安全资讯归档（2026-04-14）

2Libra
- AI 编程是不是一个骗局呢
- chatGPT codex 500 刀，试下服务器压力，给我站起来瞪，没有的话补额度
- Kimi K2.6 code preview 现已上线
- notion + obsidian 双修方案讨论
- Surge
- Surge 续集
- webstorm 多窗口合并
- 《骇人来电》点评：9 分｜没有真人表演，通过对话台词、声波画面等完成的作品，时空错乱的设定，剧情前后还圆上了，很出色，不长 9 集，每集 10 分钟左右，值得看。
- 【投票】预言家们出来，微信聊天记录导出工具 wechat-cli 关停了
- 【本日羊毛】发一些羊毛供大家薅
- 【🔒】一款适用于 macOS Tahoe 的透明化磁盘清理工具
- 【🔒】分享一个大模型公益站
- 光鸭云盘内测 VIP 中奖名单公布！冲鸭 🦆
- 写了个测试修为的网站，看看各位是前辈还是蝼蚁
- 国产主流杀毒软件内核驱动曝高危漏洞
- 在番茄上上架了一本小说
- 墨雪飘影文件床上线了，支持 2Libra 用户直接使用
- 大家推荐一款好用的 PC 版的记事本呢。
- 怎么订阅 X 上某位博主发的推
- 想问下本站有 APP 吗
- 捣蛋鬼后遗症，血亏
- 新人报到!
- 有什么 PDF 转换、编辑、拆分的软件推荐吗？
- 有什么耳机适合午休时候不被打呼噜的同事吵醒
- 有没有推荐的骨传导耳机？或者挂脖耳机？蓝牙耳机塞的耳朵疼
- 杨景媛小红书自爆在兰州万达茂 REVAN 女装品牌担任销售服务员，武汉大学法学硕士毕业，在甘肃只能当服务员吗？
- 没有手机号问题解决办法
- 现在支持提交博客收录，你的博客内容现在会聚合在 2Libra 的单独页面上显示
- 符号链接问题
- 经常感到很迷茫
- 网上的 GPT-Plus 10r 直充，还有 team 版本的，哪个更安全？
- 莱恩岛生存指南玩过吗？好不好玩
- 追加 bug 了。。
36氪
- 8点1氪丨“马斯克版微信”将于4月17日上线；美军开始拦截进出霍尔木兹海峡船只；字节与荣耀合作“豆包手机”细节尚未达成一致
- ADP：截至3月28日四周美国私营部门就业人数平均每周增加39250人
- AUM越做越大，利润持续承压：银行零售业务“虚胖”待解
- A股三大指数午间休盘集体上涨，半导体板块走强
- A股三大指数集体收涨，沪指重返4000点上方
- A股三大指数集体高开，协创数据涨超15%
- BP发布首季交易更新：石油交易表现卓越，净债务预计上升
- CREAO AI完成千万美金融资
- LVMH集团第一季度收入下滑6%
- MiniMax Agent桌面端更新：新增Pocket功能，支持接入飞书、微信等
- Omdia：存储成本上涨推升设备价格，2026年中国大陆智能手机市场小幅下滑1%
- OpenRouter上线100B参数匿名模型Elephant Alpha
- Seedance 2.0全面开放API服务
- SK海力士计划将HBM4出货量减少约20%至30%
- SpaceX星链业务2025年营收或增长50%，达到114亿美元
- TCL电子将出售印度电视制造业务？公司回应：不持有该资产
- “蓝点触控”完成超亿元C+轮融资
- 「美股例外」何时休？
- 一季度业绩陆续出炉，多家行业龙头公司亮相
- 上期所：调整黄金等期货相关合约涨跌停板幅度和交易保证金比例
- 上海市浦东新区副区长徐欣：加快把浦东打造成为跨境金融创新高地
- 两市融资余额增加160.13亿元
- 中信建投：公募REITs纳入二级债基投资范围，“固收+”的多资产组合进一步丰富
- 中信建投：受益军工补库/安全备货，持续看好战略金属投资机遇
- 中信建投：当前上市险企估值水平仍有较高安全边际，长期配置价值显著
- 中信建投：当前证券板块估值处于历史低位，上行空间有望进一步打开
- 中信证券：重点推荐所有电子布公司
- 中信证券：金价或有由流动性驱动的反弹机会
- 中信证券：随着尾部产能产量的出清，钢铁行业格局将进一步改善
- 中国人民银行：将开展5000亿买断式逆回购操作，期限为6个月
- 中国汽车流通协会：3月汽车经销商库存系数为1.76，环比下降9.7%
