安全资讯归档（2026-04-07）

36氪
- 中远海特、福田汽车在广州成立远福汽车供应链公司
- 监控系统出现漏洞，300多人被带走？海康威视回应：假的
- 美汽车安全监管机构结束对特斯拉高级智能召唤功能的调查
404 Media
- Multiple Hackers Warned Anti-Porn App Quittr About Security Issue for Months
Arturo Di Corinto
- L’INFRASTRUTTURA DEL TUTTO: Ciclo di seminari su Cybersecurity e intelligenza artificiale alla Sapienza, Università di Roma.
darkreading
- AI-Assisted Supply Chain Attack Targets GitHub
- Focusing on the People in Cybersecurity at RSAC 2026 Conference
- Fortinet Issues Emergency Patch for FortiClient Zero-Day
- Human vs AI: Debates Shape RSAC 2026 Cybersecurity Trends
- Lies, Damned Lies, and Cybersecurity Metrics
- RSAC 2026: How AI Is Reshaping Cybersecurity Faster Than Ever
Hacker News: Front Page
- Show HN: I Built Paul Graham's Intellectual Captcha Idea
http://www.infosecurity-magazine.com/rss/news/
- Fortinet Releases Emergency Patch After FortiClient EMS Bug Is Exploited
ICT Security Magazine
- Cybersecurity sanitaria: come difendere gli ospedali da ransomware e cyber-intrusioni
NetSPI
- AI Fools Week: Don’t Let AI Fool Your Pentesting Strategy
NVIDIA Blog
- National Robotics Week — Latest Physical AI Research, Breakthroughs and Resources
Offensive Security Blog: Latest Trends in Hacking | Praetorian
- The Attack Helix: Praetorian Guard’s AI Architecture for Offensive Security
Qualys Security Blog
- Signals from the Cloud Security Forecast 2026: Cloud Risk Is Scaling through Design, Not Disruption
Schneier on Security
- Hong Kong Police Can Force You to Reveal Your Encryption Keys
- New Mexico’s Meta Ruling and Encryption
Security Affairs
- Experts published unpatched Windows zero-day BlueHammer
- Fast-moving Storm-1175 uses new exploits to breach networks and drop Medusa
- GPUBreach exploit uses GPU memory bit-flips to achieve full system takeover
- Phishing LNK files and GitHub C2 power new DPRK cyber attacks
Sploitus.com Exploits RSS Feed
- Benchmarking-Agent-Architectures exploit
- Exploit for Classic Buffer Overflow in Pjsip exploit
- Exploit for Command Injection in Paloaltonetworks Pan-Os exploit
- Exploit for CVE-2025-10681 exploit
- Exploit for CVE-2025-1242 exploit
- Exploit for CVE-2026-33186 exploit
- Exploit for CVE-2026-34156 exploit
- Exploit for CVE-2026-39324 exploit
- Exploit for Deserialization of Untrusted Data in Facebook React exploit
- Exploit for Heap-based Buffer Overflow in Pjsip exploit
- Exploit for Improper Input Validation in Nodejs Node.Js exploit
- Exploit for Improper Restriction of XML External Entity Reference in Cisco Secure_Endpoint exploit
- Exploit for Out-of-bounds Write in Gnu Glibc exploit
- pentest-agent exploit
- uploadpwner exploit
TechCrunch
- Netflix launches a standalone app for kids’ games
- North Korea’s hijack of one of the web’s most used open source projects was likely weeks in the making
- Trump administration plans to cut cybersecurity agency’s budget by $700 million
Terence Eden’s Blog
- Did WordPress VIP leak my phone number?
