安全资讯归档（2026-04-08）

2Libra 社区 - 今日热议
- 写了个简单的 ArchiSteamFarm Python API 库
- 有没有什么对 ai 安全小白友好的教学网站或者文档呢
36氪
- 36氪首发 | 柔性触觉传感器厂商完成近亿元融资，切入具身智能与锂电安全双场景
- Anthropic在源代码泄露数日后推出网络安全AI模型
- 海光信息发布“机密Token”，保障云端大模型数据安全
- 马斯克要求撤换OpenAI掌门人，主张恢复该公司非营利组织身份
Ars Technica - All content
- Anthropic limits access to Mythos, its new cybersecurity AI model
- Apple and Lenovo have the least repairable laptops, analysis finds
Black Hills Information Security, Inc.
- Getting Started In Pentesting – Advice From The BHIS Pentest Lead
Daring Fireball
- Sam Altman, in a Video Released by OpenAI, Apparently Thinks AGI Is Going to Hit Society Like a Once-a-Century Pandemic
- Solar Eclipse From the Far Side of the Moon
darkreading
- Full Sail University to Open IBM Cyber Defense Range Powered by AWS and Cloud Range on Campus
- Storm-1175 Deploys Medusa Ransomware at 'High Velocity'
Fidelis Security
- How Can Active Deception Validate Security Controls in Real Environments?
Hacker News: Front Page
- Assessing Claude Mythos Preview's cybersecurity capabilities
- US Labor Force Participation Continues to Slide
HackerNoon
- Multi-Agent Reinforcement Learning Needs More Than Better Rewards
Horizon3.ai
- 10 Minutes with Claude: Remote Code Execution in Apache ActiveMQ (CVE-2026-34197)
- CVE-2026-34197
http://www.infosecurity-magazine.com/rss/news/
- Anthropic Launches Project Glasswing to Use AI to Find and Fix Critical Software Vulnerabilities
- Iran‑Backed Threat Actors Hit US CNI Providers via Internet‑Facing OT Assets
InfoSec Write-ups - Medium
- 6+ Ways to Spot a Phishing Email in 2026
- Android APK Analysis Tool: AI-Powered Static Malware Analysis in Your Terminal
- The Company Fixed the Breach… but Forgot the Root Cause
- TryHackMe: CSRF Introduction — Full Walkthrough
- Why strip_tags() Does Not Protect You From XSS in PHP/Laravel
- Writeup for picoCTF challenge “Old Sessions”
MIT Technology Review
- The Download: water threats in Iran and AI’s impact on what entrepreneurs make
NetSPI
- Regulatory-Ready Security: Ensuring FCC Compliance for Routers
Schneier on Security
- Cybersecurity in the Age of Instant Software
Securelist
- Financial cyberthreats in 2025 and the outlook for 2026
Security Affairs
- Attackers exploit critical Flowise flaw CVE-2025-59528 for remote code execution
- Project Glasswing powered by Claude Mythos: defending software before hackers do
- Signature Healthcare hit by cyberattack, services and pharmacies impacted
Security Café
- When AI Understands Code: Prompt Injection to RCE
Simon Willison's Weblog
- Anthropic's Project Glasswing - restricting Claude Mythos to security researchers - sounds necessary to me
Sploitus.com Exploits RSS Feed
- Exploit for CVE-2026-22732 exploit
- Exploit for CVE-2026-27739 exploit
- Exploit for CVE-2026-3288 exploit
- Exploit for CVE-2026-34197 exploit
- Exploit for Eval Injection in Langflow exploit
- Exploit for OS Command Injection in Magnussolution Magnusbilling exploit
- Exploit for OS Command Injection in Magnussolution Magnusbilling exploit
- Exploit for OS Command Injection in Paessler Prtg_Network_Monitor exploit
- Exploit for Out-of-bounds Write in Exim exploit
- exploit-code-management exploit
- H4C-WEB exploit
- jshook_plugin_exploit_library exploit
- Magento-Polyshell-RCE exploit
- penetration-testing-engagement exploit
- shannon-defender-skill exploit
- sql-bypass exploit