- 乘联分会：3月份皮卡市场销售7万辆，同比增长11.7%
- 亚钾国际澄清：在老挝被限产及股东资产注入传闻不实
- 亚马逊卫星联网项目Leo发布航空天线
- 亚马逊或接近达成收购GlobalStar的交易，以期与Starlink展开竞争
- 亚马逊据悉将以每股90美元收购通信运营商Globalstar
- 人民币兑美元中间价报6.8593
- 光华科技：一季度净利润4114.51万元，同比增长63.19%
- 全球最大零食店“零食王国”将于4月17日开业
- 全球首个自动驾驶移动空间路线4月20日试运营
- 创业板指、深成指双双涨逾1%
- 创业板指涨逾1%
- 创业板指涨逾2%，全市场上涨个股超2900只
- 北京君正：预计计算芯片和存储芯片平均单价均会有所提高
- 千问上线表格Agent：对话直接生成、编辑Excel文件
- 半年融资近2亿，他要用AI发球机器人解决全球1亿人的训练难题｜硬氪专访
- 半日主力资金加仓电子板块，抛售医药生物板块
- 华工科技向港交所递交上市申请
- 华泰证券：具备强品牌力与渠道力的龙头酒企有望率先复苏
- 华泰证券：预计今年全国房价二阶导有望转正，建议逐步布局地产股
- 华谊兄弟电影公司被冻结1亿股权
- 可孚医疗：拟1亿元—2亿元回购股份
- 吉比特：一季度净利同比预增59%-87%
- 吴清会见马来西亚证券委员会主席拿督穆罕默德·法伊兹·阿兹米
- 周大生：部分黄金产品品牌使用费上调至24元/克
- 商业养老金有效账户数超224万户，存量规模超1600亿元
- 商务部、中国进出口银行联合印发通知，加大进出口信贷支持力度
- 国办：优化创新药等新上市药品首发价格机制
- 国办：促进创新药多元支付与价格合理形成
- 国家统计局：4月上旬生猪（外三元）价格环比下降4.2%
- 国开行一季度发放绿色贷款超1500亿元
- 埃夫特：2025年净亏损4.97亿元
- 城发环境：2025年净利润12.36亿元，同比增长8.29%
- 大摩：美股处于调整最后阶段，投资者应准备好增加风险敞口
- 央行今日开展10亿元7天逆回购操作
- 字节跳动在乌兰察布成立科技新公司，注册资本17亿元
- 宁德时代、智元、银河通用联合投资，六维力传感器头部企业「蓝点触控」完成超亿元C+轮融资 | 36氪首发
- 宁德时代港股跌幅扩大至7%
- 宝马集团一季度全球交付量同比下降3.5%
- 家电业部分塑料从进口转向国内供应，上游短缺与下游疲软博弈价格涨幅
- 富国银行一季度营收214.5亿美元，不及预期
- 富国银行披露其私募信贷敞口约为362亿美元
- 对标OpenClaw，微软拟为Copilot开发新功能
- 小米增持墨睿科技公司，后者为石墨烯材料研发商
- 少飞又加价，澳洲航空设法应对燃油成本上涨
- 岚图汽车：东风公司附属公司拟增持至多2.5亿元股份
- 工信部等三部门：要稳妥有序开展智能网联汽车道路测试与示范应用
- 市场对业绩关注度逐渐升温，机构建议布局三大方向
- 常青股份、浩淼科技等在安徽新设股权投资基金
- 强生第一季度销售额240.6亿美元，上调全年销售额预期
- 微软美区官网Surface全线暴涨：旗舰款起售价上调500美元
- 德国汉莎航空飞行员因劳资纠纷罢工两天
- 快看漫画将研发多款AI应用，涉及AI角色互动等
- 恒大集团、恒大地产及许家印案一审开庭
- 恒指午间休盘涨0.43%，恒生科技指数涨0.17%
- 恒指开盘涨1.05%，恒生科技指数涨1.37%
- 恒指收涨0.82%，恒生科技指数涨0.62%
- 我国最大规模科学智能计算集群投入使用
- 报告：欧洲消费者在速卖通的年花费增速达25%
- 招商港口：3月集装箱吞吐量同比增长3.2%
- 摩根大通一季度经调整后营收505.4亿美元
- 政策创新双驱动，国产手术机器人商业化提速
- 新加坡第一季度经济增长放缓
- 新加坡金管局收紧货币政策并上调通胀预期
- 日产发布转型计划：削减20%车型，冲刺中美百万销量
- 日联科技：拟购买上海菲莱测试公司控股权，股票15日起停牌
- 星际荣耀旗下四川航天智能制造公司增资至6亿元
- 最前线 | 远见智存发布HBM3/3e高带宽存储芯片，带宽迈入800GB/s级别
- 有道词典笔A7S正式发布
