安全资讯归档（2026-04-09）

• 2Libra
  • 300 元左右，求推荐骨传导耳机
  • Anthropic 模型进化太猛了，天天这么搞，即强又快，能不焦虑吗
  • B 站视频播放页暂停广告 4 月 10 日上线
  • cc switch 会导致封 cc 吗？
  • DeepSeek 更新了快速模式与专家模式
  • DGX Spark llama.cpp 部署 Gemma4 31B
  • YouTube 被指在电视端出现 90 秒不可跳过广告,时长超现行规则上限
  • 【竞猜】【💰】来猜猜我跟 utags 谁先获得卡皮巴拉徽章
  • 【💰】有没有这样一个徽章呵护呵护非酋
  • 一个思考：智能体的核心，不是怎么写 prompt 、Agent ，而是——如何准确控制一个会说话的概率引擎。
  • 以前会急写不出好代码，现在急写给 ai 的 prompt 缺少关键信息
  • 全职猎人要恢复连载了？
  • 和 ai 聊天
  • 国漫排行榜~
  • 夏天出门电风扇有无推荐
  • 如何让 2libra 更像 V2EX❓❓❓
  • 屁股决定脑袋——有 AI 后想让它 007 为我打工，所以其实在领导眼里打工人也不算人？
  • 最近《红色沙漠》是不是火起来了？有人玩了吗，如何？
  • 来秀徽章, 今天是一只水豚
  • 现在还有玩 dota2 的人吗
  • 社区不活跃了
  • 请大家看一集海绵宝宝
  • 请问有无好用的 ipad 的能用阅读器支持漫画小说
  • 黑袍第五季开播，我已经看到一些名场面了
• 36氪
  • Arm首席执行官哈斯有望领导软银的大部分国际业务
  • A股三大指数午间休盘集体下跌，光模块逆势走强
  • A股三大指数集体收跌
  • CoreWeave与Meta宣布210亿美元扩展人工智能基础设施协议
  • Coreweave宣布发行30亿美元可转换优先票据
  • INAIR完成千万美元融资，便携空间主机适配多款 AR 眼镜｜最前线
  • MiniMax发布命令行工具MMX-CLI
  • OBSBOT寻影新品发布，在口袋直播摄像头中实现AI智能跟踪与4K画质｜最前线
  • OpenAI因能源成本问题暂停英国“星际之门”项目
  • OpenAI预计今年将实现25亿美元的广告收入
  • Polygon Labs正为支付业务融资至多1亿美元
  • ST人福：控股子公司药品RFUS-1646片获药物临床试验批准通知书
  • ST智知：申请撤销公司股票其他风险警示
  • Terra Quantum拟通过SPAC在纳斯达克上市，估值达32.5亿美元
  • ​乘联分会：3月新能源乘用车出口34.9万辆，同比增长139.9%
  • “众擎机器人”完成2亿美元B轮融资
  • “开普勒机器人”完成亿元级A++轮融资
  • “阿迈特医疗”获超2亿元D轮融资
  • 一个225平方公里的“庄”，如何成为AI“顶流”
  • 一汽-大众发布纯电序列ID.AURA首款车型T6
  • 三星电子、SK海力士据悉转向三至五年长期供应协议模式
  • 三部门指导平台企业落实《互联网平台价格行为规则》
  • 上期所：对部分客户采取限制开仓监管措施
  • 上海：出台“首发上海”政策4.0版
  • 上海：持续开展汽车以旧换新活动，全面释放汽车消费潜力
  • 上海：深入推进直播经济集聚区建设，加快直播产业集聚
  • 世界黄金协会：全球黄金ETF在3月流出120亿美元，亚洲市场逆势买入
  • 业绩预告“大变脸”，股价跌停，中化岩土回应
  • 两部门：用3年左右时间集中力量支持30个左右城市（群）实施新一轮国家综合货运枢纽补链强链提升行动
  • 中信证券业绩快报：一季度净利润102.16亿元，同比增长54.6%
  • 中国人民银行副行长宣昌能出席东盟与中日韩财政和央行副手会
  • 中国自贸试验区扩围至23个
  • 中微半导：今年MUC行业景气度向好 目前主要矛盾是供应紧张
  • 中汽协：1-2月中国出口到“一带一路”沿线国家的汽车商品累计金额达263.3亿美元
  • 中钨高新：一季度净利润同比预增256%—276%
  • 乘联分会：3月全国乘用车市场零售164.8万辆，同比下降15.0%
  • 乘联分会：3月新能源乘用车市场零售84.8万辆，同比下降14.4%
  • 九岭锂业沪主板IPO终止，原计划募资31.35亿元
  • 五粮液在四川成立数智营销公司
  • 五部门：做好2026年享受税收优惠政策的集成电路企业或项目、软件企业清单制定工作
  • 亚马逊为礼来GLP-1口服药Foundayo提供当日达服务
  • 亚马逊芯片业务年化营收现已超过200亿美元
  • 全志科技：第一季度净利同比预增112.99%—140.3%
  • 具身智能企业“零次方机器人”完成超亿元融资，由清华00后团队创办
  • 利通电子澄清“谷歌推动液冷链价值增长”：公司液冷产品的研发尚处于前期探讨阶段
  • 半日主力资金加仓电子板块，抛售传媒板块
  • 华远控股：实控人北京市西城区国资委正在筹划对下属部分企业集团进行重组
  • 南向资金净买入额达100亿港元
  • 南向资金净买入额达70亿港元
  • 南大光电：2025年净利润同比增长18%，拟10派2.8元
  • 吉利远程汽车换帅完成工商变更
  • 后视摄像头存在故障，通用在美召回超27万辆汽车
  • 哈啰出行在太原成立网络科技新公司
  • 唐人神：3月生猪销售收入合计5.87亿元，同比下降14.46%
  • 商务部回应稀土出口管制：中美将通过经贸磋商机制保持沟通
  • 商汤绝影发布家庭AI终端“可悠”，支持全场景多设备协同
  • 国务院印发《中国（内蒙古）自由贸易试验区总体方案》
  • 天合光能旗下公司等在上海成立新能源科技公司
  • 天齐锂业：公司未来3—5年将围绕固态电池等下一代技术路线匹配相应的上游关键材料
  • 宏碁3月销售额299亿元新台币
  • 宝马氢能扁平化储存系统2028年量产
  • 对话前阿里高管、天猫设计家CEO：这些年烧掉千亿，家装行业还能怎么做？
  • 对话美团GN06刘炯：美团为什么做了一款AI浏览器？
  • 小马智行全球化布局再迎新进展，克罗地亚开启欧洲首个商业化Robotaxi服务
  • 工业和信息化部等四部门召开动力及储能电池行业企业座谈会
  • 工信部等五部门：开展中小企业人才服务专项行动
  • 市场消息： 获高盛投资的 “GO” 打车应用计划今年在日本上市
  • 市场消息：三星将在越南投资40亿美元建设芯片封装基地
  • 康恩贝：替米沙坦氨氯地平片（Ⅱ）获药品注册证书
  • 微信支付发布“AI接入工具箱”
  • 德业股份：一季度净利同比预增55.91%—70.08%
  • 恒指午间休盘跌0.35%，恒生科技指数跌1.26%
  • 恒指收跌0.54%，恒生科技指数跌2.06%
  • 报告：预估2026年中国人形机器人市场产量将年增94%
  • 报道称OpenAI因安全风险采取了分阶段推出新模型的策略
  • 招金黄金：2025年净利润1.59亿元，同比扭亏
  • 新希望：3月商品猪销售收入15.47亿元，同比降19.86%
  • 新石器无人车旗下公司在广东成立新公司，含外卖递送服务业务
  • 日本考虑再释放合20天需求量的石油储备
  • 机器人租赁平台擎天租成智元新款人形机器人A3���首发应用场”
  • 机构今日买入东山精密等20股，卖出神剑股份2.14亿元
  • 杭氧股份、昆仑信托在上海成立气体公司
  • 杭钢股份：诚通金控拟减持不超2%公司股份
  • 欣旺达装车特斯拉，供应全球车型｜36氪独家
  • 武汉光谷金融控股集团增资至约215.9亿元
  • 比亚迪成功注册一枚“比亚迪闪充”商标
  • 氪星晚报｜李佳琦回应“缺席”直播：没有退休；市场消息： 获高盛投资的 “GO” 打车应用计划今年在日本上市
  • 汇源通信：没有石英光纤预制棒及石英光纤制造产能
  • 沪深两市成交额突破1万亿元
  • 海南：出台入境旅游支持措施，推动优化免签政策
  • 海尔消费金融公司增资至约31.2亿元
  • 消息称特斯拉Cybercab量产启动
  • 淘宝闪购上线行业首个支持语音搜索能力的商家端AI Agent
  • 港股AI应用股持续走高 讯策大涨超15%
  • 湖南发展：2026年第一季度净利同比预增165%—223.89%
  • 热门中概股美股盘前多数下跌，小鹏集团跌超3%
  • 焱融存储与沐曦股份完成产品兼容性认证
  • 特斯拉正在研发一款体型更小、价格更低的全新电动汽车
  • 环旭电子：3月合并营业收入46.88亿元，同比下降6.08%
  • 瑞芯微：2026年第一季度净利同比预增52.76%—62.31%
  • 由于业绩不佳，柒和伊控股推迟美国便利店业务上市计划
  • 穆巴达拉：2025年资产管理规模同比增长17%
  • 美国2月核心PCE物价指数环比增长0.4%
  • 美国上周首次申领失业救济人数为21.9万人
  • 美股大型科技股盘前多数下跌，英特尔跌超2%
  • 美银：预计到2030年，半导体市场规模达2万亿美元
  • 耀速科技获2亿人民币融资，将“AI+器官芯片”嵌入新药开发流程
  • 脉脉发布80家“隐形大厂”名单
  • 腾讯发布QClaw V2大版本
  • 英伟达收购告吹后，Nebius正洽谈收购以色列人工智能初创公司AI21
  • 茅台代销政策落地：部分专卖店生肖等稀缺品“秒空” 小酒“不用抢”
  • 起亚将2030年电动汽车销售目标下调约20%
  • 起亚计划到2030年在设施和研发方面投入330亿美元
  • 阿克曼拟推出新基金，反向押注市场主流观点来获利
  • 隆基绿能与华为数字能源达成战略合作
  • 雅化集团：与津巴布韦政府进行了沟通，力争早日恢复锂精矿出口
  • 马斯克称FSD V15版本安全性将远超人类水平
  • 高盛：将布油和美油第二季度价格预测分别下调至90美元和87美元