- sql-injection-lab exploit
- wsa_exploits exploit
TechCrunch
- Anthropic debuts preview of powerful new AI model Mythos in new cybersecurity initiative
- I can’t help rooting for tiny open source AI model maker Arcee
- Intel signs on to Elon Musk’s Terafab chips project
- Iranian hackers are targeting American critical infrastructure, U.S. agencies warn
- Russian government hackers broke into thousands of home routers to steal passwords
- Uber is the latest to be won over by Amazon’s AI chips
- VC Eclipse has a new $1.3B to back — and build — ‘physical AI’ startups
The Decoder
- Microsoft's Bing team open-sources "Harrier" embedding model
The Verge
- Anthropic is launching a new AI model for cybersecurity
- GoPro is cutting 23 percent of its workforce
- Insta360’s Snap is a tiny magnetic phone screen for taking rear-camera selfies
- Satechi’s 3-in-1 travel stand now wirelessly charges your phone at 25W
unSafe.sh - 不安全
- [Tool] Rikune: A reverse-engineering MCP server that turns PE triage, Ghidra analysis, runtime evidence, and source-like reconstruction into reusable tools for any LLM
- Cloudflare targets 2029 for full post-quantum security
- From Malware and Exploits to Apps and Identities: How the Browser Became the Battleground
- Why i think Mythos is gonna be game changing after using Opus for a CTF
VMRay
- SOC Case Management: A Practical Guide to Getting It Right
VulDB Recent Entries
- CVE-2024-36058 | Koha Library up to 23.05.9 POST Parameter opac-sendbasket.pl bib_list sql injection
- CVE-2025-14857 | Semtech LR1110/LR1120/LR1121 SPI Interface write-what-where condition (psa-2026-001)
- CVE-2025-14858 | Semtech LR1110/LR1120/LR1121 SPI Interface sensitive information in resource not removed before reuse (psa-2026-001)
- CVE-2025-14859 | Semtech LR1110/LR1120/LR1121 risky encryption (psa-2026-001)
- CVE-2025-14944 | inisev BackupBliss Plugin up to 2.0.0 on WordPress Endpoint initializeOfflineAjax authorization
- CVE-2025-1794 | johanaarstein AM LottiePlayer Plugin up to 3.6.0 on WordPress SVG File Parser cross site scripting
- CVE-2025-20628 | Ping Identity PingIDM up to 7.2.2/7.3.1/7.4.1/7.5.0 insufficient granularity of access control
- CVE-2025-24817 | Nokia MantaRay NM Symptom Collector Application os command injection
- CVE-2025-24818 | Nokia MantaRay NM Log Search Application os command injection
- CVE-2025-24819 | Nokia MantaRay NM Software Manager application path traversal
- CVE-2025-56015 | GenieACS 1.2.13 NBI API Endpoint improper authentication
- CVE-2025-57847 | Red Hat Ansible Automation Platform 2 default permission
- CVE-2025-57851 | Red Hat Multicluster Engine for Kubernetes default permission
- CVE-2025-57853 | Red Hat Web Terminal default permission
- CVE-2025-57854 | Red Hat OpenShift Update Service default permission
- CVE-2025-58713 | Red Hat Process Automation 7 Process Automation Manager default permission
- CVE-2025-69515 | JXL 9 Inch Car Android Double Din Player Android 12.0
- CVE-2025-71058 | Dual DHCP DNS Server 8.01 UDP DNS Response injection
- CVE-2026-1342 | IBM Verify Identity Access Container inclusion of functionality from untrusted control sphere
- CVE-2026-1343 | IBM Verify Identity Access Container server-side request forgery
- CVE-2026-1346 | IBM Verify Identity Access Container unnecessary privileges
- CVE-2026-1672 | realmag777 BEAR Plugin up to 1.1.5 on WordPress woobe_redraw_table_row cross-site request forgery