- 机构今日买入长源东谷等19股，卖出九安医疗4.72亿元
- 机构研判二季度：A股存在结构性机会，聚焦三大核心投资方向
- 机构：近期住房租金阶段性回升
- 李云泽会见美国桥水投资公司创始人瑞·达利欧
- 核微反应堆开发商Nuclea Energy申请美股IPO，拟筹资5000万美元
- 横店东磁：正在积极关注BBU领域并与相关客户接洽中
- 比亚迪回应坪山园区一立体车库火情：为试验及报废车辆专用停放区，火势已扑灭，无人员伤亡
- 氪星晚报｜高德首款具身机器人将亮相；日产发布转型计划：削减20%车型，冲刺中美百万销量；随着战略转向，OpenAI的8520亿美元估值遭投资者质疑
- 汇丰银行在美国推出代币化存款服务
- 沪深两市成交额突破1万亿
- 沪深两市成交额突破5000亿元
- 沪深京三市成交额突破2万亿
- 油价冲击影响显现，通胀制约美联储降息前景
- 海关总署：一季度我国出口机电产品4.34万亿元，同比增长18.3%
- 海关总署：一季度我国能源产品、金属矿砂进口分别增加4.4%和13.2%
- 海关总署：中国3月以美元计价进口同比增长27.8%
- 海关总署：我国进出口总值已连续12季度保持在10万亿元以上
- 海南机场：3月旅客吞吐量552.79万人次，同比增长14.09%
- 深交所将召开深市民企2025年度集体业绩说明会
- 深圳华强：一季度净利润同比预增80%—120%
- 湖南能源集团等在长沙新设先进制造产业基金，出资额50亿元
- 热门中概股美股盘前涨跌互现，百度涨超1%
- 燕京啤酒：2025年净利润16.79亿元，同比增长59.06%
- 现货白银向上触及76美元/盎司
- 现货白银向上触及77美元/盎司
- 现货白银站上77美元/盎司
- 瑞芯微：2025年净利润10.4亿元，同比增长74.82%
- 甘李药业：GZR33注射液Ⅲ期临床试验完成首例受试者给药
- 生数科技与阿里云达成战略合作，Vidu系列模型正式登陆百炼平台
- 甲骨文与Bloom Energy达成电力采购协议，用于其AI数据中心
- 申通快递：2025年净利润13.69亿元，同比增长31.63%
- 申通快递：一季度净利润同比预增60.99%—111.83%
- 电投能源：一季度净利润20.01亿元，同比增长28.35%
- 盛视科技：拟不超11亿元分批采购IT设备及零部件
- 离境退税2.0版措施预计4月底前推出
- 网易互娱架构调整，市场负责人王怡调任海外
- 美团发布AI产品“小团健康管家”
- 美国3月生产者价格指数环比增长0.5%
- 美国电动车商Lucid与Uber扩大合作，获沙特公投基金关联公司新投资
- 美国电动车商Lucid任命新CEO
- 美国联合航空公司首席执行官提出与竞争对手美国航空合并的可能性
- 美国财长贝森特称正在制定要求银行核验公民身份的行政令
- 美联储主席提名人沃什已提交听证会推进前必需的财务披露文件
- 美联储主席提名人选凯文·沃什的参议院听证会或21日举行
- 美股三大指数集体收涨，大型科技股多数走强
- 美股大型科技股盘前普涨，甲骨文涨超5%
- 群核科技结束招股，券商统计获千倍超额认购
- 联想助力理想汽车打造的PPAP文档审核智能体正式发布
- 芭田股份：一季度净利润同比预增46.47%—75.77%
- 芯碁微装：一季度净利润同比预增104.45%至138.53%
- 英伟达否认“洽购大型PC制造商”传闻
- 英搏尔：一季度净利润5674.38万元，同比增长430.8%
- 苹果新款平价电脑MacBook Neo首批产品已售罄，正向供应商鸿海和广达紧急追加大量订单
- 谷歌宣布提供1000万美元资助，支持4万名制造业从业者掌握AI技能
- 资深投资人：AI领域投资逻辑正回归商业本质
- 赣粤高速：3月车辆通行服务收入为3.51亿元
- 越疆完成A股IPO辅导验收
- 鄂尔多斯：2025年净利润23.63亿元，同比增长27.93%
- 锅圈：预计一季度实现营业收入22亿元至23亿元
- 闽发铝业：液冷服务器铝型材开始小批量供货
- 随着战略转向，OpenAI的8520亿美元估值遭投资者质疑
- 雪佛龙通过资产置换巩固委内瑞拉重油业务主导地位
- 雷诺韩国计划到2029年每年推出新车型
