安全资讯归档（2026-04-11）

2Libra
- claude 和 copilot 的 pro 连不经用
- OPC 感觉是就业蓄水池蓄不下来就再造一个词来安慰自己。
- 【💰】公司要买 Ai 套餐，求推荐
- 以后 AI 各个厂商对于程序员会不会出怀旧服
- 北京时间 4 月 11 日，8 点 07 分，阿尔忒弥斯二号完成降落，返回地球，结束了历时 10 天环绕月球的人类历史性任务。欢迎回到地球。
- 南京易司拓
- 弄了一个小程序，30 块认证费都挣不回来
36氪
- 34家上市房企债务压降8900亿元，打造好项目提升“造血”能力成关键
- 36氪首发 | 打破日本工业镜头垄断，松山湖团队融资数千万
- 36氪首发 | 深大教授AI芯片项目再融资近亿，主动式散热微系统服务传音
- 3月北京二手房成交近2万套，创近15个月新高
- 9点1氪｜7家涉火车票销售第三方平台被约谈；45秒500万，张雪直播间拍卖冠军复刻赛车“光速”成交；亚马逊辟谣5月将裁员1.4万
- Claude新模型危险，鲍威尔召集华尔街紧急开会！全美安全股暴跌2万亿
- IBM将支付1700万美元解决美国政府对DEI的调查
- OpenAI就第三方开发者库安全事件发声明：未发现用户数据泄露或系统遭入侵
- YouTube近三年来首次在美国上调订阅价格
- “锐盟半导体”完成近亿元A轮融资
- “阿基视觉”完成数千万元天使轮融资
- 一季度全国铁路完成固定资产投资1379亿元，同比增长5.1%
- 中信证券：流动性冲击扰动，互联网板块关注业绩韧性与AI主线
- 为什么有钱人也不买GUCCI了？
- 交易商仍押注美联储2026年全年将维持利率不变
- 京东否认进入网约车领域：正在测试新项目，4月13日上线
- 低空经济第一股，来了
- 供需双向博弈上演，化工品涨价持续性存差异
- 北向资金一季度持股情况公布，12个行业环比获加仓
- 千亿诉讼临近 OpenAI指控马斯克搞“突袭”
- 华泰证券：美国3月CPI环比增速符合预期，核心通胀仍然温和
- 多家上市公司预计一季度业绩倍增上游资源及材料制造类表现抢眼
- 多家快递公司宣布涨价
- 奥特曼家被炸了！
- 崔东树：3月的A00级电动车剧烈萎缩带来均价的上升，2026年销量增长压力较大
- 工业和信息化部将发布一批“人工智能+”高价值场景
- 工信部原副部长苏波：2030年新能源汽车市场渗透率预计超过70%
- 工信部原副部长苏波：新能源汽车发展仍存挑战，治理体系亟待完善
- 康斯特：压力传感器产品暂未向半导体、新材料等行业客户推广
- 我国首个海上注碳增气技术示范应用项目启动
- 报道：特朗普承诺将在卸任前为政府高级官员颁发特赦令
- 拿下豪华种子轮，一家明星AI公司宣布倒闭
- 日本投入160亿美元，力推初创企业Rapidus进军人工智能芯片领域
- 汽车行业已在阿里云上使用超10万卡“真武”PPU研发智驾
- 液冷逐渐成为“刚需”，16只概念股获机构调研
- 滴滴自动驾驶张博：聚焦安全和体验，推动自动驾驶全球化落地
- 特斯拉FSD受监督版本在荷兰获批
- 私募三月新发产品数量创近一年来新高
- 美国3月预算赤字为1641亿美元
- 美国土安全部召回员工，下笔薪资无着落
- 美股三大指数收盘涨跌不一，纳指涨0.35%并录得八连涨
- 美载人绕月飞船溅落在预定海域
- 蔚来李斌：高阶智驾芯片神玑NX9031与蔚来世界模型上车乐道L90
- 蔚来董事长李斌：建议尽快推动电芯标准化和芯片归一化
- 资本“抢跑”量产元年，具身智能产业链迎价值重估
- 那个“爱马仕”，想拯救“智障”小龙虾
- 郑州出台8条楼市新政
- 闪迪公司将于2026年4月20日起纳入纳斯达克100指数
- 雷军投的"红娘"要去IPO了
- 韩国政府将向收入下游70%人群发放现金援助，以缓解油价上涨压力
- 高盛、摩根士丹利等大行正测试Anthropic的Mythos大模型
- 黑石为数据中心收购公司IPO提交文件
404 Media
- The Oldest Octopus Fossil Ever Isn’t An Octopus At All, Scientists Discover
Ars Technica
- AI models are terrible at betting on soccer—especially xAI Grok
- F1 moves a step closer to fixing its 2026 hybrid problem
- Four astronauts are back home after a daring ride around the Moon
Blog - Praetorian
- Bypassing LLM Supervisor Agents Through Indirect Prompt Injection
Daniel Miessler
- How to Avoid Aperture Collapse
daringfireball.net
- Ed Bindels’s Apple Museum in Utrecht, Netherlands
- ★ Let Us Learn to Show Our Friendship for a Man When He Is Alive and Not After He Is Dead
darkreading
- Your Next Breach Will Look Like Business as Usual
defend.network
- Daily Threat Briefing – April 11, 2026
Hacker News Frontpage
- 20 Years on AWS and Never Not My Job
- Artemis II safely splashes down
- Bitcoin miners are losing $19,000 on every BTC produced as difficulty drops 7.8%
- Chimpanzees in Uganda locked in vicious 'civil war', say researchers
- Combining spicy foods with mint boosts anti-inflammatory effects 100x or more