- CVE-2026-1673 | realmag777 BEAR Plugin up to 1.1.5 on WordPress woobe_delete_tax_term cross-site request forgery
- CVE-2026-1865 | wpeverest User Registration & Membership Plugin up to 5.1.2 on WordPress membership_ids[] sql injection
- CVE-2026-2263 | wpmudev Hustle Plugin up to 7.8.10.2 on WordPress hustle_module_converted authorization
- CVE-2026-22683 | Windmill Community Edition/Enterprise Edition up to 1.614.0 Backend API raw_apps authorization
- CVE-2026-22711 | Wikimedia Wikilove Extension up to 1.43.6/1.44.3/1.45.1 on Mediawiki cross site scripting
- CVE-2026-24511 | Dell PowerScale OneFS up to 9.5.0.0/9.10.1.6/9.11.0.0/9.13.0.0 information exposure (dsa-2026-125)
- CVE-2026-2481 | beaverbuilder Beaver Builder Page Builder Plugin up to 2.10.1.1 on WordPress settings[js] cross site scripting
- CVE-2026-27102 | Dell PowerScale OneFS up to 9.5.0.0/9.10.1.6/9.11.0.0/9.13.0.1 privileges assignment (dsa-2026-125)
- CVE-2026-27144 | cmd-compile up to 1.25.8/1.26.1 on Go expected behavior violation
- CVE-2026-27949 | makeplane up to 1.2.x Authentication Utility auth.ts information disclosure (GHSA-8rvg-7w43-p2w2)
- CVE-2026-28261 | Dell Elastic Cloud Storage/ObjectScale up to 3.8.1.7/4.1.0.3/4.2.0.0 log file (dsa-2026-143)
- CVE-2026-28264 | Dell PowerProtect Agent up to 20.0 Service permission assignment (dsa-2026-158)
- CVE-2026-2838 | idealwebdesignlk Whole Enquiry Cart for WooCommerce Plugin up to 1.2.1 on WordPress woowhole_success_msg cross site scripting
- CVE-2026-28386 | OpenSSL up to 3.6.1 on x86-64 AES-CFB-128 out-of-bounds
- CVE-2026-28387 | OpenSSL up to 3.6.1 DANE Client Code use after free
- CVE-2026-28388 | OpenSSL up to 3.6.1 Delta CRL null pointer dereference
- CVE-2026-28389 | OpenSSL up to 3.6.1 CMS EnvelopedData Message CMS_decrypt null pointer dereference
- CVE-2026-28390 | OpenSSL up to 3.6.1 CMS KeyTransportRecipientInfo CMS_decrypt null pointer dereference
- CVE-2026-29181 | open-telemetry opentelemetry-go up to 1.40.x Header Field allocation of resources (GHSA-mh2q-q3fh-2475)
- CVE-2026-30460 | Daylight Studio FuelCMS 1.5.2 Blocks Remote Code Execution
- CVE-2026-3142 | uniquecodergmailcom Pinterest Site Verification plugin using Meta Tag up to 1.8 on WordPress post_var cross site scripting
- CVE-2026-31789 | OpenSSL up to 3.0.19/3.3.6/3.4.4/3.5.5/3.6.1 Hexadecimal Conversion heap-based overflow
- CVE-2026-31790 | OpenSSL up to 3.0.19/3.3.6/3.4.4/3.5.5/3.6.1 RSA KEM RSASVE Encapsulation RSA_public_encrypt uninitialized pointer
- CVE-2026-32280 | crypto-x509 up to 1.25.8/1.26.1 on Go Certificate allocation of resources
- CVE-2026-32281 | crypto-x509 up to 1.25.8/1.26.1 on Go Certificate algorithmic complexity
- CVE-2026-32282 | syscall-unix up to 1.25.8/1.26.1 on Go Root.Chmod AT_SYMLINK_NOFOLLOW symlink
- CVE-2026-3243 | danbilabs Advanced Members for ACF Plugin up to 1.2.5 on WordPress Path Validation create_crop path traversal
- CVE-2026-32712 | opensourcepos Open Source Point of Sale up to 3.4.2 Daily Sales Page customer_name first_name/last_name cross site scripting
- CVE-2026-32860 | NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0 LVLIB File Parser out-of-bounds write
- CVE-2026-32861 | NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0 LVCLASS File Parser out-of-bounds write
- CVE-2026-32862 | NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0 VI File Parser InitResourceMgr out-of-bounds write
