Quantum Secret Sharing and Error Correction vs No-Cloning
秘密共享在密码学中无处不在：经典情形下所有访问结构均可实现，门限结构甚至可高效构造。但进入量子场景后，不可克隆定理导致许多访问结构无法实现；对于门限结构，量子秘密共享（QSS）可行当且仅当门限 t 严格大于 n/2。本文提出一种变体：提供输
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Query-Limited RAM Programs and their Applications
该论文研究量子一次性程序（Quantum One-Time Programs，QOTP/OTP，Broadbent、Gutoski 与 Stebila，CRYPTO 2013）的推广问题。经典/量子一次性程序能把某个功能编码进一枚量子令牌，
Verifiable quantum advantage based on polynomials with planted structures
本文研究量子优势理论中的一个核心问题：是否存在这样一类量子优势协议——其资源需求与「随机线路采样」（RCS）相当，同时又仅凭量子计算输出的经典结果即可被验证。作者提出「模拟秘密」（simulation secrets）这一概念作为可验证量子
Rate 1/5 Non-Malleable Codes against Entangled Split-State Tampering
该论文研究的是密码学与编码理论交叉领域中的非可延展码（Non-Malleable Codes, NMC）。非可延展码的核心保证是：敌手对码字进行篡改后，解码结果要么等于原始消息，要么是一个与原始消息无关的（可模拟的）消息，而不会产生"被敌手
GNSS Spoofing in Mobile Devices: A Survey on Impact and Countermeasures
该论文是一篇聚焦智能手机场景的 GNSS 欺骗综述，系统梳理了攻击影响与可行对策。背景方面，智能手机的导航、网约车、位置分享、紧急呼叫等大量日常功能都依赖 GNSS 定位，而手机内嵌 GNSS 接收机因卫星信号到达地面功率极低、且民用信号结
Device-Independent Conference Keys from Parity-Extended Games
设备无关会议密钥协商（DI-CKA）允许多个参与方利用不可信的量子设备协商共享密钥，其安全性由非局域性（non-locality）认证，而无需信任设备内部实现。已有 DI-CKA 协议几乎都围绕单一贝尔不等式构造，典型代表是 CHSH 博弈
MultiTable: A Faster Hash Table at any Physical Load Factor up to and Including One
本文提出一种名为 multitable 的稳定哈希表结构与 Rust 参考实现，目标是在同等物理内存占用下同时获得更高吞吐与更强灵活性。现有主流方案（如 Rust hashbrown 中的 SwissTable）采用固定梯度的装载因子策略，
A Hybrid Approach to Malware Detection: Integrating Few-Shot Model-Agnostic Meta-Learning with Autoencoders
该论文针对勒索软件检测中"新型样本或标注样本稀缺"这一核心痛点，提出了一种混合深度学习框架，将自编码器特征提取器（Autoencoder Feature Extractor, AFE）与模型无关元学习分类器（Model-Agnostic M
The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via t...
CVE-2026-93367
CVE-2026-93367 是 WordPress 插件 Visitors Traffic Real Time Statistics Pro 中的一个未授权存储型跨站脚本漏洞，影响所有版本至 11.22（含）。该漏洞源于插件通过 ahcp
A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. This manipulat...
CVE-2026-104052
CVE-2026-104052 是 itsourcecode Pet Shop Management System 1.0 中被披露的一处 SQL 注入漏洞。受影响文件为 admin_reject_completed.php，问题出在该文件
Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext acr...
CVE-2026-103098
CVE-2026-103098 描述的是在一个未加密的 HTTP 连接中，把敏感密钥作为 URL 的一部分进行传输所导致的信息泄露问题。根据 NVD 提供的描述，客户端发起的请求走的是 HTTP 而非 HTTPS，因此该密钥在传输路径上以明
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the c...
CVE-2026-103097
CVE-2026-103097 披露了一个在 Android 应用程序包中硬编码 API 密钥的安全问题。由于 Android 应用可被逆向工程，攻击者能够从 APK 文件中提取嵌入的敏感凭证，进而可能未经授权地调用后端 API，导致数据泄
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the clie...
CVE-2026-103096
CVE-2026-103096 描述的是 Android 应用程序包中存在硬编码 API 密钥的安全问题。由于 Android 应用可以被逆向工程，攻击者能够从客户端应用中提取嵌入的敏感 API 凭据，进而未授权使用该密钥。CVSS 3.1
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying abs...
CVE-2025-71427
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same conne...
CVE-2026-86344
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the f
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS). ...
CVE-2026-71454
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-sit
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.
CVE-2026-71453
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63.
CVE-2026-71452
- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects Ea
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.
CVE-2026-71449
: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affects EasyIO FS32: before 3.0b63.
CVE-2026-71448
: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abus