- Filing the Corners Off MacBooks
- Industrial design files for Keychron keyboards and mice
- Nowhere Is Safe
- Peers vote to ban pornography depicting sex acts between stepfamily members
- South Korea introduces universal basic mobile data access
- Tesla's supervised self-driving software gets Dutch okay, first in Europe
- ’Abhorrent’: the inside story of the Polymarket gamblers betting millions on war
HackerNoon
- AI Subagents: What Works and What Doesn't
ICT Security Magazine
- Threat Modeling nel 2026: analisi approfondita, aggiornata e operativa
IEEE Spectrum
- Working With More Experienced Engineers Can Fast-Track Career Growth
NVIDIA AI Blog
- National Robotics Week — Latest Physical AI Research, Breakthroughs and Resources
pluralistic.net
- Pluralistic: Don't Be Evil (11 Apr 2026)
Schneier on Security
- Friday Squid Blogging: Squid Overfishing in the South Pacific
Security Affairs
- CVE-2026-39987: Marimo RCE exploited in hours after disclosure
shkspr.mobi
- Cheapest way to keep a UK mobile number using an eSIM
simonwillison.net
- Kākāpō parrots
Sploitus.com Exploits RSS Feed
- Exploit for CVE-2026-22557 exploit
TechCrunch
- Anthropic temporarily banned OpenClaw’s creator from accessing Claude
- Battery recycler Ascend Elements files for bankruptcy
- How to watch NASA’s Artemis II splash back down to Earth
- NASA Artemis II splashes down in Pacific Ocean in ‘perfect’ landing for Moon mission
- Nvidia-backed SiFive hits $3.65 billion valuation for open AI chips
- Stalking victim sues OpenAI, claims ChatGPT fueled her abuser’s delusions and ignored her warnings
- TechCrunch is heading to Tokyo — and bringing the Startup Battlefield with it
text/plain
- Understanding Defender AV Scans
The Decoder
- AI models would rather guess than ask for help, researchers find
- Claude Code's new Ultraplan feature moves task planning to the cloud
- Google's Gemma 4 puts free agentic AI on your phone and no data ever leaves the device
- Overworld's Waypoint-1.5 brings AI-generated 3D worlds to Mac and Windows on consumer hardware
- Someone threw a Molotov cocktail at OpenAI CEO Sam Altman's home in the middle of the night
- The operator behind the AI agent that defamed an open-source developer calls it a "social experiment"
The Verge
- 20-year-old man arrested for allegedly throwing a Molotov cocktail at Sam Altman’s house
- Amazon Luna axes third-party game purchases
- Demons and pinball are a perfect match
- Google’s latest Nest Doorbells just hit their lowest prices of the year
- How Iran out-shitposted the White House
- How to watch the Artemis II astronauts return to Earth
- Is the ‘Holy Grail of batteries’ finally ready to bless us with its presence?