- CVE-2026-32863 | NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0 VI File Parser sentry_transaction_context_set_operation out-of-bounds
- CVE-2026-32864 | NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0 VI File Parser aligned_free out-of-bounds
- CVE-2026-3296 | wpeverest Everest Forms Plugin up to 3.4.3 on WordPress html-admin-page-entries-view.php unserialize deserialization
- CVE-2026-3357 | IBM Langflow Desktop up to 1.8.2 deserialization
- CVE-2026-33810 | crypto-x509 up to 1.26.1 on Go Certificate Chain certificate validation
- CVE-2026-33815 | jackc pgproto3 array index
- CVE-2026-33816 | jackc pgproto3 comparison
- CVE-2026-3396 | shamimmoeen WCAPF Plugin up to 4.2.3 on WordPress post-author sql injection
- CVE-2026-34045 | podman-desktop Podman Desktop up to 1.26.1 on Windows allocation of file descriptors or handles without limits or throttling
- CVE-2026-34078 | Flatpak up to 1.16.3 symlink
- CVE-2026-34080 | flatpak xdg-dbus-proxy up to 0.1.6 improper validation of unsafe equivalence in input (GHSA-vjp5-hjfm-7677)
- CVE-2026-34371 | danny-avila LibreChat up to 0.8.3 writeFileSync path traversal
- CVE-2026-34580 | randombit botan up to 3.11.0 Path Validation certificate_known certificate validation
- CVE-2026-34582 | randombit botan up to 3.11.0 behavioral workflow
- CVE-2026-34765 | Electron up to 39.8.4/40.8.4/41.0.x window.open exposure of resource
- CVE-2026-3477 | projectzealous01 PZ Frontend Manager Plugin up to 1.0.6 on WordPress AJAX Endpoint pzfm_user_request_action_callback dataType authorization
- CVE-2026-34781 | Electron up to 39.8.4/40.8.4/41.0.x clipboard.readImage null pointer dereference
- CVE-2026-3480 | burlingtonbytes WP Blockade Plugin up to 0.9.14 on WordPress Shortcode render_shortcode_preview authorization
- CVE-2026-3535 | mlfactory DSGVO Google Web Fonts GDPR Plugin up to 1.1 on WordPress CSS File DSGVOGWPdownloadGoogleFonts unrestricted upload
- CVE-2026-35461 | papra-hq papra up to 26.3.x server-side request forgery (GHSA-cjw7-qg95-58mq)
- CVE-2026-35488 | TandoorRecipes recipes up to 2.6.3 CustomIsShared.has_object_permission routine
- CVE-2026-35492 | kedro-org kedro-plugins up to 9.2.x path traversal
- CVE-2026-35516 | Kovah LinkAce up to 2.5.3 LinkRepository::update server-side request forgery
- CVE-2026-35519 | pi-hole FTL up to 6.5 Web Interface dns.hostRecord os command injection
- CVE-2026-35520 | pi-hole FTL up to 6.5 Web Interface dhcp.leaseTime os command injection
- CVE-2026-35521 | pi-hole FTL up to 6.5 Web Interface dhcp.hosts os command injection
- CVE-2026-35523 | strawberry-graphql strawberry up to 0.312.2 Start Message connection_init missing authentication
- CVE-2026-35526 | strawberry-graphql strawberry up to 0.312.2 Subscribe Message allocation of resources
- CVE-2026-35533 | jdx mise up to 2026.4.5 access control
- CVE-2026-35534 | ChurchCRM up to 7.0.x HTML Attribute PersonView.php sanitizeText Facebook HTML injection
- CVE-2026-35566 | ChurchCRM up to 7.0.x FundRaiserStatement.php legacyFilterInputArr iCurrentFundraiser sql injection
- CVE-2026-35567 | ChurchCRM up to 7.0.x PersonView Page src/MemberRoleChange.php src sql injection
- CVE-2026-35568 | modelcontextprotocol java-sdk up to 0.x Model Context Protocol origin validation
- CVE-2026-35571 | NSA Emissary up to 8.38.x Web Interface Link cross site scripting
