安全资讯归档（2026-04-12）

2Libra
- AI 厂家为啥不弄类似公钥私钥呢
- m2 用户请谨慎升级 26.4
- PureMac：一款免费开源的 CleanMyMac 平替
- trae solo 模式真不错
- XChat 将于 4 月 17 日正式上线，现在已开放下载预约
- 一些不安全的软件和硬件
- 夸克网盘大规模清理海外剧资源，相关内容陆续下架删除
- 建议优化 @echo 帖子标题
- 种种迹象显示苹果准备推出 M5 芯片版 Mac mini / Mac Studio。但从目前的行情来看，全球内存芯片短缺潮影响了供货，都说库克是“库存克星”，显然是库存没有管理好，是另一种失职。
- 请尊重其他社区，注册完一发帖就是伸手
- 谁不希望自己的手机里“住”着一个贾维斯呢 😍， Gemma 4 入住手机攻略
- 这几天的天气好到不想被辜负。看看你那里的天空。
- 阿里的 coding plan lite 版本居然连续费和升级都关闭了，这是什么情况
36氪
- 上海二手房单日成交1632套：连续打破5年峰值纪录高端房源成交占比提升
- 中央台办受权发布十项促进两岸交流合作的政策措施
- 中老铁路国际旅客列车发送跨境旅客超80万人次
- 乘联分会崔东树：预计2026年汽车总批发量3480万辆同比增长1%
- 俄罗斯黑海沿岸区域超130只海豚死亡
- 元戎启行CEO周光：解决小模型的“跷跷板效应”，必须转向大模型范式
- 台风“森拉克”已加强为强台风级逐渐靠近美国关岛附近
- 启明星辰：第一季度净利润同比预增2279.31%—3281.13%
- 宇树科技宣布人形机器人跑出10米/秒，逼近人类巅峰水平
- 崔东树：建议购车支出纳入个税专项抵扣
- 我国复用航天器关键部件研制成功
- 我国超87%留学人员选择回国发展
- 新渝万高铁正线56座隧道全部贯通
- 新版“海南省智能网联汽车管理办法”拟4、5月发布
- 新西兰联储主席：将宣布提高货币政策决策透明度
- 日本3月机床订单额增长28% 海外订单增40%
- 星元晶算发布1nm芯片路线图
- 柬埔寨扶南德佐综合水利项目举行第二阶段开工仪式
- 欧盟航空燃油三周后或系统性短缺
- 海南自贸港全球产业招商大会低空经济专场将于14日举办
- 深圳邮轮母港一季度迎客110万人次同比增长6%
- 特斯拉受监督版全自动驾驶系统获准在荷兰使用
- 特朗普政府将打击赴美生子
- 粤桂股份：第一季度净利润同比预增67.72%—98.53%
- 联合国环境署呼吁推动航天活动可持续发展
- 自然资源部：一季度我国办理不动产“带押过户”9万笔
- 荣耀机器人“闪电”“元气仔”出征北京亦庄马拉松
- 菲律宾要求Facebook遏制虚假信息，并警告或将采取法律行动
- 超七成日本人担心汽油短缺
- 轻舟智航于骞：智能汽车的AI能力已完成三次关键进化，2026年迈入超人智能的新阶段
- 长城汽车佘士东：当前智能座舱界面高度同质化，200多款车型相似度达95%以上
- 长药退：公司股票将在4月13日被摘牌
- 马斯克：Grok要达到甚至超越Claude Opus 4.6的水平，需要等到六月
Ars Technica
- Shock from Iran war has Trump's vision for US energy dominance flailing
daringfireball.net
- Pan American Luggage Labels
defend.network
- Daily Threat Briefing – April 12, 2026
Hacker News Frontpage
- AI Job Loss Tracker
- AI Will Be Met with Violence, and Nothing Good Will Come of It
- Americans still opt for print books over digital or audio versions
- Apple update looks like Czech mate for locked-out iPhone user
- How to build a Git diff driver
- How We Broke Top AI Agent Benchmarks: And What Comes Next
- Pope Leo XIV denounces the 'delusion of omnipotence' he says fuels the Iran war
- Pro Max 5x Quota Exhausted in 1.5 Hours Despite Moderate Usage
- Seven countries now generate 100% of their electricity from renewable energy
- Tell HN: OpenAI silently removed Study Mode from ChatGPT
- US appeals court declares 158-year-old home distilling ban unconstitutional
- We spoke to the man making viral Lego-style AI videos for Iran
- Why weekends are under threat
HackerNoon
- Architecture for Compliance Scaling Microservices with DDD for High Volume Global Enterprise Systems
- How to Evaluate an AI Persona: Beyond Benchmarks and Vibes
- Meet the Writer: Hacker Noon's Contributor Pavel Manovich, Founder & Product Builder
- Resident Evil Star Milla Jovovich Shipped an AI Memory System. Devs Shredded Its Benchmarks
- When AI Becomes the Voice You Think With
ICT Security Magazine
- APT31 spiava la Russia: cyber spionaggio cinese infiltrato nel tech russo per anni
InfoSec Write-ups - Medium
- App using Cognito for SSO? Use this Methodology to find High Severity Issues
- Binary Heaven — Reverse Engineering Go Binaries, ret2libc Buffer Overflow, and PATH Hijack to Root…
- CVE-2026-21876 — Root cause, Reproduction, Impact and Lessons Learned
- Deception Scenario How Inverted Social Engineering is Redefining the Web3 Recruitment Trap
- OT Reconnaissance with Wireshark and GrassMarlin
- The Accidental Open Source: What Claude Code’s Leaked Source Code Tells Us About the Future of AI…
- Thick Client Pentest for Kiddos
- ThreatLens: Automating IoC Detection Directly in Your Browser
joanwestenberg.com
- Optimism is not a personality flaw
johndcook.com
- The gap between Eastern and Western Easter
Recent Commits to cve:main
- Update Sun Apr 12 11:18:45 UTC 2026
Security Affairs
- Censys finds 5,219 devices exposed to attacks by Iranian APTs, majority in U.S.