- Little Snitch’s software counter surveillance jumps from Mac to Linux
- Microsoft finally lets Windows 11 testers unlock experimental features without ViVeTool
- My baby deer plushie told me that Mitski’s dad was a CIA operative
- My go-to electric screwdriver is on sale for over 50 percent off today
- Now the FAA says gamers are the answer to its air traffic controller shortage
- Pokémon Champions is off to a rough start
- The Iranian Lego AI video creators credit their virality to ‘heart’
- The new show making fun of tech bros
- You don’t have to spend more than $50 on a great USB-C dock for your Switch 2
- Your article about AI doesn’t need AI art
Threatninja.net
- Hack The Box: Eighteen Machine Walkthrough – Easy Difficulity
VulDB Recent Entries
- CVE-2025-66447 | Chamilo LMS up to 1.11.0/2.0-beta.1/2.0-beta.2 /login redirect (GHSA-m82x-prv3-rwwv)
- CVE-2026-1502 | Python CPython up to 3.14.x HTTP Client Proxy Tunnel crlf injection (ID 146211)
- CVE-2026-22560 | Rocket.Chat up to 8.3.x SAML Endpoint redirect
- CVE-2026-23781 | BMC Control-M MFT up to 9.0.22 API Debug Interface missing encryption
- CVE-2026-27460 | TandoorRecipes recipes up to 2.6.4 ZIP File Parser data amplification (GHSA-w8pq-4pwf-r2m8)
- CVE-2026-29043 | HDFGroup HDF5 up to 1.14.1-2 h5 File H5T__ref_mem_setnull heap-based overflow (GHSA-qm2m-5g5w-2277)
- CVE-2026-30232 | Chartbrew up to 4.8.4 server-side request forgery (GHSA-p4rg-967r-w4cv)
- CVE-2026-31939 | Chamilo LMS up to 1.11.37 savescores.php test path traversal
- CVE-2026-31940 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 Request Parameter main/lp/aicc_hacp.php session fixiation
- CVE-2026-31941 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 Social Wall read_url_with_open_graph social_wall_new_msg_main server-side request forgery (GHSA-q74c-mx8x-489h)
- CVE-2026-32252 | Chartbrew up to 4.8.x :project_id improper authorization (GHSA-mw4f-cf22-qpcj)
- CVE-2026-32892 | Chamilo LMS up to 1.11.37 POST Parameter fileManage.lib.php move Source os command injection
- CVE-2026-32893 | Chamilo LMS up to 2.0.0-RC.2 array_merge cross site scripting (GHSA-37jh-g64j-88mc)
- CVE-2026-32894 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 delete_mark/resultdelete null pointer dereference (GHSA-rqpg-p95v-fv98)
- CVE-2026-32930 | Chamilo LMS up to 1.11.37 editeval authorization
- CVE-2026-32931 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 File unrestricted upload
- CVE-2026-32932 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 External URL id_session redirect
- CVE-2026-33118 | Microsoft Edge up to 146.0.3856.84
- CVE-2026-33119 | Microsoft Edge up to 146.0.3856.84 on Android clickjacking
- CVE-2026-33141 | Chamilo LMS up to 2.0.0-RC.2 REST API Stats Endpoint authorization
- CVE-2026-3358 | themeum Tutor LMS Plugin up to 3.9.7 on WordPress POST enroll_now/course_enrollment authorization
- CVE-2026-33618 | Chamilo LMS up to 2.0.0-RC.2 /platform-config/list decodeSettingArray eval injection
- CVE-2026-33698 | Chamilo LMS up to 1.11.37 file access
- CVE-2026-33702 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 lp_ajax_save_item.php authorization
- CVE-2026-33703 | Chamilo LMS up to 2.0.0-RC.2 personal-data userId authorization