- CVE-2026-35578 | ChurchCRM up to 6.x DonatedItemEditor.php redirect
- CVE-2026-35580 | NSA Emissary up to 8.38.x workflow_dispatch command injection
- CVE-2026-35581 | NSA Emissary up to 8.38.x Configuration Executrix PLACE_NAME os command injection
- CVE-2026-35583 | NSA Emissary up to 8.38.x API Endpoint /api/configuration/ Name path traversal
- CVE-2026-35584 | freescout-help-desk freescout up to 1.8.211 /thread/read/ conversation_id missing authentication
- CVE-2026-35585 | filebrowser File Browser up to 2.63.1 FILE/USERNAME os command injection (ID 5199)
- CVE-2026-35586 | pyLoad up to 0.5.0b3.dev92 SETTING set_config_value authorization
- CVE-2026-35592 | pyLoad up to 0.5.0b3.dev92 UnTar.py _safe_extractall path traversal
- CVE-2026-35607 | filebrowser File Browser up to 2.63.0 Registered User privileges management (GHSA-7526-j432-6ppp)
- CVE-2026-35611 | sporkmonger addressable up to 2.8.x redos (GHSA-h27x-rffw-24p4)
- CVE-2026-3594 | imprintnext Riaxe Product Customizer Plugin up to 2.4 on WordPress REST API Endpoint orders information disclosure
- CVE-2026-3618 | bestweblayout Columns by BestWebSoft Plugin up to 1.0.3 on WordPress Shortcode shortcode_atts ID cross site scripting
- CVE-2026-3646 | enituretechnology LTL Freight Quotes Plugin up to 3.3.13 on WordPress Hazardous Material authorization
- CVE-2026-3781 | tnomi Attendance Manager Plugin up to 0.6.2 on WordPress attmgr_off sql injection
- CVE-2026-39307 | MervinPraison PraisonAI up to 4.5.112 zipfile.extractall path traversal (GHSA-4ph2-f6pf-79wv)
- CVE-2026-39312 | SoftEtherVPN up to 5.2.5188 memory allocation (GHSA-q5g3-qhc6-pr3h)
- CVE-2026-39316 | OpenPrinting CUPS up to 2.4.16 on Linux scheduler/printers.c cupsdDeleteTemporaryPrinters use after free (GHSA-pjv5-prqp-46rg)
- CVE-2026-39322 | polarnl PolarLearn up to 0-PRERELEASE-15 /api/v1/auth/sign-in improper authentication (GHSA-9vx4-7ww7-4cf5)
- CVE-2026-39351 | Frappe up to 15.103.x/16.13.x API authorization
- CVE-2026-39354 | Erudika scoold up to 1.66.1 /questions/ask postId authorization
- CVE-2026-39355 | MGeurts genealogy up to 5.9.0 authorization
- CVE-2026-39356 | drizzle-team drizzle-orm up to 0.45.1 escapeName sql injection (GHSA-gpj5-g38j-94v9)
- CVE-2026-39360 | RustFS up to alpha.89 Multipart Upload authorization
- CVE-2026-39361 | OpenObserve up to 0.70.3 mod.rs validate_enrichment_url server-side request forgery (GHSA-gcwf-3p7h-wm79)
- CVE-2026-39362 | InvenTree 1.2.6 remote_image server-side request forgery (GHSA-m9j7-jw3m-fr22)
- CVE-2026-39363 | vitejs vite up to 6.4.1/7.3.1/8.0.4 HTTP Request information disclosure (GHSA-p9ff-h696-f583)
- CVE-2026-39364 | vitejs vite up to 7.3.1/8.0.4 Query Parameter incorrect behavior order: validate before canonicalize (GHSA-v2wj-q39q-566r)
- CVE-2026-39365 | vitejs vite up to 6.4.1/7.3.1/8.0.4 path traversal (GHSA-4w7w-66w2-5vf9)
- CVE-2026-39366 | WWBN AVideo up to 26.0 plugin/PayPalYPT/ipn.php PayPalYPT_log data authenticity (GHSA-mmw7-wq3c-wf9p)
- CVE-2026-39367 | WWBN AVideo up to 26.0 EPG Page epg_link cross site scripting (GHSA-rqp3-gf5h-mrqx)
- CVE-2026-39368 | WWBN AVideo up to 26.0 server-side request forgery (GHSA-q4x6-6mm2-crg9)
- CVE-2026-39369 | WWBN AVideo up to 26.0 aVideoEncoderReceiveImage.json.php path traversal (GHSA-f4f9-627c-jh33)