The Trail of Bits Blog
- What we learned about TEE security from auditing WhatsApp's Private Inference
The Verge
- Asus’ lightweight 16-inch laptop is a formidable MacBook Air alternative
- First photos of solar eclipse from Artemis II crew look almost too good to be real
- Gemini is making it faster for distressed users to reach mental health resources
unSafe.sh - 不安全
- German authorities identify REvil and GandCrab ransomware bosses
- Legacy Systems are Undermining Financial Institution Cybersecurity
VulDB Recent Entries
- CVE-2017-18892 | Mattermost Server up to 4.0.4/4.1.0 Email Template neutralization
- CVE-2021-4473 | Beijing Topsec Network Security Tianxin Internet Behavior Management System prior 4.0.0.7_20210716.180815 Reporter objClass os command injection (CNVD-2021-41972)
- CVE-2024-14032 | Twitch Studio up to 0.114.8 XPC Service authorization
- CVE-2025-13044 | IBM Concert up to 2.2.0 Temporary File generation of predictable numbers or identifiers
- CVE-2025-15611 | Popup Box Plugin up to 5.4.x on WordPress add_or_edit_popupbox cross-site request forgery
- CVE-2025-31257 | Oracle Java SE 8u461-b50 JavaFX WebKitGTK memory corruption
- CVE-2025-39666 | Checkmk up to 2.2.0/2.3.0p45/2.4.0p24/2.5.0b2 untrusted search path
- CVE-2025-47374 | Qualcomm Snapdragon CCW/Snapdragon Compute FastConnect 6900 up to XRV7209 use after free
- CVE-2025-47389 | Qualcomm Snapdragon Auto up to XRV9209 buffer overflow
- CVE-2025-48651 | Google Android privilege escalation
- CVE-2025-54324 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 9110 NAS denial of service
- CVE-2025-54601 | Samsung Mobile Processor/Wearable Processor Exynos up to 1580 Global Variable race condition
- CVE-2025-57835 | Modem Mobile Processor/Wearable Processor/Modem Exynos up to 9110 RRC initialization
- CVE-2025-58349 | Modem Mobile Processor/Wearable Processor/Modem Exynos up to 9110 L2 denial of service
- CVE-2025-59440 | Samsung Mobile Processor/Wearable Processor/Modem Exynos up to 9110 USIM denial of service
- CVE-2025-61166 | SigningHub User 10.0 URL redirect
- CVE-2025-65116 | Hitachi JP1 IT Desktop Management 2 on Windows release of reference (sec-2026-118)
- CVE-2026-0049 | Google Android 14/15/16/16-qpr2 LocalImageResolver.java onHeaderDecoded resource consumption
- CVE-2026-0740 | SaturdayDrive Ninja Forms Plugin up to 3.3.26 on WordPress handle_upload unrestricted upload
- CVE-2026-1114 | parisneo lollms up to 2.1.x JSON Web Token access control
- CVE-2026-1839 | huggingface transformers up to 5.0.0rc2 trainer.py _load_rng_state deserialization
- CVE-2026-1900 | Spencer Haws Link Whisper Free Plugin up to 0.9.0 on WordPress REST Endpoint authorization
- CVE-2026-20431 | MediaTek MT8883 Base Station allocation of resources (MSV-4467)
- CVE-2026-20432 | MediaTek MT8893 Base Station out-of-bounds write (MSV-4461)
- CVE-2026-20433 | MediaTek MT8893 Base Station out-of-bounds write (MSV-4460)
- CVE-2026-20446 | MediaTek MT6813 sec boot out-of-bounds write (MSV-3899 / ALPS09963054)
- CVE-2026-20884 | LibRaw File deflate_dng_load_raw integer overflow (TALOS-2026-2364)
- CVE-2026-20889 | LibRaw d20315b File x3f_thumb_loader integer overflow (TALOS-2026-2358)
- CVE-2026-20911 | LibRaw 0b56545/d20315b File HuffTable::initval buffer size (TALOS-2026-2330)
- CVE-2026-21413 | LibRaw 0b56545/d20315b File lossless_jpeg_load_raw array index (TALOS-2026-2331)
- CVE-2026-22666 | Dolibarr ERP CRM up to 23.0.1 dol_eval_standard eval injection
- CVE-2026-22679 | Weaver Network e-cology 10.0/2026-03-31 POST Request method interfaceName/methodName missing authentication
- CVE-2026-23818 | HPE Private 5G Core up to 1.25.3.0 Graphical User Interface redirect
- CVE-2026-24450 | LibRaw 8dc68e2 File uncompressed_fp_dng_load_raw integer overflow (TALOS-2026-2363)
- CVE-2026-28808 | Erlang OTP up to 28.4.2 mod_alias.erl script_alias authorization
- CVE-2026-28810 | Erlang OTP up to 28.4.2 inet_res/inet_db generation of predictable numbers or identifiers
- CVE-2026-29047 | glpi-project glpi up to 10.0.24/11.0.5 Logs Export sql injection (GHSA-3m49-qf92-vccr)
- CVE-2026-30613 | AZIOT 1.1.9 UART Interface information disclosure
- CVE-2026-31053 | rizin librz/bin/format/le/le.c le_load_fixup_record denial of service (Issue 5753)
- CVE-2026-31058 | UTT HiPER 1200GW 2.5.3-170306 Parameter formConfigDnsFilterGlobal timeRangeName buffer overflow
- CVE-2026-31059 | UTT HiPER 520W 1.7.7-180627 /goform/formDia privilege escalation
- CVE-2026-31060 | UTT HiPER 810G 1.7.7-171114 Parameter formGroupConfig notes buffer overflow
- CVE-2026-31061 | UTT HiPER 810G 1.7.7-171114 Parameter ConfigAdvideo timestart buffer overflow
- CVE-2026-31062 | UTT 520W 1.7.7-180627 Parameter formFtpServerDirConfig filename buffer overflow
- CVE-2026-31063 | UTT HiPER 1200GW 2.5.3-170306 Parameter formArpBindConfig pools buffer overflow
- CVE-2026-31065 | UTT 520W 1.7.7-180627 Parameter formConfigCliForEngineerOnly addCommand buffer overflow
- CVE-2026-31066 | UTT HiPER 810G 1.7.7-1711 Parameter formTaskEdit selDateType buffer overflow
- CVE-2026-31351 | Feehi CMS 2.1.1 Title cross site scripting (ID 81)
- CVE-2026-31353 | Feehi CMS 2.1.1 Category Name cross site scripting (ID 84)
- CVE-2026-31354 | Feehi CMS 2.1.1 Permissions Group/Category/Description cross site scripting (ID 85)
- CVE-2026-3177 | smub Charitable Plugin up to 1.8.9.7 on WordPress Webhook payment_intent.succeeded data authenticity
- CVE-2026-32144 | Erlang OTP up to 28.4.2 Self-Signed Certificate pubkey_ocsp.erl certificate validation
- CVE-2026-33227 | Apache ActiveMQ Client/ActiveMQ Broker/ActiveMQ path traversal
- CVE-2026-33405 | pi-hole web up to 6.4 queries.js formatInfo cross site scripting (GHSA-jx8x-mj2r-62vq)
- CVE-2026-33727 | Pi-hole up to 6.4.0 /etc/pihole/versions privileges management (GHSA-c935-8g63-qp74)
- CVE-2026-33817 | etcd bbolt Branch Page out-of-bounds (ID 4923)
- CVE-2026-33865 | mlflow up to 3.10.1 Web Interface cross site scripting
- CVE-2026-33866 | MLflow up to 3.10.1 AJAX Endpoint authorization
- CVE-2026-34148 | fedify vocab-runtime up to 1.9.5/1.10.4/2.0.7/2.1.0 Outbound Request resource consumption (GHSA-gm9m-gwc4-hwgp)
- CVE-2026-34197 | Apache ActiveMQ Broker/ActiveMQ Jolokia MBeans Remote Code Execution
- CVE-2026-34208 | nyariv SandboxJS up to 0.8.35 protection mechanism (GHSA-2gg9-6p7w-6cpj)
- CVE-2026-34211 | nyariv SandboxJS up to 0.8.35 restOfExp recursion (GHSA-8pfc-jjgw-6g26)
- CVE-2026-34217 | nyariv SandboxJS up to 0.8.35 exposure of resource (GHSA-hg73-4w7g-q96w)
- CVE-2026-34378 | AcademySoftwareFoundation OpenEXR up to 3.4.8 EXR File Parser generic_unpack integer overflow (GHSA-v76p-4qvv-vh4g)
- CVE-2026-34379 | AcademySoftwareFoundation OpenEXR up to 3.2.6/3.3.8/3.4.8 EXR File Parser internal_dwa_decoder.h LossyDctDecoder_execute type conversion (GHSA-w88v-vqhq-5p24)