- 韩3月ICT出口额超435亿美元创新高
- 韩国3月ICT出口额达435亿美元，同比增长逾一倍
- 韩国人工智能芯片初创公司DeepX准备在韩国进行IPO
- 韩国养老基金允许提高外汇对冲比例以支撑韩元
- 韩国将在周末和节假日为电动汽车充电提供折扣
- 首季增速15%，我国外贸起势有力、开局良好
- 香港拟出台低空经济发展纲领，已对接内地推动跨境低空试飞尽快开展
- 高德将发布首款四足机器人
- 高德红外：2025年净利润6.86亿元，同比扭亏为盈
- 高德首款具身机器人将亮相
404 Media
- Airbnb Hosts Don't Want to Talk to Guests Anymore, Are Outsourcing Messages to AI
- Hacker Compromises a16z-Backed Phone Farm, Tries to Post Memes Calling a16z the ‘Antichrist’
Ars Technica
- Google shoehorned Rust into Pixel 10 modem to make legacy code safer
Ben's Bites
- Big lab leaks
daringfireball.net
- [Sponsor] WorkOS FGA: The Authorization Layer for AI Agents
- Apple Frames 4
- FT: ‘Meta Builds AI Version of Mark Zuckerberg to Interact With Staff’
- John Martellaro, RIP
- MacOS Tip: Enable the Zoom ‘Peek’ Gesture
- Marcin Wichary Visits the Large Scale Systems Museum
- Memory, They Say, Is the First Thing to Go
- Steven Soderbergh Twice Pitched James Bond Projects
- Tahoe Nitpick of the Day: ‘Reduce Transparency’ Makes Layers Harder to See, Not Easier
darkreading
- CSA: CISOs Should Prepare for Post-Mythos Exploit Storm
- Empty Attestations: OT Lacks the Tools for Cryptographic Readiness
Data Breach
- Hackers access Booking.com user data, company secures systems
defend.network
- Daily Threat Briefing – April 14, 2026
EFF
- EFF 🤝 HOPE: Join Us This August!
- Hot Off the Press: EFF's Updated Guide to Tech at the US-Mexico Border
- Speaking Freely: Dr. Jean Linis-Dinco
- The Dangers of California’s Legislation to Censor 3D Printing
ElcomSoft blog
- Low-Level Extraction for iOS 17 and 18
Emergent Minds | paddo.dev
- The AI Scapegoat
Hacker News Frontpage
- An AI Vibe Coding Horror Story
- Ask HN: I quit my job over weaponized robots to start my own venture
- Austerity Creates Fascism
- Can Claude Fly a Plane?