- CVE-2026-33704 | Chamilo LMS up to 1.11.37 BigUpload Endpoint unrestricted upload (GHSA-phfx-pwwg-945v)
- CVE-2026-33705 | Chamilo LMS up to 1.11.37 AJAX Endpoint /main/template/default/ file information disclosure (GHSA-5wjg-8x28-px57)
- CVE-2026-33706 | Chamilo LMS up to 1.11.37 update_user_from_username Status privileges management (GHSA-3gqc-xr75-pcpw)
- CVE-2026-33707 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 Password Reset email password recovery (GHSA-f27g-66gq-g7v2)
- CVE-2026-33708 | Chamilo LMS up to 1.11.37 REST API Endpoint get_user_info_from_username authorization (GHSA-qwch-82q9-q999)
- CVE-2026-3371 | themeum Tutor LMS Plugin up to 3.9.7 on WordPress AJAX save_course_content_order authorization
- CVE-2026-33710 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 time random values (GHSA-rpmg-j327-mr39)
- CVE-2026-33736 | Chamilo LMS up to 2.0.0-RC.2 Personal Information /api/users authorization (GHSA-fp2p-fj6c-x3x9)
- CVE-2026-33737 | Chamilo LMS up to 1.11.37/2.0.0-RC.2 simplexml_load_string xml external entity reference (GHSA-c4ww-qgf2-v89j)
- CVE-2026-3446 | Python CPython up to 3.13.12/3.14.3/3.15.0a7 b64decode
- CVE-2026-34477 | Apache Log4j Core up to 2.25.3/3.0.0-beta3 log4j2.sslVerifyHostName certificate host validation
- CVE-2026-34478 | Apache Log4j Core up to 2.25.3/3.0.0-beta3 Configuration incorrect provision of specified functionality
- CVE-2026-34480 | Apache Log4j Core up to 2.25.3/3.0.0-beta3 Conforming Parser escape output
- CVE-2026-34621 | Adobe Acrobat Reader up to 24.001.30356/26.001.21367 File prototype pollution (apsb26-43)
- CVE-2026-34727 | go-vikunja up to 2.2.x OIDC Call improper authentication (GHSA-8jvc-mcx6-r4cg)
- CVE-2026-3498 | wpblockart BlockArt Blocks Plugin up to 2.2.15 on WordPress Block Attribute cross site scripting
- CVE-2026-35594 | go-vikunja up to 2.2.x link_sharing.go GetLinkShareFromClaims session expiration (GHSA-96q5-xm3p-7m84)
- CVE-2026-35595 | go-vikunja up to 2.2.x project_permissions.go privileges management (GHSA-2vq4-854f-5c72)
- CVE-2026-35596 | go-vikunja up to 2.2.x hasAccessToLabel Label titles/descriptions/colors/creator authorization (GHSA-hj5c-mhh2-g7jq)
- CVE-2026-35597 | go-vikunja up to 2.2.x Login login.go HandleFailedTOTPAuth excessive authentication (GHSA-fgfv-pv97-6cmj)
- CVE-2026-35598 | go-vikunja up to 2.2.x GetResource/GetResourcesByList authorization (GHSA-48ch-p4gq-x46x)
- CVE-2026-35599 | go-vikunja up to 2.2.x addRepeatIntervalToTime algorithmic complexity (GHSA-r4fg-73rc-hhh7)
- CVE-2026-35600 | go-vikunja up to 2.2.x Email Notification cross site scripting (GHSA-45q4-x4r9-8fqj)
- CVE-2026-35601 | go-vikunja up to 2.2.x iCalendar VTODO Entry crlf injection (GHSA-2g7h-7rqr-9p4r)
- CVE-2026-35602 | go-vikunja up to 2.2.x File Import Endpoint Size allocation of resources (GHSA-qh78-rvg3-cv54)
- CVE-2026-35619 | OpenClaw up to 2026.3.23 /v1/models authorization (GHSA-68f8-9mhj-h2mp)
- CVE-2026-35620 | OpenClaw up to 2026.3.23 /send authorization (GHSA-39mp-545q-w789)
- CVE-2026-35621 | OpenClaw up to 2026.3.23 operator.admin authorization (GHSA-94pw-c6m8-p9p9)
- CVE-2026-35641 | OpenClaw up to 2026.3.23 Configuration File acceptance of extraneous untrusted data with trusted data (GHSA-m3mh-3mpg-37hw)