- GlassWorm evolves with Zig dropper to infect multiple developer tools
- Hackers claim control over Venice San Marco anti-flood pumps
- SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 92
- Security Affairs newsletter Round 572 by Pierluigi Paganini – INTERNATIONAL EDITION
simonwillison.net
- SQLite 3.53.0
- SQLite Query Result Formatter Demo
Sploitus.com Exploits RSS Feed
- Dir-Listing-Auto-Exploit exploit
- Exploit for Code Injection in Ejs exploit
- Exploit for Cross-site Scripting in Churchcrm exploit
- Exploit for Cross-site Scripting in Devcode Openstamanager exploit
- Exploit for Cross-site Scripting in Pw Omega-Psir exploit
- Exploit for Cross-site Scripting in Saleor exploit
- Exploit for CVE-2025-66024 exploit
- Exploit for CVE-2026-40175 exploit
- Exploit for CVE-2026-4106 exploit
- Exploit for Deserialization of Untrusted Data in Roundcube Webmail exploit
- Exploit for Improper Authorization in Wbce Wbce_Cms exploit
- Exploit for Improper Neutralization of Special Elements in Data Query Logic in Facturascripts exploit
- Exploit for OS Command Injection in Devcode Openstamanager exploit
- Exploit for Path Traversal in Gogs exploit
- Exploit for Path Traversal in Gogs exploit
- Exploit for Path Traversal in Redaxo exploit
- Exploit for SQL Injection in Churchcrm exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Devcode Openstamanager exploit
- Exploit for SQL Injection in Egroupware exploit
- Exploit for SQL Injection in Facturascripts exploit
- Exploit for SQL Injection in Wbce Wbce_Cms exploit
- Exploit for Use After Free in Haxx Curl exploit
- neocorp-ctf-backend exploit
- pentest-autopilot-mcps exploit
- vulnscanx exploit
- Webite-Security-Scanner exploit
TechCrunch
- AMC will stream ‘The Audacity’ premiere in 21 parts on TikTok
- At the HumanX conference, everyone was talking about Claude
- Kalshi wins temporary pause in Arizona criminal case
- Sam Altman responds to ‘incendiary’ New Yorker article after attack on his home
- Slate Auto: Everything you need to know about the Bezos-backed EV startup
- Walmart-owned Flipkart, Amazon are squeezing India’s quick commerce startups
The Decoder
- Agent skills look great in benchmarks but fall apart under realistic conditions, researchers find
- Anthropic seeks advice from Christian leaders on Claude's moral and spiritual behavior
- Arcee AI spent half its venture capital to build an open reasoning model that rivals Claude Opus in agent tasks
- Molotov suspect who attacked Sam Altman's home was likely a Pause AI follower with AI extinction fears
- OpenAI employee tries to explain usage limits of the new ChatGPT Pro plans
- Researchers define what counts as a world model and text-to-video generators do not
- Stalking victim sues OpenAI claiming ChatGPT fueled her ex-partner’s delusions
The Verge
- Allow me to explain why I love this camera that can’t shoot color
- The AI code wars are heating up
- The Netherlands is the first European country to approve Tesla’s supervised Full Self-Driving
- You can grab a refurbished 2021 Kindle Paperwhite starting at just $49.99
VulDB Recent Entries
- CVE-2019-25697 | VictorAlagwu CMSsite 1.0 GET Request category.php cat_id sql injection (Exploit 46259 / EDB-46259)
- CVE-2019-25703 | ImpressCMS 1.3.11 POST Request admin.php bid sql injection (Exploit 46239 / EDB-46239)
- CVE-2019-25707 | eBrigade ERP 4.5 pdf.php ID sql injection (Exploit 46117 / EDB-46117)
- CVE-2019-25710 | Dolibarr ERP-CRM 8.0.4 POST Parameter dict.php rowid sql injection (Exploit 46095 / EDB-46095)
- CVE-2026-1116 | parisneo lollms up to 2.1.x AppLollmsMessage from_dict content cross site scripting
- CVE-2026-31413 | Linux Kernel up to 6.12.79/6.18.20/6.19.10/7.0-rc1/7.0-rc4 bpf maybe_fork_scalars runtime out-of-bounds
