典难以模拟的计算。作者在假设 qiO 存在，并假设比 BQP≠BPP 略
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Natural Barriers to Quantum Extraction: On the Post-Quantum (In)security of (O)EKE and Masny-Rindal OT
该论文研究「编译器式」密码构造在量子敌手模型下的安全性边界。EKE（加密密钥交换，Bellovin 与 Merritt，IEEE S&P 1992）以及 Masny-Rindal 不经意传输（ACM CCS 2019）是两类高效编译方法：它
Protocol Integration of Physical Layer Deception into EAP-TEAP Wi-Fi Authentication
该论文针对基于凭证的 EAP 认证无法区分合法凭证持有者与持有被窃凭证的攻击者这一根本缺陷，提出把物理层欺骗（Physical Layer Deception, PLD）机制作为认证链中的二次验证环节，并在真实企业 Wi-Fi 认证栈中完成
Can AI Oversight Be Zero Knowledge?
随着 AI 系统越来越多地基于机密数据给出结论（例如依据医疗记录给出适岗性评估，或依据未公开的分子结构预测候选药物性质），如何在不泄露底层数据的前提下验证这些输出是否正确，成为一个关键问题。此前的一类工作借助交互式证明与「辩论」（debat
Cybersecurity in Edge Computing: A Trust-Aware Federated Hybrid Intrusion Detection Framework
该论文针对边缘计算场景下的入侵检测难题提出了一套名为 TA-FHIDF（Trust-Aware Federated Hybrid Intrusion Detection Framework，信任感知联邦混合入侵检测框架）的方案。研究背景是：
A Systematization of Knowledge on DeFi Vaults: Architectures, Curation Mechanisms, and Strategy Design
本文是一篇关于去中心化金融（DeFi）金库的系统化知识综述（SoK），面向区块链金融应用的安全设计与分析。DeFi 金库是基于智能合约的资产管理系统，其核心机制是汇集用户存款、执行可编程的链上策略，并按份额铸造代币化的权益凭证，代表持有者对
Breaking the Bounded Entanglement Barrier for Quantum Position Verification
本文研究量子位置验证(QPV)的理论安全性根基。位置验证由 Chandran 等人于 2014 年提出，其目标是让验证方通过交互式协议确认证明方所声称的物理位置；在经典设定下，该任务被证明不可能完成。已有的不可能性结果进一步指出：在 QPV
XIM: The XDC Interledger Messaging Protocol
分布式账本、隐私保护型机构网络以及传统支付系统之间，越来越需要跨异构信任域交换经过认证的消息并完成资产结算，但现有互操作方案通常只侧重三件事之一：应用层抽象、跨链消息传输，或是在同一账本家族内部的同步执行，难以同时兼顾通用性与可验证性。本文
Path-Finding, Orbit State Preparation, and the Security of Invariant Quantum Money
该论文研究基于纽结的量子货币(quantum money from knots)及其推广形式——不变子货币(invariant money)的安全性证明基础。这类方案的安全性依赖于 path-finding 的困难性, 即在两个具有相同不变
On quantum interactive proofs with a laconic prover
该论文研究带简洁证明者（laconic prover）的两消息量子交互证明系统。经典情形下，Goldreich、Vadhan 与 Wigderson 于 2002 年提出的简洁证明者交互证明，刻画了证明者通信量仅为对数级即可验证的问题类。量
Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
CVE-2026-55231
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version
Lektor 3.3.14 CSRF via Admin API Endpoints
CVE-2026-104059
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows un
DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
CVE-2026-55083
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versi
jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
CVE-2026-68495 · CVE-2026-68496
The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d
jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
CVE-2026-68496 · CVE-2026-68495
The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when de
Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation
CVE-2023-54404
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows atta
djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
CVE-2026-73976
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated
djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
CVE-2026-73975
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated de
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
CVE-2026-77387
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU tim
Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)
CVE-2026-94620
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to versio