- CVE-2026-35643 | OpenClaw up to 2026.3.21 Untrusted Page verification of source (GHSA-cxmw-p77q-wchg)
- CVE-2026-35647 | OpenClaw up to 2026.3.24 Direct Message authentication bypass (GHSA-9wqx-g2cw-vc7r)
- CVE-2026-35648 | OpenClaw up to 2026.3.21 toctou (GHSA-wj55-88gf-x564)
- CVE-2026-35649 | OpenClaw up to 2026.3.21 Setting permissive list of allowed inputs (GHSA-pw7h-9g6p-c378)
- CVE-2026-35650 | OpenClaw up to 2026.3.21 Environment Variable external control of setting (GHSA-39pp-xp36-q6mg)
- CVE-2026-35651 | OpenClaw up to 2026.3.24 ANSI Escape Sequence control sequence (GHSA-4hmj-39m8-jwc7)
- CVE-2026-35652 | OpenClaw up to 2026.3.21 Interactive Call incorrect behavior order (GHSA-8883-9w57-vwv6)
- CVE-2026-35653 | OpenClaw up to 2026.3.23 /reset-profile authorization (GHSA-xp9r-prpg-373r)
- CVE-2026-35654 | OpenClaw up to 2026.3.24 Microsoft Teams Feedback authentication bypass (GHSA-rf6h-5gpw-qrgq)
- CVE-2026-35655 | OpenClaw up to 2026.3.21 rawInput reliance on untrusted inputs in a security decision (GHSA-74wf-h43j-vvmj)
- CVE-2026-35656 | OpenClaw up to 2026.3.21 Header X-Forwarded-For authentication spoofing (GHSA-844j-xrrq-wgh4)
- CVE-2026-35657 | OpenClaw up to 2026.3.24 Endpoint history authorization (GHSA-5jvj-hxmh-6h6j)
- CVE-2026-35658 | OpenClaw up to 2026.3.1 Image Parser exposure of resource (GHSA-cfp9-w5v9-3q4h)
- CVE-2026-35659 | OpenClaw up to 2026.3.21 data authenticity (GHSA-rvqr-hrcc-j9vv)
- CVE-2026-35660 | OpenClaw up to 2026.3.22 New Message /reset authorization (GHSA-wq58-2pvg-5h4f)
- CVE-2026-35661 | OpenClaw up to 2026.3.24 Direct Message authentication bypass (GHSA-j4c9-w69r-cw33)
- CVE-2026-35662 | OpenClaw up to 2026.3.21 Message authorization (GHSA-x2cm-hg9c-mf5w)
- CVE-2026-35663 | OpenClaw up to 2026.3.24 operator.admin incorrect privileged apis (GHSA-9hjh-fr4f-gxc4)
- CVE-2026-35664 | OpenClaw up to 2026.3.24 Legacy Call authentication bypass (GHSA-77w2-crqv-cmv3)
- CVE-2026-35665 | OpenClaw up to 2026.3.23 Feishu Webhook Endpoint amplification (GHSA-w6m8-cqvj-pg5v)
- CVE-2026-35666 | OpenClaw up to 2026.3.21 /usr/bin/time name resolution (GHSA-qm9x-v7cx-7rq4)
- CVE-2026-35667 | OpenClaw up to 2026.3.23 denial of service (GHSA-3298-56p6-rpw2)
- CVE-2026-35668 | OpenClaw up to 2026.3.23 Configuration Data fileUrl path traversal (GHSA-hr5v-j9h9-xjhg)
- CVE-2026-35669 | OpenClaw up to 2026.3.24 operator.admin incorrect privileged apis (GHSA-qm2m-28pf-hgjw)
- CVE-2026-35670 | OpenClaw up to 2026.3.21 reliance on untrusted inputs in a security decision (GHSA-wv46-v6xc-2qhf)
- CVE-2026-3865 | Kubernetes up to 1.20.0 CSI Driver for SMB path traversal (Issue 138319)
- CVE-2026-39921 | GeoNode up to 4.4.4/5.0.1 URL doc_url server-side request forgery
- CVE-2026-39922 | GeoNode up to 4.4.4/5.0.1 WMS Service server-side request forgery
- CVE-2026-40073 | sveltejs SvelteKit up to 2.57.0 BODY_SIZE_LIMIT allocation of resources (GHSA-2crg-3p73-43xp)
- CVE-2026-40074 | sveltejs SvelteKit up to 2.57.0 location exceptional condition (GHSA-3f6h-2hrp-w5wx)
- CVE-2026-40086 | danielgatis rembg up to 2.0.74 model_path path traversal (GHSA-3wqj-33cg-xc48)
- CVE-2026-40097 | smallstep certificates up to 0.30.0-rc2 array index (GHSA-9qq8-cgcv-qmc9)
- CVE-2026-40100 | labring FastGPT up to 4.14.10.3 Endpoint runTool isInternalAddress server-side request forgery (GHSA-jrhc-f3j7-f8g4)