- CVE-2026-39370 | WWBN AVideo up to 26.0 aVideoEncoder.json.php downloadURL server-side request forgery (GHSA-cmcr-q4jf-p6q9)
- CVE-2026-39371 | redwoodjs sdk up to 1.0.5 GET Request serverAction cross-site request forgery (GHSA-x8rx-789c-2pxq)
- CVE-2026-39373 | latchset jwcrypto up to 1.5.6 JWE data amplification (GHSA-fjrm-76x2-c4q4 / EUVD-2026-19911)
- CVE-2026-39374 | makeplane up to 1.2.x IssueBulkUpdateDateEndpoint start_date/target_date authorization (GHSA-4q54-h4x9-m329)
- CVE-2026-39376 | kagisearch fastfeedparser up to 0.5.9 RDF Parser parse recursion (GHSA-4gx2-pc4f-wq37)
- CVE-2026-39380 | opensourcepos Open Source Point of Sale up to 3.4.2 Employees Interface stock_location cross site scripting (GHSA-7hg5-68rx-xpmg)
- CVE-2026-39381 | parse-community parse-server up to 8.6.74 Endpoint /sessions/ authorization (GHSA-g4v2-qx3q-4p64 / EUVD-2026-19917)
- CVE-2026-39382 | dbt-labs dbt-core Comment open-issue-in-repo.yml steps.issue_comment.outputs.comment- os command injection (GHSA-5jxf-vmqr-5g82)
- CVE-2026-39384 | freescout-help-desk freescout up to 1.8.211 limit_user_customer_visibility authorization
- CVE-2026-39395 | sigstore cosign up to 2.6.2/3.0.5 unusual condition (GHSA-w6c6-c85g-mmv6 / EUVD-2026-19919)
- CVE-2026-39397 | delmaredigital payload-puck up to 0.6.22 CRUD Endpoint createPuckPlugin authorization (EUVD-2026-19921)
- CVE-2026-39400 | jhuckaby Cronicle up to 0.9.110 Job Details Page create_events cross site scripting (GHSA-36q6-pwxv-j545 / EUVD-2026-19923)
- CVE-2026-39401 | jhuckaby Cronicle up to 0.9.110 update_event authorization (GHSA-5j3v-cq96-xw6v / EUVD-2026-19925)
- CVE-2026-39517 | A WP Life Blog Filter Plugin up to 1.7.6 on WordPress cross site scripting
- CVE-2026-39521 | Nelio Content Plugin up to 4.3.1 on WordPress server-side request forgery
- CVE-2026-39541 | Themefic Hydra Booking Plugin up to 1.1.38 on WordPress cross site scripting
- CVE-2026-39575 | Ronald Huereca Custom Query Blocks Plugin up to 5.5.0 on WordPress cross site scripting
- CVE-2026-39603 | ThemeGoods Grand Photography Plugin up to 5.7.8 on WordPress cross-site request forgery
- CVE-2026-39604 | zookatron MyBookTable Bookstore Plugin up to 3.6.0 on WordPress cross site scripting
- CVE-2026-39620 | priyanshumittal Appointment Plugin up to 3.5.5 on WordPress cross-site request forgery
- CVE-2026-39625 | kutethemes TechOne Plugin up to 3.0.3 on WordPress cross site scripting
- CVE-2026-39626 | kutethemes Armania Plugin up to 1.4.8 on WordPress Web Page cross site scripting
- CVE-2026-39628 | kutethemes DukaMarket Plugin up to 1.3.0 on WordPress Web Page cross site scripting
- CVE-2026-39629 | kutethemes Uminex Plugin up to 1.0.9 on WordPress cross site scripting
- CVE-2026-39630 | Getty Images Plugin up to 4.1.0 on WordPress server-side request forgery
- CVE-2026-39643 | Payment Plugins for PayPal WooCommerce Plugin up to 2.0.13 on WordPress authorization
- CVE-2026-39645 | Global Payments GlobalPayments WooCommerce Plugin up to 1.18.0 on WordPress server-side request forgery
- CVE-2026-39647 | sonaar MP3 Audio Player for Music, Radio & Podcast Plugin server-side request forgery
- CVE-2026-39670 | Brecht Visual Link Preview Plugin up to 2.3.0 on WordPress server-side request forgery
- CVE-2026-39674 | Manoj Kumar MK Google Directions Plugin up to 3.1.1 on WordPress cross site scripting
- CVE-2026-39687 | Rapid Car Check Vehicle Data Plugin up to 2.0 on WordPress authorization
