SoK: Failure Modes in Common Criteria Product Evaluation - A Taxonomy and Design-for-Evaluability Guidance
The Common Criteria (CC; ISO/IEC 15408) is the principal international framework for evaluating the security of IT produ
2026-10-11 归档
今日共收录 1127 条安全情报，包含 372 个 CVE，412 篇安全通告，以及 88 篇研究论文。
← 返回归档列表Pump-and-Dump meets Honeypot Tokens: Detection and Analysis of Telegram Bait-and-Trap Schemes
While Pump-and-Dump schemes have been extensively studied on centralized exchanges (CEXs), how they operate in decentral
The Price of Privacy: Randomness Complexity of Graph-Based Multi-Secret Sharing
We study the randomness required to share possibly correlated secret bits among parties connected by a graph. A dealer p
Hybrid Hierarchical Runtime Verification for Edge-IoT Security: Combining MonPoly and RTLola
Security monitoring of edge-IoT fleets faces three structural challenges. (i) A per-node monitor is cheap but cannot see
Hierarchical Security Monitoring for Edge-IoT: A Formal Methods Approach
Cyber resiliency in edge-IoT deployments is fundamentally an economic problem: detection must keep critical processes op
Automotive Hardware Attacks: An Architect's Guide to TARA
Threat analysis and risk assessment (TARA) according to ISO/SAE 21434 treats implementation-level hardware attacks incon
When Routing Reveals Membership: Privacy Leakage from MoE Router Telemetry
Mixture-of-Experts (MoE) language models produce routing information during inference that may be logged or exposed for
Temporal transformer CAN encoder with federated lightweight heads for anomaly detection
Modern vehicles rely on large numbers of Electronic Control Units (ECUs) that constantly exchange information over the C
Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir
CVE-2026-108595
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_o
mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment
CVE-2026-108592
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwra
InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool
CVE-2026-108591
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create
1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter
CVE-2026-108586
1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticat
argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
CVE-2026-108585
argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool tha
zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool
CVE-2026-108583
zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach int
GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store
CVE-2026-108582
GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows
AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login
CVE-2026-108580
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI
OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export
CVE-2026-108579
OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed sp
OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote
openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
CVE-2026-108551
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an O
cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing
CVE-2026-108549
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in pla