  • 黑莓公司2026财年第四季度营收为1.56亿美元，同比增长10%
  • 黑莓预计2027年营收5.84亿美元至6.11亿美元
• 404 Media
  • FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database
• Arturo Di Corinto
  • Fnsi, il 16 aprile sciopero per il contratto. E domani in piazza a Roma per l’equo compenso
• berthub.eu
  • Rapport digitale autonomie binnen de energie-intensieve industrie voor Energy Innovation Nl
• CERT Recently Published Vulnerability Notes
  • VU#536588: Multiple Heap Buffer Overflows in Orthanc DICOM Server
• darkreading
  • AI-Led Remediation Crisis Prompts HackerOne to Pause Bug Bounties
• Data Breach
  • The alleged breach of China’s National Supercomputing Center can have serious geopolitical consequences
• defend.network
  • Daily Threat Briefing – April 9, 2026
• dfarq.homeip.net
  • Osborne Computer liquidated April 9, 1986
• Hacker News Frontpage
  • Claude mixes up who said what and that's not OK
  • Clean code in the age of coding agents
  • Creating the Futurescape for the Fifth Element [2019]
  • Launch HN: Relvy (YC F24) – On-call runbooks, automated
  • Open Source Security at Astral
  • Show HN: 41 years sea surface temperature anomalies
• HackerNews
  • Apache ActiveMQ Classic 潜伏 13 年的 RCE 漏洞曝光
  • Masjesu 僵尸网络隐蔽攻击物联网设备，专注持久化而非大规模感染
  • OpenSSL 修复数据泄露等七处漏洞
  • 洛杉矶市律师系统遭入侵，敏感警局文件泄露
• Horizon3.ai
  • CVE-2026-20160
• ICT Security Magazine
  • APT28 e la campagna FrostArmada: come il GRU russo ruba credenziali Microsoft senza installare malware
  • Ransomware senza cifratura: come il data extortion sta sostituendo l’attacco classico
  • Supply Chain Attack nordcoreano, Contagious Interview prende di mira gli sviluppatori: 1.700 pacchetti malevoli in cinque ecosistemi open source
• InfoSec Write-ups - Medium
  • CI/CD Takeover & Supply Chain Risk! $$$$ Bounty
  • Dig Dug TryHackMe Walkthrough
  • JADX + MCP: I let the AI read the APK so I don’t have to
  • Love Letter Locker — TryHackMe Writeup
  • My eCPPTv3 Exam Review
  • OWASP API Security Top 10 (Part 1) — TryHackMe Walkthrough ️
  • “Bug Bounty Bootcamp #30: Time-Based Blind SQL Injection — When Silence Speaks Through Delays”
• infosecurity-magazine.com
  • Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings
• LangChain Blog
  • Human judgment in the agent improvement loop
• matduggan.com
  • You can absolutely have an RSS dependent website in 2026
• miguelgrinberg.com
  • SQLAlchemy 2 In Practice - Chapter 4 - Many-To-Many Relationships
• MIT Technology Review
  • The Download: AstroTurf wars and exponential AI growth
• NetSPI
  • Anthropic’s Mythos Announcement: What it Means for Security Teams
• NVIDIA AI Blog
  • Strength and Destiny Collide: ‘Samson: A Tyndalston Story’ Arrives in the Cloud
• Pen Test Partners
  • You can pen test OT networks without breaking them
• pluralistic.net
  • Pluralistic: Cindy Cohn's "Privacy's Defender" (09 Apr 2026)
• Product Hunt
  • Lunagraph (Alpha)
  • Orca
  • Startups.RIP
• Recent Commits to cve:main
  • Update Thu Apr 9 11:20:06 UTC 2026
• SANS Internet Storm Center, InfoCON: green
  • ISC Stormcast For Thursday, April 9th, 2026 https://isc.sans.edu/podcastdetail/9886, (Thu, Apr 9th)
  • TeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory, (Wed, Apr 8th)
• Schneier on Security
  • On Microsoft’s Lousy Cloud Security
• Securelist
  • The long road to your crypto: ClipBanker and its marathon infection chain
• Security Affairs
  • Internet-Exposed ICS Devices Raise Alarm for Critical Sectors
  • Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics
  • U.S. CISA adds a flaw in Ivanti EPMM to its Known Exploited Vulnerabilities catalog
• SentinelOne
  • Edge Decay: How a Failing Perimeter Is Fueling Modern Intrusions
• shkspr.mobi
  • Book Review: Small Comfort by Ia Genberg ★★☆☆☆
• Sploitus.com Exploits RSS Feed
  • AutoRunScan- exploit
  • centuri-translation-demo exploit
  • Exploit for Code Injection in Mariadb exploit
  • Exploit for Code Injection in Pivotal_Software Spring_Data_Commons exploit
  • Exploit for CVE-2020-12446 exploit
  • Exploit for CVE-2026-23398 exploit
  • Exploit for CVE-2026-34197 exploit
  • Exploit for CVE-2026-40271 exploit
  • Exploit for CVE-2026-4747 exploit
  • Exploit for Improper Input Validation in N8N exploit
  • Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server exploit
  • Exploit for OS Command Injection in Gnu Bash exploit
  • Exploit for Type Confusion in Mozilla Firefox exploit
  • Exploit for Type Confusion in Mozilla Firefox exploit
  • sqlmap-gui exploit
• steveblank.com
  • Nowhere Is Safe
• TechCrunch
  • Amazon CEO takes aim at Nvidia, Intel, Starlink, more in annual shareholder letter
  • British cryptographer Adam Back denies NYT report that he is Bitcoin creator Satoshi Nakamoto
  • Collide Capital raises $95M fund to back fintech, future-of-work startups
  • Ex-Tesla engineer’s startup taps Pronto to help automate a copper mine
  • Final 2 days to save up to $500 on your TechCrunch Disrupt 2026 ticket
  • Instagram expands its movie inspired content restrictions for teens internationally
  • Radify’s sci-fi plasma reactors could break China’s dominance of rare earth elements
  • Spotify now lets everyone turn off videos in its app
  • These are the countries moving to ban social media for children
  • This founder helped build SpaceX’s most powerful rocket engine. Now he’s building a ‘fighter jet for orbit’
  • Waymo robotaxis are tracking potholes and sharing that data with Waze users
• The Decoder
  • Anthropic launches managed infrastructure for autonomous AI agents
  • New Stanford study reveals when teaming up AI agents is worth the compute
  • OpenAI reportedly following Anthropic's lead in restricting access to powerful cybersecurity AI
• The Verge
  • A jury is about to decide the fate of Ticketmaster
  • Amazon’s Starlink competitor Leo gets a new date
  • Amflow’s latest e-bikes raise the bar again
  • Google makes it easy to deepfake yourself
  • Spotify now lets you turn off all its videos
  • The AI industry’s race for profits is now existential
  • The Exit 8 movie is even better if you play the game first
  • Waymo is offering to help cities fix their potholes
• Trail of Bits Blog
  • Master C and C++ with our new Testing Handbook chapter
• VMRay
  • The CISO’s Guide to Preventing Phishing Attacks
• VulDB Recent Entries
  • CVE-2023-46945 | QD 20230821 server-side request forgery
  • CVE-2025-14243 | Red Hat OpenShift Mirror Registry information exposure
  • CVE-2025-45806 | rrweb-snapshot up to 2.0.0-alpha.17 cross site scripting (ID 1817)
  • CVE-2025-57175 | Siklu EtherHaul 8010 10_6_2-18707-ea552dc00b hard-coded password
  • CVE-2026-1092 | GitLab Community Edition/Enterprise Edition up to 18.8.8/18.9.4/18.10.2 improper validation of specified quantity in input
  • CVE-2026-1101 | GitLab Enterprise Edition up to 18.8.8/18.9.4/18.10.2 improper validation of specified quantity in input
  • CVE-2026-1516 | GitLab Enterprise Edition up to 18.8.8/18.9.4/18.10.2 code injection
  • CVE-2026-1752 | GitLab Enterprise Edition up to 18.8.8/18.9.4/18.10.2 authorization
  • CVE-2026-1830 | davidfcarr Quick Playground Plugin up to 1.3.1 on WordPress REST API Endpoint authorization (EUVD-2026-20843)
  • CVE-2026-20709 | Intel Pentium Processor Silver default key (intel-sa-00609)
  • CVE-2026-2104 | GitLab Community Edition/Enterprise Edition up to 18.8.8/18.9.4/18.10.2 authorization
  • CVE-2026-2377 | Red Hat OpenShift mirror registry server-side request forgery
  • CVE-2026-2519 | ladela Bookly Plugin up to 27.0 on WordPress Negative Number tips external control of assumed-immutable web parameter
  • CVE-2026-2619 | GitLab Enterprise Edition up to 18.8.8/18.9.4/18.10.2 Private Project authorization
  • CVE-2026-3005 | fernandobt List Category Posts Plugin up to 0.94.0 on WordPress Shortcode catlist cross site scripting
  • CVE-2026-30075 | OpenAirInterface oai-cn5g-amf 2.2.0 AUSF denial of service
  • CVE-2026-30080 | OpenAirInterface oai-cn5g-amf 2.2.0 Security Mode downgrade
  • CVE-2026-31017 | Frappe ERPNext/Framework 16.0.1/16.1.1 HTTP Request server-side request forgery
  • CVE-2026-3199 | Sonatype Nexus Repository up to 3.90.x deserialization
  • CVE-2026-33460 | Elastic Kibana up to 8.19.13/9.2.7/9.3.2 Internal Enrollment Endpoint authorization
  • CVE-2026-33461 | Elastic Kibana up to 8.19.13/9.2.7/9.3.2 Internal API Endpoint authorization
  • CVE-2026-34177 | Canonical LXD up to 5.0.6/5.21.4/6.7.x permissions.go isVMLowLevelOptionForbidden incomplete blacklist