- Claude Mythos: The System Card
- Distributed DuckDB Instance
- Evaluation of Claude Mythos Preview's cyber capabilities
- GitHub Stacked PRs
- Lean proved this program correct; then I found a bug
- NimConf 2026: Dates Announced, Registrations Open
- Shape Grammar
- Show HN: Ithihāsas – a character explorer for Hindu epics, built in a few hours
- TanStack Start Now Support React Server Components
- The Future of Everything Is Lies, I Guess: Safety
- The Looming College-Enrollment Death Spiral
- The Rational Conclusion of Doomerism Is Violence
- Two Months After I Gave an AI $100 and No Instructions
- UpDown: Efficient Manycore based on Many Threading & Scalable Memory Parallelism
HackerNews
- Rockstar Games ĺˆ†ćžć•°ćŽéĺ‹’ç´˘ĺ›˘äź™ćł„éœ˛
- ćŹ§ć´˛ĺĽčşŤĺˇ¨ĺ¤´ Basic-Fit ć•°ćŽćł„éœ˛ďźŒĺ˝ąĺ“ 100 ä¸‡äźšĺ‘˜
HackerNoon
- 5 Things Crypto Whitepapers Don’t Explain Clearly - And You Should Know
ICT Security Magazine
- Gestione del rischio cyber 2026: rilevare l’invisibile per mitigare la superficie di attacco
- Shadow AI, compliance e responsabilità: verso un modello minimo di governance
idiallo.com
- Back button hijacking is going away
IEEE Spectrum
- What It’s Like to Live With an Experimental Brain Implant
InfoSec Write-ups - Medium
- Android Malware Analysis: A Practical Guide for Security Analysts
- Exam Review: Certified Network Security Practitioner (CNSP)
- Exploiting LLM APIs for OS Command Injection (PortSwigger Lab Write-up)
- From Threat Intelligence to Detection: A Practitioner’s Guide
- GraphQL RCE: The Kill Chain to Cloud Identity…!
- How Dark Web Intelligence Helped Me Prioritize High-Value Targets
- I Tricked an AI Into Deleting a User Account (No Direct Access Needed)
- Lian_Yu — TryHackMe Walkthrough
- Master Advanced Netcat Usage for Hackers: Techniques Beyond Reverse Shells
- Rocket — CVE-2021–22911 NoSQL Injection + Ruby cap_setuid to Root | TryHackMe
johndcook.com
- Finding a parabola through two points with given slopes
MIT Technology Review
- The Download: the state of AI, and protecting bears with drones
NetSPI Blog
- Q1 2026 Critical Vulnerability Roundup: Mitigating Risk
pluralistic.net
- Pluralistic: In praise of (some) compartmentalization (14 Apr 2026)
rtl-sdr.com
- BrowSDR: Turn Your HackRF or RTL-SDR Into a Browser-Based Remote WebSDR
SANS Internet Storm Center, InfoCON: green
- ISC Stormcast For Tuesday, April 14th, 2026 https://isc.sans.edu/podcastdetail/9890, (Tue, Apr 14th)
Schneier on Security
- How Hackers Are Thinking About AI
- On Anthropic’s Mythos Preview and Project Glasswing
Security Affairs
- Attackers target unpatched ShowDoc servers via CVE-2025-0520
- Fake Claude AI installer abuses DLL sideloading to deploy PlugX
- U.S. CISA adds Adobe, Fortinet, Microsoft Exchange Server, and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog
- US, UK and Canada disrupt $45M crypto theft in Operation Atlantic
Securityinfo.it
- Donne e cybersecurity: crescono le nuove leve e alcune sfide
Sploitus.com Exploits RSS Feed
- auditor-v1 exploit
- CORScanner exploit
- coruna-exploit-kit-analysis exploit
- enterthevoid exploit
- Exploit for Code Injection in Langflow exploit
- Exploit for CVE-2025-69993 exploit
- Exploit for CVE-2026-34621 exploit
- Exploit for CVE-2026-35517 exploit
- Exploit for CVE-2026-35585 exploit
- Exploit for CVE-2026-39987 exploit
- Exploit for CVE-2026-39987 exploit
- Exploit for CVE-2026-40175 exploit
- Exploit for CVE-2026-6227 exploit
- Exploit for Improper Input Validation in Microsoft exploit
- Exploit for Missing Authentication for Critical Function in Flowiseai Flowise exploit
- Exploit_Development exploit
- jwt-attack-suite exploit
- PoC_n_Dockerfile_4_PentestFinalProject_Group02 exploit
- SENTINELSHIELD-ADVANCED-INTRUSION-DETECTION-WEB-PROTECTION-SYSTEM exploit
- sql-xss exploit
- Vulnerable-Web-App-Scanner exploit
- vulnswarm exploit
- wp-pie-exploit exploit
TechCrunch
- Adobe fixes PDF zero-day security bug that hackers have exploited for months
- Amazon to buy Globalstar for $11.57B in bid to flesh out its satellite biz
- An Amazon warehouse worker died on the job at Oregon facility
- Booking.com confirms hackers accessed customers’ data