- CVE-2026-40103 | go-vikunja up to 2.2.x projects.background_delete password hash instead of password for authentication (GHSA-v479-vf79-mg83)
- CVE-2026-40156 | MervinPraison PraisonAI up to 4.5.127 tools.py importlib.util.spec_from_file_location code injection (GHSA-2g3w-cpc4-chr4)
- CVE-2026-40157 | MervinPraison PraisonAI up to 4.5.127 tar.extract path traversal (GHSA-99g3-w8gr-x37c)
- CVE-2026-40158 | MervinPraison PraisonAI up to 4.5.127 python_tools.py _execute_code_direct code injection (GHSA-3c4r-6p77-xwr7)
- CVE-2026-40159 | MervinPraison PraisonAI up to 4.5.127 Model Context Protocol information disclosure (GHSA-pj2r-f9mw-vrcq)
- CVE-2026-40160 | MervinPraison PraisonAIAgents up to 1.5.127 httpx.AsyncClient.get server-side request forgery (GHSA-qq9r-63f6-v542)
- CVE-2026-40162 | Bugsink up to 2.1.0 File (GHSA-8hw4-fhww-273g)
- CVE-2026-40163 | Saltcorn up to 1.4.4/1.5.4/1.6.0-beta.3 JSON File Parser /sync/offline_changes path traversal (GHSA-32pv-mpqg-h292)
- CVE-2026-40168 | gitroomhq postiz-app up to 2.21.4 /api/public/stream server-side request forgery
- CVE-2026-40175 | Axios up to 1.14.x response splitting
- CVE-2026-40177 | ajenti up to 0.111 2FA improper authentication (GHSA-3mcx-6wxm-qr8v)
- CVE-2026-40178 | ajenti up to 0.111 improper authentication (GHSA-8647-755q-fw9p)
- CVE-2026-40180 | quarkiverse quarkus-openapi-generator up to 2.15.x ZIP ApicurioCodegenWrapper.java unzip path traversal (GHSA-jx2w-vp7f-456q)
- CVE-2026-40184 | mauriceboe TREK up to 2.7.1 missing authentication (GHSA-wxx3-84fc-mrx2)
- CVE-2026-40185 | mauriceboe TREK up to 2.7.1 authorization (GHSA-pcr3-6647-jh72)
- CVE-2026-40188 | patrickhener goshs up to 1.0.6/2.0.0-beta.3 missing write protection for parametric data values (GHSA-2943-crp8-38xx)
- CVE-2026-40189 | patrickhener goshs up to 2.0.0-beta.3 ACL/basic-auth authorization (GHSA-wvhv-qcqf-f3cx)
- CVE-2026-40190 | langchain-ai langsmith-sdk up to 0.5.17 set prototype pollution
- CVE-2026-40191 | craigjbass clearancekit up to 5.0.3 Destination authorization
- CVE-2026-40194 | phpseclib up to 1.0.27/2.0.52/3.0.50 SSH2::get_binary_packet timing discrepancy (GHSA-r854-jrxh-36qx)
- CVE-2026-40198 | STIGTSP Net::CIDR::Lite up to 0.22 on Perl _pack_ipv6 improper validation of syntactic correctness of input
- CVE-2026-40199 | STIGTSP Net::CIDR::Lite up to 0.22 on Perl IPv6 Address _pack_ipv6 length parameter
- CVE-2026-40200 | musl libc up to 1.2.6 control flow
- CVE-2026-40228 | systemd 259 ANSI Escape Sequence resource transfer
- CVE-2026-40242 | getarcaneapp arcane up to 1.17.2 /api/templates/fetch url server-side request forgery (GHSA-ff24-4prj-gpmj)
- CVE-2026-40252 | labring FastGPT up to 4.14.10.4 access control (GHSA-gc8m-w37w-24hw)
- CVE-2026-40354 | Flatpak xdg-desktop-portal up to 1.20.3/1.21.0 g_file_trash symlink (GHSA-rqr9-jwwf-wxgj)
- CVE-2026-4895 | wpsoul Greenshift Plugin up to 12.8.9 on WordPress HTML Attribute gspb_greenShift_block_script_assets disablelazy HTML injection
- CVE-2026-4979 | stiofansisland UsersWP Plugin up to 1.2.58 on WordPress process_image_crop uwp_crop server-side request forgery (bca-4611-9753)
- CVE-2026-5144 | boonebgorges BuddyPress Groupblog Plugin up to 1.9.3 on WordPress privileges management
- CVE-2026-5207 | chrisbadgett LifterLMS Plugin up to 9.2.1 on WordPress edit_post order sql injection
- CVE-2026-5217 | Optimole Plugin up to 4.2.2 on WordPress REST Endpoint optimizations sanitize_text_field cross site scripting
- CVE-2026-5226 | Optimole Plugin up to 4.2.3 on WordPress get_current_url cross site scripting
- CVE-2026-5483 | Red Hat OpenShift AI Kubernetes Service insertion of sensitive information into sent data (RHSA-2026:7397)
- CVE-2026-5724 | temporal up to 1.28.3/1.29.5/1.30.3 StreamWorkflowReplicationMessages endpoint missing authentication
- CVE-2026-6105 | perfree go-fastdfs-web up to 1.3.7 doInstall Interface InstallController.java improper authorization (IGB6M9)
- CVE-2026-6112 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setRadvdCfg maxRtrAdvInterval os command injection
- CVE-2026-6113 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setTtyServiceCfg ttyEnable os command injection
- CVE-2026-6114 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setNetworkCfg proto os command injection
- CVE-2026-6115 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setAppCfg enable os command injection
- CVE-2026-6116 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setDiagnosisCfg ip os command injection
Vulnerabilities and Threat Research – Qualys Security Blog
- The Mythos Inflection Point: Dealing With the Upcoming Vulnerability Disclosure Avalanche and Compressed Exploitation Window
Wired
- "Uncanny Valley": OpenAI and Musk Fight Again; DOJ Mishandles Voter Data; Artemis II Comes Home
- Anthropic’s Mythos Will Force a Cybersecurity Reckoning—Just Not the One You Think
- Artemis II Returns From Historic Flight Around the Moon
- Home Depot Spring Black Friday (2026): Best Tool and Grill Deals
- How the Internet Broke Everyone’s Bullshit Detectors
- MacBook Neo vs. MacBook Air: Which One Should You Buy?
- Motorola’s Souped-Up Folding Phone Is Almost Half Off
- Suspect Arrested For Allegedly Throwing Molotov Cocktail at Sam Altman's Home
- The Future of the Artemis Program Is Riding on Reentry
- This Clever Bike Bell Can Even Be Heard by People Wearing Noise-Canceling Headphones
- This Startup Wants You to Pay Up to Talk With AI Versions of Human Experts
- Your Push Notifications Aren’t Safe From the FBI
- Zuvi ColorBox Review: A Hair Dye Printer That Struggles
- ‘Crimson Desert’ Is a Cat Dad Simulator
不安全
- Built a Python MITM tool (ARP Spoofing + Sniffer + Nmap)
- Free cybersecurity learning paths + challenges — built this for people breaking into the industry
- I need help with finding active websites on the deepweb
- Open-source cross-modal and multimodal prompt injection test suite. 38,000+ attack payloads across text, image, document, and audio modalities. Research-backed by OWASP LLM Top 10, CrossInject (ACM MM 2025), FigStep (AAAI 2025), DolphinAttack, and CSA 2026.
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
奇客Solidot–传递最新科技情报
- 在 Firefox 浏览器上安装“所有”扩展会发生什么
- 阿根廷企鹅国度发现 PFAS
安全客
- 鸿蒙NEXT应用一键加固——AI Agent助力安全开发
爱范儿
- 早报｜「龙虾之父」Claude账号被封又解封/华为Pura 90定档4月20日/AI能力将成教师「必考项」
量子位 QbitAI
- 刘壮陈丹琦新作：开源通用视觉推理RL框架，0思考数据刷新SOTA
黑海洋
- CoreWeave宣布与Anthropic达成多年协议
- 中国官方约谈7家涉火车票销售第三方平台
- 便携式龙虾🦞：VH-Claw U 盘版开源发布
- 超越OpenClaw！Hermes Agent一键脚本发布：会成长的AI智能体