  • CVE-2026-34178 | Canonical LXD up to 5.0.6/5.21.4/6.7.x Backup Import backup/index.yaml input validation
  • CVE-2026-34179 | Canonical LXD up to 5.0.6/5.21.4/6.7.x TLS Certificate lxd/certificates.go doCertificateUpdate Type dynamically-determined object attributes
  • CVE-2026-3438 | Sonatype Nexus Repository up to 3.90.x cross site scripting
  • CVE-2026-34538 | Apache Airflow up to 3.1.8 DagRun Wait Endpoint exposure of resource
  • CVE-2026-34757 | libpng up to 1.6.56 Chunk Setter API png_set_hIST use after free
  • CVE-2026-34782 | Zammad up to 7.0.0 REST Endpoint :id authorization
  • CVE-2026-34837 | Zammad up to 7.0.0 REST Endpoint :id authorization
  • CVE-2026-34985 | aces Loris up to 27.0.2/28.0.0 Media authorization
  • CVE-2026-35165 | aces Loris up to 27.0.2/28.0.0 Backend Endpoint authorization
  • CVE-2026-35169 | aces Loris up to 27.0.2/28.0.0 help_editor cross site scripting
  • CVE-2026-35400 | aces Loris up to 27.0.2/28.0.0 Publication link following
  • CVE-2026-35403 | aces Loris up to 27.0.2/28.0.0 Header survey_accounts Content-Type cross site scripting
  • CVE-2026-35446 | aces Loris up to 27.0.2/28.0.0 file access
  • CVE-2026-35455 | immich-app immich up to 2.6.x cross site scripting
  • CVE-2026-35479 | InvenTree up to 1.2.6 improper authorization (GHSA-7c3q-vwcv-2vp7)
  • CVE-2026-3568 | inspireui MStore API Plugin up to 4.18.3 on WordPress flutter-user.php update_user_profile meta_data authorization
  • CVE-2026-3574 | uxdexperts Experto Dashboard for WooCommerce Plugin up to 1.0.4 on WordPress register_setting cross site scripting
  • CVE-2026-39304 | Apache ActiveMQ Client/ActiveMQ Broker/ActiveMQ up to 5.19.3/6.2.3 TLS 1.3 KeyUpdate denial of service
  • CVE-2026-39411 | LobeHub up to 2.1.47 /webapi/chat/ improper authentication (GHSA-5mwj-v5jw-5c97)
  • CVE-2026-39412 | harttle liquidjs up to 10.25.3 sort_natural information disclosure (GHSA-rv5g-f82m-qrvv)
  • CVE-2026-39416 | ail-project ail-framework up to 6.7 cross site scripting (GHSA-fj6v-43r7-gcjm)
  • CVE-2026-39860 | NixOS nix up to 2.34.4 on Linux symlink (GHSA-g3g9-5vj6-r3gj)
  • CVE-2026-39862 | Shopify tophat up to 2.5.0 URL Parser /bin/bash os command injection (GHSA-8x8g-6rv5-mgg2)
  • CVE-2026-39882 | open-telemetry opentelemetry-go up to 1.42.x Configured Collector Endpoint traces/metrics/logs memory allocation (GHSA-w8rr-5gcm-pp58)
  • CVE-2026-39883 | open-telemetry opentelemetry-go up to 1.42.x untrusted search path (GHSA-hfvc-g4fc-pqhx)
  • CVE-2026-39885 | agentfront frontmcp/adapters/sdk/mcp-from-openapi Model Context Protocol initialize ref server-side request forgery (GHSA-v6ph-xcq9-qxxj)
  • CVE-2026-39888 | MervinPraison praisonaiagents up to 1.5.114 praisonaiagents.tools.python_tools execute_code violation of secure design principles (GHSA-qf73-2hrx-xprp)
  • CVE-2026-39889 | MervinPraison PraisonAI up to 4.5.114 Endpoint /a2u/ create_a2u_routes information disclosure (GHSA-f292-66h9-fpmf)
  • CVE-2026-39890 | MervinPraison PraisonAI up to 4.5.114 API Endpoint deserialization (GHSA-32vr-5gcf-3pw2)
  • CVE-2026-39891 | MervinPraison PraisonAI up to 4.5.114 File Content create_agent_centric_tools code injection (GHSA-hwg5-x759-7wjg)
  • CVE-2026-39892 | pyca cryptography up to 46.0.6 memory corruption (GHSA-p423-j2cm-9vmq)
  • CVE-2026-39901 | monetr up to 1.12.2 Transaction Update Endpoint improper authorization (GHSA-hqxq-hwqf-wg83)
  • CVE-2026-40024 | sleuthkit The Sleuth Kit up to 4.14.0 tsk_recover path traversal
  • CVE-2026-40025 | sleuthkit The Sleuth Kit up to 4.14.0 APFS File Parser wrapped_key_parser out-of-bounds
  • CVE-2026-40026 | sleuthkit The Sleuth Kit up to 4.14.0 Image Parser parse_susp len_id/len_des/len_src out-of-bounds
  • CVE-2026-40027 | abrignoni ALEAPP up to 3.4.0 NQ_Vault.py file_name_from path traversal
  • CVE-2026-40028 | Yamato-Security hayabusa up to 3.7.0/3.7.x Computer cross site scripting
  • CVE-2026-40029 | khyrenz parseusbs up to 1.8 LNK File Parser parseUSBs.py os.popen os command injection
  • CVE-2026-40030 | khyrenz parseusbs up to 1.8 Volume popen path os command injection
  • CVE-2026-40031 | ufrisk MemProcFS up to 5.16/5.16.12 Dlopen Call LD_LIBRARY_PATH uncontrolled search path
  • CVE-2026-40032 | tclahr UAC up to 3.2.0 Placeholder _run_command os command injection (ID 429)