- CVE-2026-39688 | Glowlogix WP Frontend Profile Plugin up to 1.3.9 on WordPress authorization
- CVE-2026-39689 | eshipper Commerce Plugin up to 2.16.12 on WordPress authorization
- CVE-2026-39690 | Paul Bearne Author Avatars List Block Plugin up to 2.1.25 on WordPress authorization
- CVE-2026-39691 | AdAstraCrypto Cryptocurrency Donation Box Plugin up to 2.2.13 on WordPress authorization
- CVE-2026-39694 | NSquared Simply Schedule Appointments Plugin up to 1.6.10.2 on WordPress authorization
- CVE-2026-39697 | HBSS MAIO Plugin up to 6.2.8 on WordPress authorization
- CVE-2026-39698 | PublisherDesk Publisher Desk ads.txt Plugin up to 1.5.0 on WordPress authorization
- CVE-2026-39699 | massiveshift AI Workflow Automation Plugin up to 1.4.2 on WordPress authorization
- CVE-2026-39700 | WPXPO WowOptin Plugin up to 1.4.32 on WordPress authorization
- CVE-2026-39701 | Andrew ShopWP Plugin up to 5.2.4 on WordPress authorization
- CVE-2026-39704 | nfusionsolutions Precious Metals Automated Product Pricing – Pro Plugin authorization
- CVE-2026-39705 | Mulika MIPL WC Multisite Sync Plugin up to 1.4.4 on WordPress authorization
- CVE-2026-39706 | Netro Systems Make My Trivia Plugin up to 1.1.0 on WordPress authorization
- CVE-2026-39707 | ZealousWeb Accept PayPal Payments using Contact Form 7 Plugin authorization
- CVE-2026-39709 | thetechtribe The Tribal Plugin up to 1.3.4 on WordPress insertion of sensitive information into sent data
- CVE-2026-39711 | stmcan RT-Theme 18 Plugin up to 2.5 on WordPress insertion of sensitive information into sent data
- CVE-2026-39712 | tagDiv Composer Plugin up to 5.4.3 on WordPress cross site scripting
- CVE-2026-39713 | Mailercloud Plugin up to 1.0.7 on WordPress authorization
- CVE-2026-39837 | Wikimedia Cargo Extension up to 3.8.6 on Mediawiki cross site scripting
- CVE-2026-39838 | Wikimedia ProofreadPage Extension up to 1.43.6/1.44.3/1.45.1 on MediaWiki cross site scripting
- CVE-2026-39839 | Wikimedia Cargo Extension up to 3.8.6 on Mediawiki cross site scripting
- CVE-2026-39840 | Wikimedia Cargo Extension up to 3.8.6 on Mediawiki cross site scripting (EUVD-2026-19929)
- CVE-2026-39841 | Wikimedia Cargo Extension up to 3.8.6 on Mediawiki cross site scripting (EUVD-2026-19931)
- CVE-2026-39847 | emmett-framework emmett up to 2.8.0 /Emmett path traversal (GHSA-pr46-2v3c-5356)
- CVE-2026-4025 | lcweb-projects PrivateContent Free Plugin up to 1.2.0 on WordPress Shortcode pc_login_form cross site scripting
- CVE-2026-4065 | nextendweb Smart Slider 3 Plugin up to 3.5.1.33 on WordPress display_admin_ajax authorization
- CVE-2026-4073 | dougblackjr pdfl.io Plugin up to 1.0.5 on WordPress Shortcode output_shortcode text cross site scripting
- CVE-2026-4141 | edckwt Quran Translations Plugin up to 1.7 on WordPress quran_playlist_options cross-site request forgery
- CVE-2026-4299 | mainwp MainWP Child Reports Plugin up to 2.2.6 on WordPress WordPress Heartbeat API heartbeat_received authorization
- CVE-2026-4300 | robosoft Robo Gallery Plugin up to 5.1.3 on WordPress Setting fixJsFunction cross site scripting
- CVE-2026-4303 | osamaesh WP Visitor Statistics Plugin up to 8.4 on WordPress Shortcode wsm_showDayStatsGraph cross site scripting
- CVE-2026-4330 | pr-gateway Blog2Social Plugin up to 8.8.3 on WordPress AJAX b2s_id authorization