- CVE-2026-31845 | Rukovoditel CRM up to 3.6/3.6.4 API Endpoint /api/tel/zadarma.php zd_echo cross site scripting
- CVE-2026-6120 | Tenda F451 1.0.0.7 httpd /goform/DhcpListClient fromDhcpListClient page stack-based overflow
- CVE-2026-6121 | Tenda F451 1.0.0.7 httpd /goform/WrlclientSet GO stack-based overflow
- CVE-2026-6122 | Tenda F451 1.0.0.7 httpd /goform/L7Prot frmL7ProtForm page stack-based overflow
- CVE-2026-6123 | Tenda F451 1.0.0.7 httpd /goform/addressNat fromAddressNat entrys stack-based overflow
- CVE-2026-6124 | Tenda F451 1.0.0.7 httpd /goform/SafeMacFilter fromSafeMacFilter page/menufacturer stack-based overflow
- CVE-2026-6125 | Dromara warm-flow up to 1.8.4 Workflow Definition /warm-flow/save-json SpelHelper.parseExpression listenerPath/skipCondition/permissionFlag code injection (IHURVQ)
- CVE-2026-6126 | zhayujie chatgpt-on-wechat CowAgent 2.0.4 Administrative HTTP Endpoint missing authentication (Issue 2733)
- CVE-2026-6129 | zhayujie chatgpt-on-wechat CowAgent up to 2.0.4 Agent Mode Service missing authentication (Issue 2741)
- CVE-2026-6130 | chatboxai chatbox up to 1.20.0 Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport args/env os command injection (Issue 3627)
- CVE-2026-6131 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setTracerouteCfg command os command injection
- CVE-2026-6132 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setLedCfg enable os command injection
- CVE-2026-6133 | Tenda F451 1.0.0.7_cn_svn7958 /goform/SafeUrlFilter fromSafeUrlFilter page stack-based overflow
- CVE-2026-6134 | Tenda F451 1.0.0.7_cn_svn7958 /goform/qossetting fromqossetting qos stack-based overflow
- CVE-2026-6135 | Tenda F451 1.0.0.7_cn_svn7958 /goform/SetIpBind fromSetIpBind page stack-based overflow
- CVE-2026-6136 | Tenda F451 1.0.0.7_cn_svn7958 /goform/L7Im frmL7ImForm page stack-based overflow
- CVE-2026-6137 | Tenda F451 1.0.0.7_cn_svn7958 /goform/AdvSetWan fromAdvSetWan wanmode/PPPOEPassword stack-based overflow
- CVE-2026-6138 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi setAccessDeviceCfg mac os command injection
- CVE-2026-6139 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi UploadOpenVpnCert FileName os command injection
- CVE-2026-6140 | Totolink A7100RU 7.4cu.2313_b20191024 CGI /cgi-bin/cstecgi.cgi UploadFirmwareFile FileName os command injection
Wired
- Best 2-in-1 Laptops (2026): Microsoft, Lenovo, and the iPad
- The 3 Best Mug Warmers of 2026: Better Than the Ember Mug?
- The Screen Time Maximalists Who Spend an Ungodly Amount of Time on Their Phones
- There’s a Secret Ingredient to Making Luxury Ice at Home
- Why Is It So Hard to Fix an Electric Bike? (2026)
- ‘The Audacity’ Is the Broligarchy Takedown You Were Waiting For
不安全
- App using Cognito for SSO? Use this Methodology to find High Severity Issues
- App using Cognito for SSO? Use this Methodology to find High Severity Issues
- Binary Heaven — Reverse Engineering Go Binaries, ret2libc Buffer Overflow, and PATH Hijack to Root…
- CPUID 网站下载链接被劫持传播恶意程序
- CVE-2026-21876 — Root cause, Reproduction, Impact and Lessons Learned
- Dandelion Honey
- Deception Scenario How Inverted Social Engineering is Redefining the Web3 Recruitment Trap
- Happy Easter
- OT Reconnaissance with Wireshark and GrassMarlin
- The Accidental Open Source: What Claude Code’s Leaked Source Code Tells Us About the Future of AI…
- Thick Client Pentest for Kiddos
- ThreatLens: Automating IoC Detection Directly in Your Browser
- Try it
- 大量顶尖科研人才正回流中国
- 逾八成欧洲人不信任美国和中国科技公司
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
奇客Solidot–传递最新科技情报
- CPUID 网站下载链接被劫持传播恶意程序
爱范儿
- DeepSeek，该卸下扫地僧的枷锁了
黑海洋
- IPv6 一键开关 - Windows IPv6 管理工具
- OpenAI指控马斯克搞法律突袭扰乱诉讼
- 大量顶尖科研人才正回流中国
- 逾八成欧洲人不信任美国和中国科技公司