  • CVE-2026-40035 | obsidianforensics unfurl up to 2025.08 Configuration app.run debug code (GHSA-vg9h-jx4v-cwx2)
  • CVE-2026-40036 | obsidianforensics unfurl up to 2026.3 Decompression parse_compressed.py parse_compressed allocation of resources (GHSA-h5qv-qjv4-pc5m)
  • CVE-2026-40037 | OpenClaw up to 2026.3.30/2026.4.7 Request Body redirect (GHSA-qx8j-g322-qj6m)
  • CVE-2026-40046 | Apache ActiveMQ/ActiveMQ MQTT up to 6.2.3 MQTT Control Packet length privilege escalation
  • CVE-2026-4124 | oliverfriedmann Ziggeo Plugin up to 3.1.1 on WordPress Setting current_user_can authorization
  • CVE-2026-4326 | webilia Vertex Addons for Elementor Plugin up to 1.6.4 on WordPress activate_required_plugins authorization
  • CVE-2026-4332 | GitLab Enterprise Edition up to 18.8.8/18.9.4/18.10.2 Analytics Dashboard cross site scripting
  • CVE-2026-4336 | rustaurius Ultimate FAQ Accordion Plugin up to 2.4.7 on WordPress View.FAQ.class.php cross site scripting (EUVD-2026-20845)
  • CVE-2026-4429 | photoweblog OSM Plugin up to 6.1.15 on WordPress Shortcode file_color_list cross site scripting
  • CVE-2026-4498 | Elastic Kibana up to 8.19.13 unnecessary privileges
  • CVE-2026-4660 | HashiCorp Tooling up to 1.8.5 information disclosure
  • CVE-2026-4837 | Rapid7 Insight Agent up to 3.3.0 on Linux Beacon eval eval injection
  • CVE-2026-5173 | GitLab Community Edition/Enterprise Edition up to 18.8.8/18.9.4/18.10.2 Websocket Connection routine
  • CVE-2026-5357 | codename065 Download Manager Plugin up to 3.3.52 on WordPress Shortcode members.php sid cross site scripting
  • CVE-2026-5436 | inc2734 MW WP Form Plugin up to 5.1.1 on WordPress generate_user_file_dirpath Name path traversal
  • CVE-2026-5451 | hupe13 Extensions for Leaflet Map Plugin up to 4.14 on WordPress Shortcode elevation-track cross site scripting
  • CVE-2026-5711 | pubudu-malalasekara Post Blocks & Tools Plugin up to 1.3.0 on WordPress cross site scripting
  • CVE-2026-5742 | stiofansisland UsersWP Plugin up to 1.2.60 on WordPress cross site scripting (EUVD-2026-20846)
  • CVE-2026-5823 | itsourcecode Construction Management System 1.0 borrowed_tool_report.php Home sql injection
  • CVE-2026-5824 | code-projects Simple Laundry System 1.0 /userchecklogin.php userid sql injection
  • CVE-2026-5825 | code-projects Simple Laundry System 1.0 /delmemberinfo.php userid cross site scripting
  • CVE-2026-5826 | code-projects Simple IT Discussion Forum 1.0 /edit-category.php Category cross site scripting
  • CVE-2026-5827 | code-projects Simple IT Discussion Forum 1.0 /question-function.php content sql injection
  • CVE-2026-5828 | code-projects Simple IT Discussion Forum 1.0 addcomment.php postid sql injection
  • CVE-2026-5829 | code-projects Simple IT Discussion Forum 1.0 /pages/content.php post_id sql injection
  • CVE-2026-5831 | Agions taskflow-ai up to 2.1.8 terminal_execute handlers.ts os command injection
  • CVE-2026-5832 | atototo api-lab-mcp up to 0.2.1 HTTP Interface src/mcp/http-server.ts source/url server-side request forgery
  • CVE-2026-5833 | awwaiid mcp-server-taskwarrior up to 1.0.1 index.ts server.setRequestHandler Identifier command injection
  • CVE-2026-5834 | code-projects Online Shoe Store 1.0 /admin/admin_running.php product_name cross site scripting
  • CVE-2026-5835 | code-projects Online Shoe Store 1.0 admin_football.php product_name cross site scripting
  • CVE-2026-5836 | code-projects Online Shoe Store 1.0 /admin/admin_product.php product_name cross site scripting
  • CVE-2026-5837 | PHPGurukul News Portal Project 4.1 /news-details.php Comment sql injection
  • CVE-2026-5838 | PHPGurukul News Portal Project 4.1 /admin/add-subadmins.php sadminusername sql injection
  • CVE-2026-5839 | PHPGurukul News Portal Project 4.1 add-subcategory.php sucatdescription sql injection
  • CVE-2026-5840 | PHPGurukul News Portal Project 4.1 check_availability.php Username sql injection
  • CVE-2026-5841 | Tenda i3 1.0.0.6(2204) HTTP R7WebsSecurityHandler path traversal
  • CVE-2026-5842 | decolua 9router up to 0.3.47 Administrative API Endpoint /api authorization (Issue 431)
  • CVE-2026-5847 | code-projects Movie Ticketing System 1.0 SQL Database Backup File /db/moviedb.sql information disclosure
  • CVE-2026-5848 | jeecgboot JimuReport up to 2.3.0 Data Source testConnection DriverManager.getConnection dbUrl code injection (Issue 4587)
  • CVE-2026-5849 | Tenda i12 1.0.0.11(3862) HTTP path traversal
  • CVE-2026-5850 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setVpnPassCfg pptpPassThru os command injection
  • CVE-2026-5851 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setUPnPCfg enable os command injection
  • CVE-2026-5852 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setIptvCfg igmpVer os command injection
  • CVE-2026-5853 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setIpv6LanCfg addrPrefixLen os command injection
  • CVE-2026-5854 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setWiFiEasyCfg merge os command injection
  • CVE-2026-5858 | Google Chrome up to 146.0.7680.178 WebML heap-based overflow (ID 493319)
  • CVE-2026-5859 | Google Chrome up to 146.0.7680.178 WebML external control of assumed-immutable web parameter (ID 494158)
  • CVE-2026-5860 | Google Chrome up to 146.0.7680.178 WebRTC use after free (ID 486495)
  • CVE-2026-5861 | Google Chrome up to 146.0.7680.178 V8 use after free (ID 486927)
  • CVE-2026-5862 | Google Chrome up to 146.0.7680.178 V8 sandbox (ID 470566)
  • CVE-2026-5863 | Google Chrome up to 146.0.7680.178 V8 sandbox (ID 484527)
  • CVE-2026-5864 | Google Chrome up to 146.0.7680.178 WebAudio heap-based overflow (ID 490642)
  • CVE-2026-5865 | Google Chrome up to 146.0.7680.178 V8 type confusion (ID 491884)
  • CVE-2026-5866 | Google Chrome up to 146.0.7680.178 Media use after free (ID 492218)
  • CVE-2026-5867 | Google Chrome up to 146.0.7680.178 WebML heap-based overflow (ID 492668)
  • CVE-2026-5868 | Google Chrome up to 146.0.7680.178 on macOS ANGLE heap-based overflow (ID 493256)
  • CVE-2026-5869 | Google Chrome up to 146.0.7680.178 WebML heap-based overflow (ID 493708)
  • CVE-2026-5870 | Google Chrome up to 146.0.7680.178 Skia external control of assumed-immutable web parameter (ID 495534)
  • CVE-2026-5871 | Google Chrome up to 146.0.7680.178 V8 type confusion (ID 495679)
  • CVE-2026-5872 | Google Chrome up to 146.0.7680.178 Blink use after free (ID 496281)
  • CVE-2026-5873 | Google Chrome up to 146.0.7680.178 V8 out-of-bounds write (ID 496301)
  • CVE-2026-5874 | Google Chrome up to 146.0.7680.178 PrivateAI use after free (ID 485397)
  • CVE-2026-5875 | Google Chrome up to 146.0.7680.178 Blink ui layer (ID 430198)
  • CVE-2026-5876 | Google Chrome up to 146.0.7680.178 Navigation improper protection of physical side channels (ID 414852)
  • CVE-2026-5877 | Google Chrome up to 146.0.7680.178 Navigation use after free (ID 333024)
  • CVE-2026-5878 | Google Chrome up to 146.0.7680.178 Blink ui layer (ID 365089)
  • CVE-2026-5879 | Google Chrome up to 146.0.7680.178 on macOS ANGLE access control (ID 400738)
  • CVE-2026-5880 | Google Chrome up to 146.0.7680.178 Browser UI clickjacking (ID 424995)
  • CVE-2026-5881 | Google Chrome up to 146.0.7680.178 LocalNetworkAccess Remote Code Execution (ID 454162)
  • CVE-2026-5882 | Google Chrome up to 146.0.7680.178 Fullscreen ui layer (ID 480993)
  • CVE-2026-5883 | Google Chrome up to 146.0.7680.178 Media use after free (ID 482958)
  • CVE-2026-5884 | Google Chrome up to 146.0.7680.178 Media access control (ID 484547)
  • CVE-2026-5885 | Google Chrome up to 146.0.7680.178 on Windows WebML information disclosure (ID 485203)
  • CVE-2026-5886 | Google Chrome up to 146.0.7680.178 on macOS WebAudio out-of-bounds (ID 485397)
  • CVE-2026-5887 | Google Chrome up to 146.0.7680.178 on Windows Downloads input validation (ID 486079)
  • CVE-2026-5888 | Google Chrome up to 146.0.7680.178 WebCodecs uninitialized variable (ID 486506)
  • CVE-2026-5889 | Google Chrome up to 146.0.7680.178 PDFium information disclosure (ID 486906)
  • CVE-2026-5890 | Google Chrome up to 146.0.7680.178 WebCodecs race condition (ID 487259)
  • CVE-2026-5891 | Google Chrome up to 146.0.7680.178 Browser UI ui layer (ID 487471)
  • CVE-2026-5892 | Google Chrome up to 146.0.7680.178 PWAs Remote Code Execution (ID 487568)
  • CVE-2026-5893 | Google Chrome up to 146.0.7680.178 V8 race condition (ID 487768)
  • CVE-2026-5894 | Google Chrome up to 146.0.7680.178 PDF Remote Code Execution (ID 481882)
  • CVE-2026-5895 | Google Chrome up to 146.0.7680.178 on iOS Omnibox clickjacking (ID 374285)
  • CVE-2026-5896 | Google Chrome up to 146.0.7680.178 Audio access control (ID 400645)
  • CVE-2026-5897 | Google Chrome up to 146.0.7680.178 Downloads ui layer (ID 419921)
  • CVE-2026-5898 | Google Chrome up to 146.0.7680.178 Omnibox ui layer (ID 470295)
  • CVE-2026-5899 | Google Chrome up to 146.0.7680.178 History Navigation cross site scripting (ID 474817)
  • CVE-2026-5900 | Google Chrome up to 146.0.7680.178 Downloads (ID 475265)
  • CVE-2026-5901 | Google Chrome up to 146.0.7680.178 DevTools (ID 479673)
  • CVE-2026-5902 | Google Chrome up to 146.0.7680.178 on Android Media race condition (ID 483109)
  • CVE-2026-5903 | Google Chrome up to 146.0.7680.178 IFrameSandbox access control (ID 483771)
  • CVE-2026-5904 | Google Chrome up to 146.0.7680.178 V8 use after free (ID 483851)
  • CVE-2026-5905 | Google Chrome up to 146.0.7680.178 on Windows Permissions clickjacking (ID 483899)
  • CVE-2026-5906 | Google Chrome up to 146.0.7680.178 on Android Omnibox clickjacking (ID 484082)
  • CVE-2026-5907 | Google Chrome up to 146.0.7680.178 Media out-of-bounds (ID 484665)
  • CVE-2026-5908 | Google Chrome up to 146.0.7680.178 Media external control of assumed-immutable web parameter (ID 485115)
  • CVE-2026-5909 | Google Chrome up to 146.0.7680.178 Media external control of assumed-immutable web parameter (ID 485203)
  • CVE-2026-5910 | Google Chrome up to 146.0.7680.178 Media integer overflow (ID 485212)
  • CVE-2026-5911 | Google Chrome up to 146.0.7680.178 ServiceWorkers access control (ID 485785)
  • CVE-2026-5912 | Google Chrome up to 146.0.7680.178 WebRTC integer overflow (ID 486498)
  • CVE-2026-5913 | Google Chrome up to 146.0.7680.178 Blink out-of-bounds (ID 487195)
  • CVE-2026-5914 | Google Chrome up to 146.0.7680.178 CSS type confusion (ID 490023)
  • CVE-2026-5915 | Google Chrome up to 146.0.7680.178 WebML out-of-bounds write (ID 494341)
  • CVE-2026-5918 | Google Chrome up to 146.0.7680.178 Navigation cross-domain policy (ID 490139)
  • CVE-2026-5919 | Google Chrome up to 146.0.7680.178 WebSockets cross-domain policy (ID 483423)
  • CVE-2026-5959 | GL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE 1.8.1 Factory Reset improper authentication
  • CVE-2026-5960 | code-projects Patient Record Management System 1.0 SQL Database Backup File /db/hcpms.sql information disclosure
  • CVE-2026-5962 | Tenda CH22 1.0.0.6(468) httpd R7WebsSecurityHandlerfunction path traversal
  • CVE-2026-5970 | FoundationAgents MetaGPT up to 0.8.1 HumanEvalBenchmark/MBPPBenchmark check_solution code injection (Issue 1942)
  • CVE-2026-5971 | FoundationAgents MetaGPT up to 0.8.1 XML action_node.py ActionNode.xml_fill eval injection (Issue 1928)
  • CVE-2026-5972 | FoundationAgents MetaGPT up to 0.8.1 terminal.py Terminal.run_command os command injection (Issue 1929)
  • CVE-2026-5973 | FoundationAgents MetaGPT up to 0.8.1 metagpt/utils/common.py get_mime_type os command injection (Issue 1930)
  • CVE-2026-5974 | FoundationAgents MetaGPT up to 0.8.1 terminal.py Bash.run os command injection (Issue 1931)
  • CVE-2026-5975 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setDmzCfg wanIdx os command injection
  • CVE-2026-5976 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setStorageCfg sambaEnabled os command injection
  • CVE-2026-5977 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setWiFiBasicCfg wifiOff os command injection
  • CVE-2026-5978 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setWiFiAclRules mode os command injection
  • CVE-2026-5979 | D-Link DIR-605L 2.13B01 POST Request /goform/formVirtualServ curTime buffer overflow
  • CVE-2026-5980 | D-Link DIR-605L 2.13B01 POST Request /goform/formSetMACFilter curTime buffer overflow
  • CVE-2026-5981 | D-Link DIR-605L 2.13B01 POST Request /goform/formAdvFirewall curTime buffer overflow
  • CVE-2026-5982 | D-Link DIR-605L 2.13B01 POST Request /goform/formAdvNetwork curTime buffer overflow
  • CVE-2026-5983 | D-Link DIR-605L 2.13B01 POST Request /goform/formSetDDNS curTime buffer overflow
  • CVE-2026-5984 | D-Link DIR-605L 2.13B01 POST Request /goform/formSetLog curTime buffer overflow
  • CVE-2026-5985 | code-projects Simple IT Discussion Forum 1.0 /crud.php user_Id sql injection
  • CVE-2026-5986 | Zod jsVideoUrlParser up to 0.5.1 lib/util.js getTime timestamp redos (Issue 121)
  • CVE-2026-5987 | Sanluan PublicCMS up to 6.202506.d FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine (Issue 113)
  • CVE-2026-6003 | code-projects Simple IT Discussion Forum 1.0 /admin/user.php fname cross site scripting
  • CVE-2026-6004 | code-projects Simple IT Discussion Forum 1.0 /delete-category.php cat_id sql injection
  • CVE-2026-6005 | code-projects Patient Record Management System 1.0 /hematology_print.php hem_id sql injection
  • CVE-2026-6006 | code-projects Patient Record Management System 1.0 /edit_hpatient.php ID sql injection
  • CVE-2026-6007 | itsourcecode Construction Management System 1.0 /del.php equipname sql injection
  • CVE-2026-6010 | CodeAstro Online Classroom 1.0/2.php takeassessment2.php?exid=14 Q1 sql injection
  • CVE-2026-6011 | OpenClaw up to 2026.1.26 assertPublicHostname web-fetch.ts server-side request forgery
  • CVE-2026-6012 | D-Link DIR-513 1.10 POST Request /goform/formSetPassword curTime buffer overflow
  • CVE-2026-6013 | D-Link DIR-513 1.10 POST Request /goform/formSetRoute curTime buffer overflow
  • CVE-2026-6014 | D-Link DIR-513 1.10 POST Request /goform/formAdvanceSetup webpage buffer overflow
  • CVE-2026-6015 | Tenda AC9 15.03.02.13 POST Request /goform/QuickIndex formQuickIndex PPPOEPassword stack-based overflow
  • CVE-2026-6016 | Tenda AC9 15.03.02.13 POST Request /goform/WizardHandle decodePwd WANS stack-based overflow
• Vulnerabilities and Threat Research – Qualys Security Blog
  • 12 Best Practices for Securing AWS Cloud in 2026
• Wired
  • 10% Dell Coupon Codes | April 2026
  • 20% Off Brooks Promo Code & Deals for | April 2026
  • 20% Off LG Promo Code & Coupons | April 2026
  • 30% Off Canon Promo Codes | April 2026
  • Altra Promo Codes: Get 20% Off Plus Free Shipping
  • AT&T Promo Codes and Bundle Deals: Save $50 in April
  • Bartesian Discount Codes and Deals: Up to 35% Off
  • Fi Mini for Cats Review: Track Your Pets and Monitor Their Activity
  • Google Workspace Promo Code: Up to 14% Off in 2026
  • I Asked Netflix’s Reality TV Boss Why So Many Men On Dating Shows Are Terrible
  • I Tested the Instagram-Famous Ridge Wallet and I’m a Convert
  • Inside the Pro-Iran Meme Machine Trolling Trump With AI Lego Cartoons
  • Medicube Coupon Code: Top Promo Codes and Discounts for April 2026
  • Meta Cafeteria Workers Did What Execs Won’t: Took on ICE and Won
  • NordVPN Coupons and Deals: 77% Off in April 2026
  • NZXT Discount Codes: 50% Off in April 2026
  • Peacock Promo Codes: 40% Off April 2026
  • Petlibro Discount Codes: Save Up to 50%
  • Politicians Are Spending More Money on Security as They Increasingly Become Targets
  • TCL NXTVISION Art TV Review: Just Fine
  • The FBI Didn't Answer Texts From Minnesota Investigators for Days After Renee Good’s Killing
  • This AI Wearable From Ex-Apple Engineers Looks Like an iPod Shuffle
  • Top Home Chef Promo Codes for April 2026
  • Top Paramount+ Coupon Codes and Deals for April 2026
  • TurboTax Service Codes: 30% Off TurboTax Full Service Expert | April 2026
  • Vimeo Promo Codes and Deals: Save Up to 40%
• 不安全
  • Apache ActiveMQ Classic 潜伏 13 年的 RCE 漏洞曝光
  • Cloudflare将在4月16日公测邮件发送 每月免费3,000封 超出后按千封0.35美元计算
  • Cryptocurrency ATM giant Bitcoin Depot reports $3.6 million stolen in cyberattack
  • ISC Stormcast For Thursday, April 9th, 2026 https://isc.sans.edu/podcastdetail/9886, (Thu, Apr 9th)
  • Koofr 云存储：免费 10GB 空间，支持 WebDAV、Rclone｜终身订阅 1TB 特价129刀
  • Masjesu 僵尸网络隐蔽攻击物联网设备，专注持久化而非大规模感染
  • OpenSSL 修复数据泄露等七处漏洞
  • Securing the AI Supply Chain: What are the Risks and Where to Start?
  • SkillTrojan：针对基于技能的智能体系统的后门攻击
  • 不少用户OneDrive出现陌生共享文件夹但无法删除 微软从1月开始修复但还未解决问题
  • 洛杉矶市律师系统遭入侵，敏感警局文件泄露
• 代码审计星球
  • 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
• 嘶吼
  • 嘶吼安全动态｜中央网信办召开全国网络法治工作会议 设备码钓鱼攻击暴增36倍，新型攻击工具在网上大肆扩散
• 奇客Solidot–传递最新科技情报
  • 纽时记者称 Adam Back 是中本聪
• 爱范儿
  • 接下来，苹果的 iPhone 和小米手机一样多
  • 时薪 6 毛钱，Anthropic 开始出租 AI 牛马
  • 星巴克「千店千面」战略启动，产品更重要了，门店依旧是星巴克的核心竞争力
• 量子位 QbitAI
  • 爆火GitHub！《生化危机》女主打造免费“AI记忆系统”
  • 马斯克死磕奥特曼：赔款我不要，但他必须离开OpenAI董事会
• 黑海洋
  • Gemini获得笔记本功能来帮助你组织项目
  • Spotify现在允许用户关闭应用内所有视频