Device-Independent Conference Keys from Parity-Extended Games
本文研究的是设备无关会议密钥协商（Device-Independent Conference Key Agreement, DI-CKA）：一组（N 方）参与者在完全不信任其量子设备的前提下，仍需协商出一把共享密钥，其安全性由量子非局域性（
2026-10-04 归档
今日共收录 931 条安全情报，包含 128 个 CVE，457 篇安全通告，以及 95 篇研究论文。
← 返回归档列表Crossing the Cyber Divide: Sim-to-Sim and Sim-to-Real Transfer for RL Agents
该论文研究网络攻防强化学习智能体在不同仿真环境之间的策略迁移问题。现有网络攻击智能体通常只在单一模拟器中训练和评估，导致无法判断学到的策略能否迁移到其他环境，也妨碍部署与公平比较。作者指出，不同网络模拟器在状态表示、观测模型和动作空间方面差
Need for Coherent Access in Constructing Quantum Cryptography
该论文研究量子密码学中伪随机态（PRS）构造的可实现性问题，属于量子计算复杂性理论中的黑盒分离（oracle separation）研究。已知结论表明，存在从量子安全单向函数（quantum-secure OWF）构造 PRS 生成器的黑盒
Quantum Secret Sharing and Error Correction vs No-Cloning
该论文研究量子秘密共享（QSS）在「多份输入副本」设定下的可行性与不可能性边界。经典秘密共享中，任意访问结构都可行，阈值结构更有高效协议；但进入量子设定后，不可克隆定理（no-cloning）使大量访问结构变得不可能，而且对阈值结构而言，不
Robust and leakage-resilient device-independent oblivious transfer in MiniQCryp
该论文在 MiniQCryp 框架下构造了设备无关（DI）的不经意传输（OT）与比特承诺协议，其唯一计算假设是存在后量子单向函数。其核心安全模型是：诚实参与方只使用可信的经典计算来驱动不可信的量子设备，而这些设备之间可以预先共享任意纠缠，并
MultiTable: A Faster Hash Table at any Physical Load Factor up to and Including One
该论文提出了一种名为 multitable 的新型哈希表结构，并给出了 Rust 参考实现。作者要解决的核心问题是：现有主流工程实现（以 Rust 生态中 hashbrown 所采用的 SwissTable 为代表）在物理负载因子上受到刚性
System-Level Optimization Beyond Cryptographic Kernels: An ML-KEM Case Study on Arm Cortex-M7
该论文研究嵌入式后量子密码在 Arm Cortex-M7 平台上的系统级优化空间。背景是：此前嵌入式 PQC 实现的工作几乎全部集中在指令级层面，包括算术内核改进、手写汇编调优、寄存器分配与指令调度（典型代表是基于 SLOTHY 的自动化汇
Query-Limited RAM Programs and their Applications
本文研究量子密码学中一次性程序（one-time program, OTP）范式的推广问题。量子一次性程序（QOTP，由 Broadbent、Gutoski 与 Stebila 在 CRYPTO 2013 提出）能把某一功能编码进一个量子令
LaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers to bypass the per-IP daily re...
CVE-2026-105130
LaraDashboard 在 1.4.0 起至 1.4.8 之前的版本中，注册流程 RegisterController::register 存在竞态条件（race condition）问题。该组件原本设计了基于来源 IP 的每日注册次数
LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through th...
CVE-2026-105129
CVE-2026-105129 是披露于 LaraDashboard 1.4.8 之前版本的授权校验缺陷（不当授权 / 访问控制不足，CWE-863 类问题）。LaraDashboard 是构建在 Laravel 之上的后台管理面板组件，其
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. ...
CVE-2026-105126
LaraDashboard 是一款基于 Laravel 的后台管理面板。在 1.4.8 版本之前，存在不正确的权限管理漏洞。经过身份验证的 Admin 用户（拥有 role.edit 权限）可以通过编辑或重命名角色来提升权限。具体而言，攻击
LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows ...
CVE-2026-105125
LaraDashboard 是一个基于 Laravel 框架的后台仪表盘组件。根据 NVD 元数据，该组件在 1.4.8 之前的版本中存在一处路径穿越（Path Traversal）漏洞。漏洞的触发点位于应用路由中的 {lang} 路径段：
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path...
CVE-2026-105123
CVE-2026-105123 是影响开源轻量级 CMS 项目 W（代码库 vincent-peugnet/wcms）的一个远程代码执行漏洞，波及 3.18.0 及之前的所有版本。问题根因在于媒体管理 API 对路由中的路径参数缺乏校验：上
Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki:...
CVE-2026-103065
CVE-2026-103065 影响 WordPress 生态中广泛使用的定制器框架库 Themeum Kirki（Kirki），影响范围为 6.3.1 及之前的全部版本。该漏洞被归类为「输入中指定数量验证不当」（Improper Vali
OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the ...
CVE-2026-105121
OpenAM 16.1.3 之前版本存在不当授权（授权校验逻辑缺陷）问题。核心成因在于：系统在判断“销毁其他用户会话”这一高权限操作是否越过 realm 边界时，比对的是【发起请求者自身所属 realm】与目标 realm，而不是【被销毁的
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybr...
CVE-2026-105119
OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/conn...
CVE-2026-105118
OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and reg...
CVE-2026-105117
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-s...
CVE-2026-105116
OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes wi...
CVE-2026-105115
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP