安全资讯归档（2026-04-10）

• 2Libra
  • 2 站要活跃起来，估计得有羊毛和福利才行
  • ai 在 c++的应用怎么样？
  • cc switch 请教
  • cloudflare 自建节点
  • Cursor 和 github copilot 有用过的朋友么？
  • DGX Spark llama.cpp 部署 Gemma4 26B
  • Hermes Agent 初体验
  • Mac 微信不能同步聊天记录吗？
  • MacBookPro，屏幕保持一个角度久了后调整遇到的问题。
  • SBTI 是怎么突然一夜火起来的
  • WSL Dashboard v0.6.0 版本发布：网络管理与自动化能力全面升级
  • 《十三机兵防卫圈》点评：9 分｜如果说画风或者游戏性，我是断然不会觉得它出色的，但是叙事让我欲罢不能。
  • 【投票】【💰】建议 2 站也增加一个类似 V2EX 的 VXNA 节点
  • 【羊毛】移动 app 对灵犀 AI 助手 发送【春日福利加倍】 可领话费卷， 额度随机的
  • 【羊毛】移动话费 2 张，20-2 ，看得上的撸
  • 【许愿】同时佩戴多个徽章
  • 【💰】2 友们上班摸鱼都在干嘛呢
  • 【💰】【投票】Codex 4 月九日更新之后 token 完全不够用了
  • 【💰】假如有天从单位毕业了，少儿编程有没有搞头？
  • 【💰】再来一次，为了观点不错！
  • [【💰】急需一个注册注册 discord 教程`(金币拉满了望佬救)](https://2libra.com/post/tech-qa/Myaih7G)
  • 【💰】我想看看 2 站有多少搞硬件的，是不是都是软件大佬？
  • 【🔒】50 一月的 Grok supergrok，印度卢布支付攻略
  • 之前莫名其妙在 linuxdo 被封了 封号原因是{在错误的地方}
  • 你们在什么时候生活品质获得较大的提升？
  • 你的 SBTI 是什么
  • 你的 sbti 是什么？
  • 写了一个一键添加多个飞书机器人，同时隐私隔离的插件
  • 南方的春天
  • 嗨嗨嗨！波点拼贴风 plog 小工具 CHOCHO 在此
  • 感觉字体有点小
  • 感觉站内浏览变流畅了呢
  • 我的 gemini 疯了
  • 有了本站图床后，我自己的都用的少了
  • 有些名字，人老了以后叫起来有些怪怪的
  • 梦幻西游手游 新手如何学习攻略
  • 科技数码下面的子节点不一致
  • 论坛延迟是不是有点高？
• 36氪
  • 18亿港元，香港特区政府出手补贴燃油成本
  • 2连板沃格光电澄清：未参与苹果半导体玻璃基板样品开发
  • 4连板华远控股：本次重组可能涉及控股股东华远集团 不涉及本公司的重大资产重组事项
  • 5月裁员1.4万人？亚马逊回应：消息不属实
  • 8点1氪｜“张雪峰.skill”上线GitHub引争议；康师傅“再来一瓶”被曝多店不兑换；微信回应“夫妻用AI写公众号年赚200万”
  • AI超级周期推动需求激增，多家存储芯片企业一季度业绩预喜
  • Anthropic同意租用CoreWeave的AI算力以支持Claude
  • Avalyn Pharma在完成1亿美元超募融资后申请IPO
  • A股三大指数午间休盘集体上涨，白酒股走弱
  • A股三大指数集体收涨，沪深京三市约4000股飘红
  • A股三大指数集体高开，半导体板块领涨
  • A股三大股指均涨超1%
  • Meta移除律所招揽客户起诉该平台的广告
  • MiniMax上线音乐生成模型Music 2.6
  • OpenAI“星门计划”核心负责人离职，数据中心战略再迎重大调整
  • OpenAI宣布推出全新专业版订阅套餐，月费100美元
  • OpenAI抨击Anthropic算力资源受限
  • SpaceX去年因AI投入亏损近50亿美元
  • SpaceX已开始在得州工厂安装设备，目标年底投产
  • ST新动力：股东因涉嫌公司持股变动信息披露违法违规被证监会立案
  • “中科智云”正式发布SIEA-CORE
  • “开源中国”完成数亿元C+轮融资
  • “快快游戏”完成6000万元人民币A轮融资
  • “恰好”分管AI领域工作，美副防长巨额套现AI股
  • “杭州六小龙”之一群核科技港股招股首日超购82倍
  • “此芯科技”完成近十亿元B轮融资
  • “生数科技”完成近20亿元B轮融资
  • 《OpenClaw类智能体部署风险管理指南》正式发布
  • 《王者荣耀世界》正式上线PC平台
  • 万家基金董事长方一天将离任，或赴华安基金任总经理
  • 上交所：将主板风险警示股票价格的涨跌幅限制比例由5%调整为10%
  • 上交所：本周对中韩半导体ETF等溢价较高的基金，*ST正平等异常波动退市风险警示股票进行重点监控
  • 上市券商2025年投行业务迎来复苏，竞争逻辑从规模通道转向生态赋能
  • 上市前SpaceX业绩被曝光，受xAI拖累2025年亏损近50亿美元
  • 上市银行一季报前瞻：净息差边际企稳，盈利表现有望再上台阶
  • 东方盛虹：子公司拟133.3亿元投建芳烃产业链项目
  • 两市融资余额增加74.21亿元
  • 中信建投：持续看好缺电产业链
  • 中信建投：电价波动性增强将快速打开电力市场化主体对AI交易产品及服务的需求空间
  • 中信建投：继续提示美股科技的配置机会
  • 中信建投：资本市场的流动性基础和定价效率有望持续改善
  • 中信证券AH股大涨
  • 中信证券：目前通胀上行风险在挤压美联储降息空间
  • 中信证券：看好家电龙头的后市表现
  • 中国人民银行行长潘功胜会见桥水投资公司创始人瑞·达利欧
  • 中国动力：燃气轮机占公司整体收入比例较低
  • 中国汽车动力电池产业创新联盟：3月我国动力和储能电池合计产量为177.7GWh，同比增长50.2%
  • 中央网信办、国家铁路局联合约谈7家涉火车票销售第三方平台：不得用自动化程序高频抢票
  • 中康科技推出医生超级助理MedMate
  • 乘联分会：3月国内狭义乘用车市场零售销量达164.8万辆，同比下降15%
  • 亚行上调韩国今年经济增长预期0.2个百分点至1.9%
  • 亚行上调韩国今年经济增长预期至1.9%
  • 交通运输部安委办约谈中国铁建股份有限公司
  • 人民币兑美元中间价报6.8654
  • 今年一季度我国完成水利建设投资2070亿元
  • 企业加码布局，脑机接口商业化进程提速
  • 优优绿能：艾格HVDC相关产品正按计划推进研发
  • 伯克希尔发行日元债券，为巴菲特卸任CEO后首次
  • 保时捷一季度全球交付量同比下降15%，中国销量下降21%
  • 光大同创：拟出资1.5亿元设立合资公司，设立资金主要用于高速硅光模块智能制造项目
  • 光纤龙头回应：不存在运营商推迟集采的情况
  • 光通信龙头Lumentum预计订单将排满至2028年，拟在日本新增1亿美元投资
  • 全芯智造完成IPO辅导验收
  • 内存涨价终端承压，消费电子产业链差异化应对
  • 冰川网络：预计一季度净亏损950万元-1350万元
  • 创业板指涨超4%
  • 创业板指涨逾3%
  • 剑桥科技：控股股东及其一致行动人拟合计减持不超2.69%股份
  • 包钢股份：拟调整2026年二季度稀土精矿关联交易价格
  • 北交所新股重启网下询价发行
  • 北交所本周对2起证券异常交易行为采取自律监管措施
  • 北交所：设置风险警示股票单日买入数量上限
  • 华尔街大行股票交易收入料创纪录新高，或达180亿美元
  • 华峰铝业：拟投资不超过30亿元建设年产55万吨高端铝板带箔项目
  • 华泰证券：建议重点关注具备海外电解铝产能布局的相关公司
  • 华西证券：建议关注高景气成长赛道以及政策、科技加持下服务业景气拐点赛道
  • 印度央行强制银行平仓卢比空头头寸，银行面临数亿美元潜在亏损
  • 可能我们都低估了《王者荣耀世界》
  • 台积电3月销售额4151.9亿元台币，同比增长45.2%
  • 和硕3月营收同比下降0.79％
  • 国家统计局：2026年3月份，全国居民消费价格同比上涨1.0%。
  • 国家统计局：2026年3月份，全国工业生产者出厂价格同比由上月下降0.9%转为上涨0.5%
  • 国家网信办等五部门联合公布《人工智能拟人化互动服务管理暂行办法》
  • 国家网信办等五部门：拟人化互动服务提供者不得向第三方提供用户交互数据
  • 国家网信办等五部门：支持算法、框架、芯片等技术的自主创新，推进拟人化互动服务技术研发和相关标准建设
  • 多模态大模型HappyHorse或由阿里团队研发
  • 大众汽车将在美国停产纯电车型
  • 天猫与长安启源达成合作，布局新能源整车销售业务
  • 央行今日开展20亿元7天逆回购操作
  • 央行：未予采纳“建议将第三方支付机构纳入《电子支付指引（第一号）》的规定对象”
  • 宗馥莉在上海成立企业管理新公司
  • 将投产全新小型SUV？特斯拉中国：谣言
  • 小米MiMo获Kilo多个热门场景榜单第一
  • 小马智行发布PonyWorld世界模型2.0
  • 小鹏与福耀联合发布AI调光隐私玻璃，首块量产交付
  • 工信部：2025年国家高新区上市企业数量较“十三五”末增长70%
  • 工信部：2025年国家高新区实现园区生产总值20.4万亿元
  • 工信部：加快构建高效统一的人工智能芯片计算互联生态
  • 巨人网络：第一季度净利预增187%至245%
  • 广安爱众：董事李常兵被立案调查并实施留置
  • 广州小马智行科技公司注册资本增至2亿元，增幅100%
  • 张雪机车公司业务新增货物进出口
  • 彩虹股份：ITC裁定属于初裁结果，公司基板玻璃在半导体封装领域尚处于研发阶段
  • 微信3月更新9项功能，微信、企微支持连接自己的龙虾
  • 微盟推出智慧服务和智慧美业解决方案
  • 微软称AI语音技术仍有待完善
  • 快看漫画秘密研发AI娱乐产品，近期将以独立App上线
  • 恒指午间休盘涨0.61%，恒生科技指数涨1.07%
  • 恒指开盘涨0.54%，恒生科技指数涨0.47%
  • 恒生科技指数上涨1%
  • 悦达汽车集团：奇瑞汽车全面接手高合汽车盐城工厂消息不实
  • 新宙邦：第一季度净利同比预增100.11%—117.51%
  • 无问芯穹正式推出InfiniClaw Box
  • 明牌珠宝：拟转让卡利罗公司100%股权，预计转让价格2亿元—3亿元
  • 星动纪元获“具身奥林匹克”三项全球第一
  • 春秋航空：2025年净利润23.17亿元，同比增长1.96%
  • 智元机器人等在深圳成立智元酷拓科技公司
  • 智元独立四足机器人业务，智元酷拓目标2030年出货量30万台、营收100亿元
  • 智源发布安全框架ClawKeeper，用智能体监管智能体
  • 机构今日买入中国动力等16股，抛售通鼎互联1.63亿元
  • 李强主持召开经济形势专家和企业家座谈会
  • 杭氧股份：2025年净利润9.49亿元，同比增长2.87%
  • 欧洲央行管委Sleijpen称必要时将采取行���，以确保通胀达标
  • 毛利率下滑，客户高度集中，天秦装备回应
  • 民航局：第一季度民航旅客运输量2亿人次，同比增长6.5%
  • 氪星晚报 ｜无印良品：2026财年第二季度营收196.1亿元，同比增长14.8%；小马智行发布PonyWorld世界模型2.0
  • 汇丰银行、渣打银行在香港获得稳定币牌照
  • 汉王科技发布Clear7锦鲤电纸书
  • 江特电机：拟参与发起设立“低空经济协同创新研究院”
  • 沪指重回4000点
  • 沪深两市成交额突破1万亿
  • 沪深两市成交额超2万亿元
  • 深交所：本周共对116起证券异常交易行为采取了自律监管措施
  • 深交所：第四套上市标准设置了较高的市值要求，以利于筛选出市场认可度高的企业
  • 深港通下的港股通标的证券名单调整，调入挚达科技
  • 港股恒生科技指数涨超2%
  • 潜能恒信：副总经理张卉解除留置
  • 热门中概股美股盘前集体走强，理想汽车涨超3%
  • 甘肃能源：拟投资43.77亿元建设庆阳东数西算产业园区绿电聚合试点项目二期100万千瓦新能源项目
  • 生态环境部：拟自2027年起，禁止生产以HCFC-22为制冷剂的多联式空调（热泵）机组产品
  • 百度伐谋Agent 2.0再次登顶MLE-Bench
  • 美国3月CPI同比上升3.3%
  • 美国至4月3日当周EIA天然气库存500亿立方英尺
  • 美联储4月维持利率不变的概率为98.4%
  • 美联储主席提名人选凯文·沃什的参议院听证会或推迟举行
  • 美股三大指数集体收涨，亚马逊涨超5%
  • 美股光通信龙头Lumentum放话：2028年产能面临售罄，本轮周期至少持续5年
  • 美股大型科技股盘前普涨，Meta涨超1%
  • 美财长和美联储主席据悉召集华尔街高管，讨论Anthropic新AI模型风险
  • 联想集团收购高端存储公司infinidat
  • 脑机接口等国家标准发布
  • 苏州天孚光通信股份有限公司向港交所提交上市申请书
  • 苹果将关闭美国首家成立工会的零售店
  • 蔚来ES9 开启预售，整车售价52.8万起
  • 证监会发布《关于深化创业板改革 更好服务新质生产力发展的意见》
  • 证监会同意长进光子科创板IPO注册
  • 证监会启动上市公司治理专项行动
  • 证监会：增设创业板第四套上市标准
  • 证监会：完善融资并购制度，提升股债融资灵活性便利性
  • 证监会：对财务造假且薪酬与业绩挂钩的上市公司 督促追回虚假业绩对应超发的高管薪酬
  • 证监会：意见出台更好支持科技创新和新质生产力发展的迫切需要
  • 证监会：推出更多创业板相关ETF和期权，适时推出创业板股指期货
  • 证监会：深化创业板改革，更好支持企业利用资本市场融资发展、做优做强
  • 证监会：进一步压实深交所审核主体责任 严把质量关
  • 证监会：进一步深化投资端改革，促进投融资协调发展
  • 豫园股份：预计2026年第一季度净利润同比增长208.72%
  • 财政部对中兴财光华作出行政处罚决定
  • 通源石油：2025年净利润3661.95万元，同比下降34.19%
  • 量子科技赛道一季度融资总额超去年全年
  • 长安汽车：2025年净利润40.75亿元
  • 阿里巴巴任命周靖人领导人工智能事业部
  • 阿里筹备出海闭门会：99家头部品牌受邀，已停止发放邀请函
  • 阿里：HappyHorse模型正处于内测中，近期开放API
  • 隆基绿能旗下无锡隆基氢能科技公司增资至5.5亿元
  • 集邦咨询：预估2026年第二季Consumer DRAM合约价格仍将持续季增45%—50%
  • 韩国央行将基准利率维持在2.50%不变
  • 首钢股份：终止筹划发行可转债及支付现金购买资产事项，4月13日开市起复牌
  • 香港金管局余伟文：即使将来再发牌照，整体牌照数量也会很有限
  • 马斯克的xAI就科罗拉多州新的人工智能法律提起诉讼
  • 骄成超声：拟定增募资不超13.44亿元，用于半导体先进超声设备研发及产业化项目等
  • 魔法原子近300台机器人即将亮相苏超开幕式
• 404 Media
  • World’s Largest Group of Chimps Waging Deadly ‘Civil War,’ Scientists Discover
• Ars Technica
  • Clinical trial shows gene editing works for β-Thalassaemia, too
  • Dad stuck in support nightmare after teen lied about age on Discord
  • Trump-appointed judges refuse to block Trump blacklisting of Anthropic AI tech
• blog.jim-nielsen.com
  • Fewer Computers, Fewer Problems: Going Local With Builds & Deployments
• Bruce's Blog
  • Claude HUD: The Status Bar That Claude Code Should Have Built In
  • Lazygit in 2026: The Git TUI That Makes Interactive Rebase Feel Like Cheating
  • uv in 2026: Why It Replaces pip, conda, and pyenv (With Decision Framework)
• Cheesy Rumbles
  • Crystal Mask
• CXSecurity: World Laboratory of Bugtraq 2
  • Docker Desktop 4.44.3 Unauthenticated API Exposure
  • esm-dev 136 Path Traversal
  • Grafana 11.6.0 SSRF
  • MaNGOSWebV4 4.0.6 Reflected XSS
  • OctoPrint 1.11.2 File Upload
• daringfireball.net
  • Adobe Diddles With Your /etc/hosts File
  • Lickspittle of the Week: Todd Blanche
  • MacOS Seemingly Crashes After 49 Days of Uptime — a ‘Feature’ Perhaps Exclusive to Tahoe
• darkreading
  • 'BlueHammer' Windows Zero-Day Exploit Signals Microsoft Bug Disclosure Issues
  • Industrial Controllers Still Vulnerable As Conflicts Move to Cyber
• Data Breach
  • Ransomware attack on ChipSoft knocks EHR services offline across hospitals in the Netherlands and Belgium
• defend.network
  • Daily Threat Briefing – April 10, 2026
• Der Flounder
  • Detecting installed Intel-based applications on macOS Tahoe
• EFF
  • EFF is Leaving X
  • We Need You: Our Privacy Cannot Afford a Clean Extension of Section 702
  • Yikes, Encryption’s Y2K Moment is Coming Years Early
• eli.thegreenplace.net
  • watgo - a WebAssembly Toolkit for Go
• Fidelis Security
  • Sybil Attacks Explained: How They Work and Why They Matter
• gilesthomas.com
  • Writing an LLM from scratch, part 32j -- Interventions: trying to train a better model in the cloud
• Hacker News Frontpage
  • Bitmap fonts make computers feel like computers again
  • Charcuterie – Visual similarity Unicode explorer
  • ChatGPT Pro now starts at $100/month
  • CollectWise (YC F24) Is Hiring
  • CPU-Z and HWMonitor Compromised
  • Discovering, detecting, and surgically removing Google's AI watermark
  • FBI used iPhone notification data to retrieve deleted Signal messages
  • France Launches Government Linux Desktop Plan as Windows Exit Begins
  • Hegel, a universal property-based testing protocol and family of PBT libraries
  • Hip-hop pioneer, Afrika Bambaataa, dies aged 68
  • How Microsoft Abuses Its Users
  • I Let Claude Code Autonomously Run Ads for a Month
  • Many African families spend fortunes burying their dead
  • Microsoft PhotoDNA scanning problem
  • Microsoft suspends dev accounts for high-profile open source projects
  • Native Instant Space Switching on macOS
  • Netflix Prices Went Up Again – I Bought a DVD Player Instead
  • The effects of caffeine consumption do not decay with a ~5 hour half-life
  • The Pentagon Threatened Pope Leo XIV's Ambassador with the Avignon Papacy
  • The tool that won't let AI say anything it can't cite
  • What Game Engines Know About Data That Databases Forgot
  • Why do we tell ourselves scary stories about AI?
  • Women are getting most of the new jobs. What's going on with men?
  • Zero-build privacy policies with Astro
• HackerNews
  • EngageLab SDK 漏洞曝光：5000 万安卓用户受影响，含 3000 万加密钱包
• HackerNoon
  • Enhanced Secures $1M in Strategic Pre-Seed Funding to Bring Structured Yield to More Assets Onchain
  • Here's Why You Should Build Fortresses in Disturbed Markets: The Illusion of Stability
• ICT Security Magazine
  • SBOM: da obbligo normativo a strumento operativo. Come implementarlo davvero
• IEEE Spectrum
  • Remembering Gus Gaynor: A Devoted IEEE Volunteer
• InfoSec Write-ups - Medium
  • PortSwigger Lab: Information disclosure in version control history
  • “Bug Bounty Bootcamp #31: Blind SQL Injection on INSERT — When Contact Forms Become Silent Data…
  • ️ The 2026 Web3 Security Roadmap
• infosecurity-magazine.com
  • Google Chrome Rolls Out Protection Against Infostealers Targeting Session Cookies
  • Just Three Ransomware Gangs Accounted for 40% of Attacks Last Month
• joanwestenberg.com
  • Why I quit "The Strive"
• johndcook.com
  • Distribution of digits in fractions
  • Random hexagon fractal
  • The Great Pyramid of Giza and the Speed of Light
• MIT Technology Review
  • The Download: an exclusive Jeff VanderMeer story and AI models too scary to release
• NVISO Labs
  • Security’s Blind Spot: Physical Keyloggers That Bypass Antivirus Entirely
• ProjectDiscovery.io | Blog
  • How We Cut LLM Costs by 59% With Prompt Caching
• Recent Commits to cve:main
  • Update Fri Apr 10 11:17:18 UTC 2026
• rtl-sdr.com
  • Measuring Antenna Gain Patterns with Discovery Drive
  • RTLSDR-NEXT: A Ground-Up Rust Rewrite of the RTL-SDR Driver
  • SPECTRAL-GSM: A Web-Based GSM Interception Platform Built on OsmocomBB
• SANS Internet Storm Center, InfoCON: green
  • Obfuscated JavaScript or Nothing, (Thu, Apr 9th)
• Schneier on Security
  • Sen. Sanders Talks to Claude About AI and Privacy
• Security Affairs
  • Bitcoin Depot hack leads to $3.6M Bitcoin theft via stolen credentials
  • EngageLab SDK flaw opens door to private data on 50M Android devices
  • Eurail data breach impacted 308,777 people
  • Malicious PDF reveals active Adobe Reader zero-day in the wild
  • UAT-10362 linked to LucidRook attacks targeting Taiwan-based institutions
• SentinelOne
  • The Good, the Bad and the Ugly in Cybersecurity – Week 15
• shkspr.mobi
  • [RSS Club] Why do you use RSS rather than Atom?
• simonwillison.net
  • GitHub Repo Size
• Sploitus.com Exploits RSS Feed
  • Exploit for Classic Buffer Overflow in Freefloat Freefloat_Ftp_Server exploit
  • Exploit for CVE-2022-30190 exploit
  • Exploit for CVE-2025-15260 exploit
  • Exploit for CVE-2026-23869 exploit
  • Exploit for CVE-2026-34197 exploit
  • Exploit for CVE-2026-35584 exploit
  • Exploit for CVE-2026-39912 exploit
  • Exploit for Improper Access Control in Fiberhome Hg6145F1_Firmware exploit
  • Exploit for Out-of-bounds Read in Microsoft exploit
  • Exploit for Out-of-bounds Write in Google Chrome exploit
  • Exploit for Path Traversal in Xibosignage Xibo exploit
  • Exploit for SQL Injection in Djangoproject Django exploit
  • Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware exploit
• TechCrunch
  • After data breach, $10B valued startup Mercor is having a month
  • ChatGPT finally offers $100/month Pro plan
  • EFF is the latest organization to leave X
  • Florida AG announces investigation into OpenAI over shooting that allegedly involved ChatGPT
  • Florida AG to probe OpenAI, alleging possible connection to FSU shooting
  • France to ditch Windows for Linux to reduce reliance on US tech
  • Google and Intel deepen AI infrastructure partnership
  • How to make the Startup Battlefield Top 20 — and what every company gets regardless
  • Is Anthropic limiting the release of Mythos to protect the internet — or Anthropic?
  • Last 24 hours: Save up to $500 on your TechCrunch Disrupt 2026 pass
  • Meta AI app climbs to No. 5 on the App Store after Muse Spark launch
  • PSA: If you use the Meta AI app, your friends will find out and it will be embarrassing
  • Sierra’s Bret Taylor says the era of clicking buttons is over
  • Snap gets closer to releasing new AI glasses after years-long hiatus
  • Volkswagen drops all-electric ID.4 in the US in pivot back to gas SUVs
  • What founders can learn from Anjuna’s layoffs and recovery
  • You can now edit your Instagram comments
  • YouTube Premium and YouTube Music are getting more expensive
• The Decoder
  • CIA plans to integrate AI assistants into all analysis platforms
  • Claude Cowork expands to all paid plans on macOS and Windows with new org controls
  • Google Gemini now generates interactive visualizations you can tweak and explore right in the chat
  • LLMs crush coding and math but choke on casual questions, and that's not a contradiction
  • OpenAI tells investors its infrastructure gives it an edge over Anthropic
• The Verge
  • Castlevania headlines a big list of exciting indie game reveals
  • ChatGPT has a new $100 per month Pro subscription
  • Cloudflare made a WordPress for AI agents
  • Fear and loathing at OpenAI
  • Florida launches investigation into OpenAI
  • Framework is teasing a lot of Linux for its April 21st event
  • Gen Z’s love-hate relationship with AI
  • Google’s Gemini AI can answer your questions with 3D models and simulations
  • Here are the best Apple Watch deals available right now
  • Instagram now lets you edit your own comments
  • Interior design at 25,000 mph
  • John Deere will pay farmers $99 million over right-to-repair lawsuit
  • Mastodon is about to launch its take on Bluesky’s starter packs
  • NASA’s Artemis II mission to fly around the far side of the Moon
  • Netflix’s TV games get a big boost with Jackbox collection
  • Samsung’s Galaxy Watch 8 is easier to recommend now it starts at $260
  • Snap is sticking with Qualcomm for its next AR glasses
  • The EFF is quitting X
  • The MacBook Neo is the best thing to happen to Windows in years
  • The team behind 1000xResist is making a game about convincing an AI that it isn’t human
  • Why your Whoop might tell you to up your testosterone
  • YouTube Premium is getting pricier
• VulDB Recent Entries
  • CVE-2023-54358 | Adivaha WordPress adivaha Travel Plugin 2.3 GET Parameter /mobile-app/v3/ isMobile cross site scripting (Exploit 51663 / EDB-51663)
  • CVE-2023-54359 | Adivaha WordPress adivaha Travel Plugin 2.3 GET Parameter /mobile-app/v3/ pid sql injection (Exploit 51655 / EDB-51655)
  • CVE-2023-54360 | Jlexart Joomla JLex Review 6.0.1 URL Parameter review_id cross site scripting (Exploit 51645 / EDB-51645)
  • CVE-2023-54361 | Thethinkery Joomla iProperty Real Estate 4.1.1 GET Parameter filter_keyword cross site scripting (Exploit 51640 / EDB-51640)
  • CVE-2023-54362 | Virtuemart Shopping-Cart 4.0.12 on Joomla keyword cross site scripting (Exploit 51631 / EDB-51631)
  • CVE-2023-54363 | Solidres 2.13.3 on Joomla GET Parameter cross site scripting (Exploit 51638 / EDB-51638)
  • CVE-2023-54364 | HikaShop 4.7.4 on Joomla Product Filter Endpoint from_option/from_ctrl/from_task/from_itemid cross site scripting (Exploit 51629 / EDB-51629)
  • CVE-2025-13914 | Juniper Apstra up to 6.1.0 SSH key exchange without entity authentication (JSA107862)
  • CVE-2025-13926 | Contemporary Controls BASControl20 3.1 Network Traffic reliance on untrusted inputs in a security decision
  • CVE-2025-59969 | Juniper Junos OS Evolved on PTX evo-aftmand/evo-pfemand buffer overflow (JSA103159)
  • CVE-2025-63238 | LimeSurvey up to 6.15.11 URL QuestionCreate.php getInstance gid cross site scripting
  • CVE-2025-70364 | Kiamo up to 8.3 privilege escalation
  • CVE-2025-70365 | Kiamo up to 8.3 Administrative Interface cross site scripting
  • CVE-2026-1115 | parisneo lollms up to 2.1.x init.py create_post cross site scripting
  • CVE-2026-1263 | usystemsgmbh Webling Plugin up to 3.9.0 on WordPress webling_admin_save_form cross site scripting
  • CVE-2026-1924 | arubadev Aruba HiSpeed Cache Plugin up to 3.0.4 on WordPress Setting ahsc_ajax_reset_options cross-site request forgery
  • CVE-2026-21904 | Juniper Junos Space up to 24.1R4 list filter cross site scripting (JSA106003)
  • CVE-2026-21916 | Juniper Junos OS up to 25.4R0 symlink (JSA107807)
  • CVE-2026-21919 | Juniper Junos OS/Junos OS Evolved Management Daemon incorrect synchronization (JSA106019)
  • CVE-2026-22750 | VMware Spring Cloud Gateway up to 4.2.0 SSL Bundle Configuration cryptographic issue
  • CVE-2026-2305 | addfunc AddFunc Head & Footer Code Plugin up to 2.3 on WordPress Custom Fields Interface register_meta aFhfc_head_code/aFhfc_body_code/aFhfc_footer_code cross site scripting
  • CVE-2026-25203 | Samsung Electronics MagicINFO 9 Server 21.1091.1 default permission
  • CVE-2026-2712 | davidanderson WP-Optimize Plugin up to 4.5.0 on WordPress Heartbeat class-wp-optimize-heartbeat.php receive_heartbeat authorization
  • CVE-2026-29923 | EnTech Taiwan PowerStrip up to 3.90.736 IOCTL pstrip64.sys Local Privilege Escalation
  • CVE-2026-33455 | Checkmk up to 2.5.0b3 Monitoring Quicksearch delimiter
  • CVE-2026-33456 | Checkmk up to 2.4.0p25/2.5.0b3 Notification Test Page delimiter
  • CVE-2026-33457 | Checkmk up to 2.3.0p46/2.4.0p25/2.5.0b3 Livestatus Command service name delimiter
  • CVE-2026-3360 | themeum Tutor LMS Plugin up to 3.9.7 on WordPress POST pay_incomplete_order user_id authorization
  • CVE-2026-33771 | Juniper CTP OS up to 9.2R2 weak password (JSA107864)
  • CVE-2026-33773 | Juniper Junos OS up to 23.4R2-S6/24.2R2-S3 on EX4100 IRB Interface initialization of resource (JSA107815)
  • CVE-2026-33774 | Juniper Junos OS up to 23.2R2-S5/23.4R2-S6/24.2R1/24.4R1 Loopback Interface unusual condition (JSA107865)
  • CVE-2026-33775 | Juniper Junos OS up to 25.2R1 on MX Log Message bbesmgd[] memory leak (JSA107821)
  • CVE-2026-33776 | Juniper Junos OS/Junos OS Evolved CLI Command authorization (JSA107866)
  • CVE-2026-33778 | Juniper Junos OS up to 25.2R1-S2 kmd/iked improper validation of syntactic correctness of input (JSA107868)
  • CVE-2026-33779 | Juniper Junos OS up to 25.2R1-S2 on SRX Server Certificate Parser improper following of a certificate's chain of trust (JSA107823)
  • CVE-2026-33780 | Juniper Junos OS/Junos OS Evolved prior 22.4R3-S5/23.2R2-S3/23.4R2-S4/24.2R2 Layer 2 Address Learning Daemon memory leak (JSA107819)
  • CVE-2026-33781 | Juniper Junos OS up to 24.4R0/24.4R1/25.2R1-S1/25.2R1 Packet Forwarding Engine unusual condition (JSA107869)
  • CVE-2026-33782 | Juniper Junos OS up to 22.4R3-S0/23.2R1/23.4R1 on MX memory leak (JSA107820)
  • CVE-2026-33783 | Juniper Junos OS Evolved up to 23.1/23.3/24.1/24.3/25.1 on PTX Sensor Interface Incorrect function call with incorrect argument type (JSA107870)
  • CVE-2026-33784 | Juniper JSI LWC up to 3.0.93 Virtual Lightweight Collector default password (JSA107871)
  • CVE-2026-33785 | Juniper Junos OS up to 24.4R0/24.4R2-S2/25.2R1 Security Distributed Service authorization (JSA107872)
  • CVE-2026-33786 | Juniper Junos OS up to 24.4R1-S3/24.4R1 CLI Command unusual condition (JSA107810)
  • CVE-2026-33787 | Juniper Junos OS up to 25.2R1-S1 CLI Command unusual condition (JSA107873)
  • CVE-2026-33788 | Juniper Junos OS Evolved prior 23.2R2-EVO missing authentication (JSA107806)
  • CVE-2026-33790 | Juniper Junos OS up to 25.2R1-S2 unusual condition (JSA107874)
  • CVE-2026-33791 | Juniper Junos OS/Junos OS Evolved CLI os command injection (JSA107875)
  • CVE-2026-33793 | Juniper Junos OS/Junos OS Evolved User Interface unnecessary privileges (JSA103142)
  • CVE-2026-33797 | Juniper Junos OS/Junos OS Evolved up to 25.2R0/25.2R1 denial of service (JSA107850)
  • CVE-2026-34424 | Nextendweb Smart Slider 3 Pro Plugin up to 3.5.1.35 on WordPress/Joomla malicious code
  • CVE-2026-34483 | Apache Tomcat up to 8.5.82/8.5.100/9.0.116/10.1.53/11.0.20 JsonAccessLogValve escape output
  • CVE-2026-34486 | Apache Tomcat up to 9.0.116/10.1.53/11.0.20 missing encryption
  • CVE-2026-34487 | Apache Tomcat up to 9.0.116/10.1.53/11.0.20 Bearer Token log file
  • CVE-2026-34500 | Apache Tomcat up to 9.0.116/10.1.53/11.0.20 CLIENT_CERT Authentication improper authentication
  • CVE-2026-34512 | OpenClaw up to 2026.3.24 kill killSubagentRunAdmin authorization (GHSA-9p93-7j67-5pc2)
  • CVE-2026-34941 | bytecodealliance wasmtime up to 24.0.6/36.0.6/42.0.1/44.0.0 out-of-bounds (GHSA-hx6p-xpx3-jvvv)
  • CVE-2026-34942 | bytecodealliance wasmtime up to 24.0.6/36.0.6/42.0.1/44.0.0 array index (GHSA-jxhv-7h78-9775)
  • CVE-2026-35206 | Helm up to 3.20.1/4.1.3 Chart path traversal (GHSA-hr2v-4r36-88hr)
  • CVE-2026-35207 | linuxdeepin dde-control-center/deepin-deepinid-plugin prior 5.9.9/6.1.80 Deepinid Cloud Service certificate validation (GHSA-jf2h-4vqc-3jgc)
  • CVE-2026-35556 | OpenPLC v3 credentials storage (icsa-25-345-10)
  • CVE-2026-35577 | apollographql apollo-mcp-server up to 1.6.x Model Context Protocol origin validation
  • CVE-2026-35617 | OpenClaw up to 2026.3.24 Policy Enforcement reliance on untrusted inputs in a security decision (GHSA-52q4-3xjc-6778)
  • CVE-2026-35622 | OpenClaw up to 2026.3.21 authentication spoofing (GHSA-mp66-rf4f-mhh8)
  • CVE-2026-35623 | OpenClaw up to 2026.3.24 Webhook Endpoint excessive authentication (GHSA-xq8g-hgh6-87hv)
  • CVE-2026-35627 | OpenClaw up to 2026.3.21 DM Handler incorrect behavior order (GHSA-65h8-27jh-q8wv)
  • CVE-2026-35628 | OpenClaw up to 2026.3.24 excessive authentication (GHSA-vcx4-4qxg-mfp4)
  • CVE-2026-35631 | OpenClaw up to 2026.3.21 authorization (GHSA-3w6x-gv34-mqpf)
  • CVE-2026-35632 | OpenClaw up to 2026.2.22 agents.create/agents.update symlink (GHSA-7xr2-q9vf-x4r5)
