2026-10-28 归档

今日共收录 2009 条安全情报,包含 1141 个 CVE,471 篇安全通告,以及 100 篇研究论文。

← 返回归档列表
学术论文2026-10-27 发布INFO

Split Federated Unlearning

Split federated learning (SFL) combines partitioned model execution with federated aggregation to support collaborative

历史摘要 · 未重新核验 · arXiv cs.CR

学术论文2026-10-26 发布INFO

ORBITAL: Optimization of Robust Brain--Computer Inference Through Architecture-Aware Low-Precision Compression

Compact electroencephalography (EEG) decoders enable embedded brain--computer interfaces (BCIs), but compression can alt

历史摘要 · 未重新核验 · arXiv cs.CR

学术论文2026-10-26 发布INFO

Atomic Security Concerns: Towards a Foundational Language for Security Knowledge Representation

Cybersecurity governance, risk management, compliance, and security architecture rely on numerous concepts, including se

历史摘要 · 未重新核验 · arXiv cs.CR

学术论文2026-10-26 发布INFO

JANUS: Synthesizing Cross-Layer Defenses Against Web Deserialization Attacks

Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit div

历史摘要 · 未重新核验 · arXiv cs.CR

学术论文2026-10-26 发布INFO

Pricing Cross-Bank Context in Federated Anti-Money Laundering

Most graph-based Anti-Money Laundering (AML) methods assume access to a pooled transaction graph containing all accounts

历史摘要 · 未重新核验 · arXiv cs.CR

学术论文2026-10-26 发布INFO

SoK: Timestamps Are Not a Time Model: Rethinking Temporal Reasoning in Host-Based Intrusion Detection

Host-based intrusion detectors order events, window audit streams and sequence attack stages by their timestamps. Every

历史摘要 · 未重新核验 · arXiv cs.CR

学术论文2026-10-26 发布INFO

Phantom Forgetting: How BatchNorm State Fakes Deletion in Edge Split Machine Unlearning

Split learning is a natural fit for edge intelligence: a resource-constrained edge device runs the first layers of a net

历史摘要 · 未重新核验 · arXiv cs.CR

学术论文2026-10-24 发布INFO

Securing Edge & Physical AI: Post-Quantum IoT Blockchain for Mission-Critical Cyber-Physical Agents

Distributed Cyber-Physical Systems (CPS) and Edge AI networks increasingly depend on public-key authentication and key-e

历史摘要 · 未重新核验 · arXiv cs.CR

安全公告2026-10-27 发布INFO

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

CVE-2026-116684

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

CVE-2026-116683

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement

CVE-2026-118173

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for requ

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

CVE-2026-118171

CVE-2026-118171

The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. T

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

CVE-2026-118172

CVE-2026-118172

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

CVE-2026-118170

CVE-2026-118170

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made w

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

reduxjs redux-devtools Remotedev Server evalAction code injection

CVE-2026-117526

A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

X.Org Server XKB SetGeometry TextDoodad Double Free

CVE-2026-88812

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection

CVE-2026-117516

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

CVE-2026-116678

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader v

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI manage

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-27 发布INFO

oretnom23 php-travel-agency-system traceapplication.php sql injection

CVE-2026-117515

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impa

历史摘要 · 未重新核验 · OSV.dev