- CVE-2026-3466 | Checkmk up to 2.2.0/2.3.0p45/2.4.0p24/2.5.0b2 Dashboard Dashlet Title Link cross site scripting
- CVE-2026-34764 | Electron up to 39.8.4/40.8.4/41.0.x release use after free (GHSA-8x5q-pvf5-64mp)
- CVE-2026-34896 | Analytify Under Construction, Coming Soon & Maintenance Mode Plugin cross-site request forgery
- CVE-2026-34899 | Eniture LTL Freight Quotes Plugin up to 5.2.1 on WordPress authorization
- CVE-2026-34903 | OceanWP Ocean Extra Plugin up to 2.5.3 on WordPress authorization
- CVE-2026-34904 | Analytify Simple Social Media Share Buttons Plugin up to 6.2.0 on WordPress cross-site request forgery
- CVE-2026-34940 | kubeai-project kubeai up to 0.23.1 Model URL engine_ollama.go ollamaStartupProbeScript os command injection (GHSA-324q-cwx9-7crr)
- CVE-2026-34950 | nearform fast-jwt up to 6.1.0 JSON Web Token fast-jwt/src/crypto.js risky encryption (GHSA-mvf2-f6gm-w987)
- CVE-2026-34951 | forceworkbench up to 64.x Error Page footerScripts cross site scripting (GHSA-j94x-h584-rjf9)
- CVE-2026-34969 | Nhost up to 0.47.x information disclosure (GHSA-g2qj-prgh-4g9r)
- CVE-2026-35030 | BerriAI litellm up to 1.82.x JWT/OIDC enable_jwt_auth improper authentication (GHSA-jjhc-v7c2-5hh6)
- CVE-2026-35035 | ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0 Setting cross site scripting (GHSA-5ghq-42rg-769x)
- CVE-2026-35036 | lin-snow Ech0 up to 4.2.7 Response Body /api/website/title server-side request forgery (GHSA-wc4h-2348-jc3p)
- CVE-2026-35037 | lin-snow Ech0 up to 4.2.7 Endpoint /api/website/title website_url server-side request forgery (GHSA-cqgf-f4x7-g6wc)
- CVE-2026-35039 | nearform fast-jwt up to 6.0.x data authenticity (GHSA-rp9m-7r4c-75qg)
- CVE-2026-35044 | BentoML up to 1.4.37 generate.py generate_containerfile special elements used in a template engine (GHSA-v959-cwq9-7hr6)
- CVE-2026-35045 | TandoorRecipes recipes up to 2.6.3 batch_update authorization (GHSA-v8x3-w674-55p5)
- CVE-2026-35046 | TandoorRecipes recipes up to 2.6.3 bleach.clean cross site scripting (GHSA-9hhh-g2fc-r8x2)
- CVE-2026-35047 | Ajax30 BraveCMS up to 2.0.5 CKEditor Endpoint unrestricted upload (GHSA-9rcc-w59j-965v)
- CVE-2026-35050 | oobabooga text-generation-webui up to 4.1.0 Setting download-model.py path traversal (GHSA-jg96-p5p6-q3cv)
- CVE-2026-35052 | man-group dtale up to 3.21.x cross site scripting (GHSA-436g-fhfc-9g5w)
- CVE-2026-35164 | Ajax30 BraveCMS up to 2.0.5 CkEditorController.php unrestricted upload (GHSA-2j4q-6p52-4rhw)
- CVE-2026-35166 | gohugoio hugo up to 0.159.1 Link cross site scripting (GHSA-mcv8-8m8x-48pg)
- CVE-2026-35167 | kedro-org kedro up to 1.2.x kedro/io/core.py _get_versioned_path path traversal (GHSA-6326-w46w-ppjw)
- CVE-2026-35171 | kedro-org kedro up to 1.2.x dictConfig KEDRO_LOGGING_CONFIG code injection (GHSA-9cqf-439c-j96r)
- CVE-2026-35173 | xenocrat chyrp-lite prior 2026.01 authorization (GHSA-8c3h-rh2j-fxr9)
- CVE-2026-35174 | xenocrat chyrp-lite prior 2026.01 Setting config.json.php path traversal (GHSA-p6pf-2grm-8257)
- CVE-2026-35175 | Ajenti up to 2.2.14 auth_users authorization (GHSA-73jv-44c3-j5p2)
- CVE-2026-35177 | vim up to 9.2.0279 zip.vim Plugin path traversal (GHSA-jc86-w7vm-8p24)
- CVE-2026-35199 | Microsoft SymCrypt up to 103.10.x Hardware Security SymCryptXmssSign heap-based overflow (GHSA-rvj8-8h6x-hjmg)
- CVE-2026-35200 | parse-community parse-server up to 8.6.72/9.7.1-alpha.3 Header Content-Type interpretation conflict (GHSA-vr5f-2r24-w5hc)