  • CVE-2026-35639 | OpenClaw up to 2026.3.21 device.pair.approve incorrect privileged apis (GHSA-hf68-49fm-59cq)
  • CVE-2026-35640 | OpenClaw up to 2026.3.24 JSON Parser incorrect behavior order (GHSA-3h52-cx59-c456)
  • CVE-2026-35644 | OpenClaw up to 2026.3.21 baseUrl/httpUrl cleartext storage (GHSA-ppwq-6v66-5m6j)
  • CVE-2026-35646 | OpenClaw up to 2026.3.24 excessive authentication (GHSA-mf5g-6r6f-ghhm)
  • CVE-2026-39315 | unjs unhead up to 2.1.12 safe.ts useHeadSafe incomplete blacklist (GHSA-95h2-gj7x-gx9w)
  • CVE-2026-39843 | makeplane up to 1.2.x fetch_and_encode_favicon server-side request forgery
  • CVE-2026-39848 | 10ij dockyard up to 1.0.x Docker Container action.php?action=stop&name= missing authentication (GHSA-jrf6-3j4j-q36g)
  • CVE-2026-39853 | mtrojnar osslsigncode up to 2.11 stack-based overflow
  • CVE-2026-39911 | hashgraph guardian up to 3.5.0 Environment Variable exposure of resource
  • CVE-2026-39912 | v2board/Xboard WithMailLink Endpoint login_with_mail_link_enable insertion of sensitive information into sent data
  • CVE-2026-39941 | ChurchCRM up to 7.0.x EditEventAttendees.php EName/EDesc cross site scripting
  • CVE-2026-39957 | Lychee up to 7.5.3 listAll authorization (GHSA-4v4c-g2jv-4g25)
  • CVE-2026-39958 | AOSC oma up to 1.25.0 topics.json Name crlf injection (GHSA-86jc-7r6q-cr3f)
  • CVE-2026-39959 | tmds Tmds.DBus/Tmds.DBus.Protocol up to 0.91.x SynchronizationContext allocation of resources (GHSA-xrw6-gwf8-vvr9)
  • CVE-2026-39961 | aiven aiven-operator up to 0.36.x namespace privileges management
  • CVE-2026-39962 | MISP up to 2.5.35 ApacheAuthenticate.php Username ldap injection (GHSA-mc53-48w8-9g63)
  • CVE-2026-39974 | czlonkowski n8n-mcp up to 2.47.3 Model Context Protocol server-side request forgery (GHSA-4ggg-h7ph-26qr)
  • CVE-2026-39980 | OpenCTI up to 6.9.4 safeEjs.ts special elements used in a template engine
  • CVE-2026-39987 | marimo-team marimo up to 0.22.x WebSocket Endpoint /terminal/ws validate_auth missing authentication
  • CVE-2026-40087 | langchain-ai langchain up to 0.3.82/1.2.27 special elements used in a template engine
  • CVE-2026-40088 | MervinPraison PraisonAI up to 4.5.120 execute_command os command injection
  • CVE-2026-40089 | sonicverse-eu audiostreaming-stack Dashboard api.ts server-side request forgery
  • CVE-2026-40107 | SiYuan up to 3.6.3 Mermaid Mermaid.js server-side request forgery (GHSA-w95v-4h65-j455)
  • CVE-2026-40109 | fluxcd notification-controller up to 1.8.2 Receiver Webhook Endpoint improper authentication (GHSA-h9cx-xjg6-5v2w)
  • CVE-2026-40116 | MervinPraison PraisonAI up to 4.5.127 WebSocket Endpoint /media-stream allocation of resources (GHSA-q5r4-47m9-5mc7)
  • CVE-2026-40149 | MervinPraison PraisonAI up to 4.5.127 auth_token generic exception (GHSA-4wr3-f4p3-5wjh)
  • CVE-2026-40152 | MervinPraison PraisonAIAgents up to 1.5.127 list_files directory path traversal (GHSA-7j2f-xc8p-fjmq)
  • CVE-2026-40154 | MervinPraison PraisonAI up to 4.5.127 inclusion of functionality from untrusted control sphere (GHSA-pv9q-275h-rh7x)
  • CVE-2026-40212 | OpenStack Skyline up to 5.0.0/6.0.0/7.0.0 Console Web Interface cross site scripting
  • CVE-2026-40217 | BerriAI LiteLLM test_custom_code unprotected alternate channel
  • CVE-2026-4057 | codename065 Download Manager Plugin up to 3.3.51 on WordPress makeMediaPublic ID authorization
  • CVE-2026-4305 | wproyal Royal WordPress Backup, Restore & Migration Plugin cross site scripting
  • CVE-2026-4351 | Perfmatters Plugin up to 2.5.9 on WordPress PMCS::action_handler snippets path traversal
  • CVE-2026-4436 | GPL Odorizers GPL750 up to 5.x register missing authentication
  • CVE-2026-4664 | ivole Customer Reviews for WooCommerce Plugin up to 5.103.0 on WordPress REST API Endpoint /ivole/v1/review create_review_permissions_check key improper authentication
  • CVE-2026-4977 | stiofansisland UsersWP Plugin up to 1.2.58 on WordPress AJAX upload_file_remove htmlvar authorization
  • CVE-2026-5187 | wolfSSL up to 5.9.0 wolfcrypt/src/asn.c DecodeObjectId heap-based overflow
  • CVE-2026-5188 | wolfSSL up to 5.9.0 Certificate integer underflow
  • CVE-2026-5194 | wolfSSL up to 5.9.0 Hash/Digest certificate validation
  • CVE-2026-5295 | wolfSSL up to 5.9.0 wolfcrypt/src/pkcs7.c wc_PKCS7_DecryptOri stack-based overflow
  • CVE-2026-5329 | Rapid7 Velociraptor up to 0.74.6/0.75.6/0.76.1 Client Monitoring Message handler input validation
  • CVE-2026-5448 | wolfSSL up to 5.9.0 Compatibility Layer API wolfSSL_X509_notAfter/wolfSSL_X509_notBefore Date heap-based overflow
  • CVE-2026-5460 | wolfSSL up to 5.9.0 KeyShare src/tls.c TLSX_KeyShare_ProcessPqcHybridClient use after free
  • CVE-2026-5466 | wolfSSL up to 5.9.0 wc_VerifyEccsiHash signature verification
  • CVE-2026-5479 | wolfSSL up to 5.9.0 EVP API wolfSSL_EVP_CipherFinal integrity check
  • CVE-2026-5500 | wolfSSL up to 5.9.0 Authentication Tag wc_PKCS7_DecodeAuthEnvelopedData mac channel accessible