- CVE-2026-4341 | bdthemes Prime Slider Plugin up to 4.1.10 on WordPress Mount Widget mount.php render_social_link cross site scripting
- CVE-2026-4401 | wpchill Download Monitor Plugin up to 5.1.10 on WordPress class-dlm-downloads-path.php actions_handler cross-site request forgery
- CVE-2026-4406 | Gravity Forms Plugin up to 2.9.30 on WordPress Content-Type GFCommon::send_json form_ids cross site scripting
- CVE-2026-4483 | Moxa MxGeneralIo up to 1.3.x/1.4.x on Moxa exposed ioctl with insufficient access control
- CVE-2026-4654 | awesomesupport Awesome Support Plugin up to 6.3.7 on WordPress wpas_get_ticket_replies_ajax ticket_id authorization
- CVE-2026-4655 | bdthemes Element Pack Plugin up to 8.4.2 on WordPress SVG Image Widget render_svg cross site scripting
- CVE-2026-4788 | IBM Tivoli Netcool Impact up to 7.1.0.37 log file
- CVE-2026-4808 | tidevapps Gerador de Certificados Plugin up to 1.3.6 on WordPress moveUploadedFile unrestricted upload
- CVE-2026-4871 | pstruik Sports Club Management Plugin up to 1.12.9 on WordPress Shortcode scm_member_data cross site scripting
- CVE-2026-5167 | Masteriyo LMS Plugin up to 2.1.7 on WordPress Webhook Endpoint handle_webhook order_id authorization
- CVE-2026-5169 | udamadu Inquiry form to posts or pages Plugin up to 1.0 on WordPress Setting inq_form.php update_option cross site scripting
- CVE-2026-5208 | CoolerControl coolercontrold up to 3.x Alerts os command injection
- CVE-2026-5300 | CoolerControl coolercontrold up to 3.x HTTP Request missing authentication
- CVE-2026-5301 | CoolerControl coolercontrol-ui up to 3.x Log Viewer cross site scripting
- CVE-2026-5302 | CoolerControl coolercontrold up to 3.x cross-domain policy
- CVE-2026-5379 | runZero Platform up to 2.x/3.0 Organization authorization
- CVE-2026-5380 | runZero Platform up to 3.0/5.2 authorization
- CVE-2026-5381 | runZero Platform up to 2.1/3.0 Organization authorization
- CVE-2026-5382 | runZero Platform up to 3.0/3.1/4.0.260206.0 MCP Endpoint authorization
- CVE-2026-5506 | lucascaro Wavr Plugin up to 0.2.6 on WordPress Shortcode wave cross site scripting
- CVE-2026-5508 | theyeti WowPress Plugin up to 1.0.0 on WordPress Shortcode wowpress cross site scripting
- CVE-2026-5600 | pretix up to 2026.1.1/2026.2.0/2026.3.0 API Endpoint improper isolation or compartmentalization
- CVE-2026-5745 | libarchive ACL Parser archive_acl_from_text_nl null pointer dereference
- CVE-2026-5762 | Wikimedia Reportcident Extension 1.43.7/1.44.4/1.45.2 on MediaWiki allocation of resources
- CVE-2026-5802 | idachev mcp-javadc up to 1.2.4 HTTP Interface jarFilePath os command injection
- CVE-2026-5803 | bigsk1 openai-realtime-ui up to 188ccde27fdf3d8fab8da81f3893468f53b2797c API Proxy Endpoint server.js Query server-side request forgery
- CVE-2026-5805 | code-projects Easy Blog Site up to 1.0 /users/contact_us.php Name sql injection
- CVE-2026-5806 | code-projects Easy Blog Site 1.0 /posts/update.php postTitle cross site scripting
WIRED
- 8 Best Cheap Laptops (2026): Chromebooks, the MacBook Neo, and More
- Anthropic Teams Up With Its Rivals to Keep AI From Hacking Everything
- Iran-Linked Hackers Are Sabotaging US Energy and Water Infrastructure
先知安全技术社区
- 2026阿里白帽大会 - Agent安全(智能体时代的攻防新范式)
嘶吼 RoarTalk – 网络安全行业综合服务平台,4hou.com
- 绿盟NF防火墙：筑牢OpenClaw安全防线，构筑AI时代安全基石
- 绿盟科技大模型安全白皮书发布：聚焦智能体风险与防护，护您安全“养虾”
爱范儿
- 突发！史上最强 Claude 发布：聪明到不敢开放，还会突破权限掩盖操作痕迹
绿盟科技技术博客
- 倒计时1天 | 美国2026 RSAC热点研讨暨第十八届信息安全高级论坛即将启幕