- CVE-2026-35201 | davidfstr rdiscount prior 2.2.7.4 out-of-bounds (GHSA-6r34-94wq-jhrc)
- CVE-2026-35203 | ZLMediaKit ext-codec/VP9Rtp.cpp out-of-bounds (GHSA-gxr3-fwc7-q99h)
- CVE-2026-35208 | lichess-org lila /streamer cross site scripting
- CVE-2026-35209 | unjs defu up to 6.1.4 prototype pollution (GHSA-737v-mqg7-c878)
- CVE-2026-35213 | hapijs content up to 6.0.0 HTTP Content-Type/Content-Disposition redos
- CVE-2026-35389 | bulwarkmail webmail up to 1.4.10 SMIME Signature Verification certificate validation
- CVE-2026-35390 | bulwarkmail webmail up to 1.4.10 Email Content-Security-Policy-Report-Only cross site scripting
- CVE-2026-35391 | bulwarkmail webmail up to 1.4.10 X-Forwarded-For lib/admin/session.ts getClientIP less trusted source
- CVE-2026-35444 | libsdl-org SDL_image up to 762 XCF Image Parser src/IMG_xcf.c do_layer_surface out-of-bounds (GHSA-gq8w-x74c-h6p7)
- CVE-2026-35448 | WWBN AVideo up to 26.0 Endpoint check.php authorization (GHSA-3v7m-qg4x-58h9)
- CVE-2026-35449 | WWBN AVideo up to 26.0 die information disclosure (GHSA-hg8q-8wqr-35xx)
- CVE-2026-35450 | WWBN AVideo up to 26.0 FFmpeg Management Endpoints kill.ffmpeg.json.php missing authentication (GHSA-2vg4-rrx4-qcpq)
- CVE-2026-35452 | WWBN AVideo up to 26.0 CloneSite Plugin client.log.php information disclosure (GHSA-99j6-hj87-6fcf)
- CVE-2026-35454 | coder code-marketplace up to 2.4.1 VSIX File Parser path traversal (GHSA-8x9r-hvwg-c55h)
- CVE-2026-35470 | devcode-it openstamanager up to 2.10.1 Customer Information confronta_righe.php righe sql injection (GHSA-mmm5-3g4x-qw39)
- CVE-2026-35554 | Apache Kafka Clients up to 3.9.1/4.0.1/4.1.1 Producer Message use after free
- CVE-2026-39306 | MervinPraison PraisonAI up to 4.5.112 Recipe Registry Pull path traversal
- CVE-2026-39308 | MervinPraison PraisonAI up to 4.5.112 Recipe Registry path traversal
- CVE-2026-4079 | Guaven Labs SQL Chart Builder Plugin up to 2.3.7 on WordPress sql injection
- CVE-2026-5465 | ameliabooking Booking for Appointments and Events Calendar Plugin wp_set_password/wp_update_user authorization
- CVE-2026-5493 | Labcenter Proteus PDSPRJ File Parser out-of-bounds write
- CVE-2026-5494 | Labcenter Proteus PDSPRJ File Parser out-of-bounds write
- CVE-2026-5495 | Labcenter Proteus PDSPRJ File Parser out-of-bounds write
- CVE-2026-5496 | Labcenter Proteus PDSPRJ File Parser type confusion
- CVE-2026-5719 | itsourcecode Construction Management System 1.0 /borrowedtool.php sql injection
- CVE-2026-5731 | Mozilla Firefox up to 149.0.1 memory corruption
- CVE-2026-5732 | Mozilla Firefox up to 149.0.1 Text integer overflow
- CVE-2026-5733 | Mozilla Firefox up to 149.0.1 WebGPU memory corruption
- CVE-2026-5734 | Mozilla Firefox up to 149.0.1 memory corruption
- CVE-2026-5735 | Mozilla Firefox up to 149.0.1 memory corruption
- CVE-2026-5736 | PowerJob 5.1.0/5.1.1/5.1.2 detailPlus Endpoint InstanceController.java customQuery sql injection (Issue 1167)
Westenberg.
- The Hacker News tarpit
WIRED
- He Started a Social Network Alone. Then 5 Million People Signed Up
嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
- “影子AI”危机？绿盟威胁情报“三把锁”，构筑OpenClaw防御体系
- 一只AI“龙虾”的冰火一周：从全网追捧到紧急卸载——OpenClaw爆火背后的三大智能体安全风险与应对
- 亚洲顶赛公益进校 | XCTF百城千赛 · AI+安全万人计划重磅启航
- 嘶吼安全动态｜工信部NVDB平台发布风险提示：利用苹果iOS漏洞的攻击活动激增黑客利用React2Shell发起自动化凭证窃取活动
- 梆梆安全加固再进一步：延用Android16现有策略，零修改完美适配Android17
绿盟科技技术博客
- 重磅认证！绿盟AI安全围栏通过首批国家级政务大模型安全测评