  • CVE-2026-5501 | wolfSSL up to 5.9.0 OpenSSL Compatibility API wolfSSL_X509_verify_cert certificate validation
  • CVE-2026-5503 | wolfSSL up to 5.9.0 ClientHello TLSX_EchChangeSNI out-of-bounds write
  • CVE-2026-5504 | wolfSSL up to 5.9.0 PKCS7 CBC Decryption integrity check
  • CVE-2026-5507 | wolfSSL up to 5.9.0 Session deserialization
  • CVE-2026-5525 | Notepad++ up to 8.9.3 File Drop stack-based overflow
  • CVE-2026-5772 | wolfSSL up to 5.9.0 src/internal.c buffer over-read
  • CVE-2026-5778 | wolfSSL up to 5.9.0 Authentication Tag ssl_DecodePacket integer underflow
  • CVE-2026-6030 | itsourcecode Construction Management System 1.0 /del1.php toolname sql injection
  • CVE-2026-6031 | code-projects Simple IT Discussion Forum 1.0 add-category-function.php Category sql injection
  • CVE-2026-6032 | code-projects Simple Laundry System 1.0 /checkcheckout.php serviceId cross site scripting
  • CVE-2026-6033 | CodeAstro Online Classroom 1.0 updatedetailsfromstudent.php?eno=146891650 fname sql injection
  • CVE-2026-6034 | code-projects Vehicle Showroom Management System 1.0 ProfitAndLossReport.php BRANCH_ID cross site scripting
  • CVE-2026-6035 | code-projects Vehicle Showroom Management System 1.0 ServiceAndSalesReport.php BRANCH_ID cross site scripting
  • CVE-2026-6036 | code-projects Vehicle Showroom Management System 1.0 VehicleDetailsFunction.php VEHICLE_ID sql injection
  • CVE-2026-6037 | code-projects Vehicle Showroom Management System 1.0 AddVehicleFunction.php BRANCH_ID sql injection
  • CVE-2026-6038 | code-projects Vehicle Showroom Management System 1.0 RegisterCustomerFunction.php BRANCH_ID sql injection
  • CVE-2026-6042 | musl libc up to 1.2.6 GB18030 4-byte Decoder src/locale/iconv.c iconv denial of service
• Vulnerabilities and Threat Research – Qualys Security Blog
  • Scaling Modern AppSec: Moving from Static Profiles to AI-Powered Scan Optimization
• Wired
  • 20% Off Sephora Promo Code | April 2026
  • AI Podcasters Really Want to Tell You How to Keep a Man Happy
  • Aventon Current ADV Electric Mountain Bike Review: Feels Just Like the Real Thing
  • China Is Cracking Down on Scams. Just Not the Ones Hitting Americans
  • Factor Promo Code: 50% Off Off Meal Prep
  • Govee Discount Codes and Deals: 30% Off
  • Hungryroot Coupon Codes: 30% Off This April
  • Instacart Promo Codes & Savings Hacks for April 2026
  • John Deere Is Paying Farmers $99 Million for Allegedly Monopolizing Repair
  • Meta’s New AI Asked for My Raw Health Data—and Gave Me Terrible Advice
  • Naturepedic Promo Codes and Deals: 20% Off
  • OpenAI Backs Bill That Would Limit Liability for AI-Enabled Mass Deaths or Financial Disasters
  • Save $20 on This Already Inexpensive Wireless Mic Set
  • Sealy Promo Code: Save $200 on Mattresses This Month
  • Surfshark Promo Codes: 87% Off | April 2026
  • Top Nomad Goods Promo Codes: Get 25% Off in April 2026
  • Vivid Seats Promo Codes and Deals: Save 10% This April
  • Walmart Promo Codes and Coupons: Up to 65% Off
  • We-Vibe Discount Codes and Deals: Up to 60% Off
• 不安全
  • Best Sentry Alternatives for Error Tracking and Monitoring (2026)
  • Help
  • How to find best NPM packages?
  • How We Cut LLM Costs by 59% With Prompt Caching
  • Instagram现允许用户在15分钟内编辑评论
  • Nuitka to python. Nuitka is not really cython code due to dependencies I recommend to create new python compiler for protect your source not by weak compiler like Nuitka also you need decrypt xored nuitka blob in 4.0 (very easy task)
  • OpenAI缩减ChatGPT Plus订阅的Codex权益 每天可进行的对话将减少
  • SPECTRAL-GSM: A Web-Based GSM Interception Platform Built on OsmocomBB
  • Static analysis of iOS App Store binaries: common vulnerabilities I keep finding after 15 years in mobile security
  • 出于对博通授权政策的不满 包括西联汇款在内的大量企业从VMware迁移到Nutanix
  • 微软正在改进Windows 11右键菜单和快速设置 点击和操作时速度将会更快
  • 苹果将关闭美国首家加入工会的零售门店
• 代码审计星球
  • 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
• 嘶吼
  • 公安部通报37款违规应用，电商类占比超七成，小程序不再是 “法外之地”
  • 嘶吼安全动态|八部门联合发布《 科技数据安全管理暂行规定》，4月10日起实施 黑客利用像素级SVG技巧隐藏信用卡窃密代码
• 奇客Solidot–传递最新科技情报
  • EFF 退出 X 平台
  • FreeBSD 公布兼容笔记本型号
• 爱范儿
  • Anthropic的「奥本海默时刻」：最害怕 AI 的公司，正在造最危险的 AI
  • SBTI说我废物，这是今年听过最舒服的一句话
  • vivo Pad6 Pro 体验：要的，就是这块 4K 超大屏
  • 创造力时代，需要更多创造力机器｜安克 eufyMake E1 体验
  • 取代龙虾的是爱马仕？狂揽4万星的Hermes Agent，不只是OpenClaw平替
  • 奇瑞发布了 3 款新燃油车，这才是奇瑞销量的支柱和基本盘
  • 早报｜大疆Pocket 4官宣，下周发布/芯片用完，曝苹果为MacBook Neo补货/ChatGPT推出100美元Pro订阅
  • 独家｜阿里认领屠榜神秘模型「欢乐马」，ATH 郑波团队打造
  • 苹果瞒着你给 iPhone 打了个补丁，为什么？
  • 蔚来 ES9，拒绝成为「XX 揽胜」和「XX 库里南」
• 绿盟科技技术博客
  • 绿盟清风卫NSF-ClawGuard龙虾安全插件正式开源：为OpenClaw筑牢企业安全防线
• 量子位 QbitAI
  • 别只用AI写脚本了，现在AI打广告可真是城会玩了！
  • 刷屏的SBTI，底层算法有点东西…
  • 大模型能“原地”改参数了！字节Seed&北大新论文：测试时推理无需加层重训练
  • 奔驰崩了，在华销量大跌27%
  • 这帮清华的，造了一个让龙虾“安全着陆”的新物种
  • 马斯克说漏嘴了！Claude Opus参数5T，Sonnet 1T
• 黑海洋
  • Anthropic探索自研AI芯片 应对全球芯片短缺
  • Instagram现允许用户在15分钟内编辑评论
  • Ollama云端大模型免费指南：零门槛调用Gemma/Qwen/GLM，一键API接入
  • OpenAI发布新安全蓝图以应对儿童安全问题
  • 白宫严禁员工利用伊朗战事在预测市场押注
  • 约翰迪尔就维修权诉讼与农民达成和解
  • 美国佛罗里达州对OpenAI公司展开调查
  • 苹果将关闭美国首家加入工会的零售门店