- FBI announces takedown of phishing operation that targeted thousands of victims
- Google brings its Gemini Personal Intelligence feature to India
- How vibe coding app Anything is rebuilding after getting booted from the App Store twice
- IBM pays $17M fine to end DOJ suit over DEI programs
- Inertia moves to commercialize one of the world’s most elaborate science experiments
- Instacart acquires Instaleap to expand its enterprise platform internationally
- Lucid Motors names new CEO, lands more money from Uber and Saudis
- Microsoft is officially killing its Outlook Lite app next month
- OpenAI has bought AI personal finance startup Hiro
- Stanford report highlights growing disconnect between AI insiders and everyone else
- Tesla adds ‘streaks,’ other stats to track how often drivers use Full Self-Driving software
- Thousands of rare concert recordings are landing on the Internet Archive — listen now
- Uber and Nuro begin testing premium robotaxi service in San Francisco
The Decoder
- Claude Mythos is a wake-up call for Europe's AI safety apparatus
- Google now offers Ultra subscribers video generation with Veo 3.1 Lite at no extra credit cost
- New AI model generates 45-minute lip-synced video from one photo and runs in real time
- OpenAI acquires AI finance startup Hiro, which built a "personal AI CFO"
- OpenAI's leaked memo says new "Spud" model will make all its products "significantly better"
- Stanford's AI Index 2026 shows rapid progress, growing safety concerns, and declining public trust
The Verge
- A sleek, wearable airbag for cyclists is nearly here
- AI influencers are ‘everywhere’ at Coachella
- Alienware’s new gaming monitor offers a 240Hz QD-OLED panel for just $350
- Anbernic’s new handheld is a pocket-friendly Android device with a swiveling screen
- Apple and Amazon are teaming up to challenge Starlink’s smartphone ambitions
- Ben McKenzie vs. crypto
- Bloodborne is being turned into an R-rated animated film
- Ecovacs’ new robovac spots and pretreats dried stains using powerful jets
- GoPro goes bigger and pro-er with support for Micro Four Thirds lenses
- Has Google’s AI watermarking system been reverse-engineered?
- Justin Bieber’s YouTube Coachella set had nothing to do with who owns his music
- Lucid sells more robotaxis to Uber, appoints a new CEO
- NZXT to pay $3.45 million settlement over Flex PC rentals
- RAMageddon has come for Microsoft’s Surface Pro and Surface Laptop
- Read OpenAI’s latest internal memo about beating the competition — including Anthropic
- Samsung is hiking the prices of its Galaxy phones and tablets
- The heist of iOS 26
- The Mercedes EQS returns with massive range and charging gains
- The new Trump Phone design is here
- Xbox Game Pass ‘has become too expensive,’ says Microsoft’s new gaming chief in leaked memo
- You can make a multicolor MacBook Neo out of Apple’s spare parts
troyhunt.com
- Weekly Update 499
VulDB Recent Entries
- CVE-2025-13822 | MCPHub up to 0.10.x Endpoint authorization
- CVE-2025-31991 | HCL DevOps Velocity up to 5.1.6 excessive authentication (KB0130138)
- CVE-2025-3756 | ABB AC800M IEC 61850 Communication Stack improper validation of specified quantity in input
- CVE-2025-40745 | Siemens Software Center Analytics Service Endpoint certificate validation (ssa-981622)
- CVE-2025-61260 | OpenAI Codex CLI up to 0.23.0 Model Context Protocol Configuration File codex/config.toml privilege escalation
- CVE-2025-63743 | Snipe-IT Web-based Asset Management System 8.3.0/8.3.1 Display Name Name/Surname cross site scripting
- CVE-2025-66769 | Nitro PDF Pro 14.41.1.4 on Windows XFA null pointer dereference
- CVE-2025-69624 | Nitro PDF Pro up to 14.41.1.4 on Windows app.alert null pointer dereference
- CVE-2025-69627 | Nitro PDF Pro 14.41.1.4 on Windows this.mailDoc use after free
- CVE-2025-70936 | vTiger CRM 8.4.0 MailManager _folder cross site scripting
- CVE-2026-22562 | Ubiquiti UniFi Play PowerAmp/UniFi Play Audio Port path traversal
- CVE-2026-2332 | Eclipse Jetty up to 9.4.59/10.0.27/11.0.27/12.0.32/12.1.6 Double Quote request smuggling
- CVE-2026-23891 | Decidim up to 0.30.4/0.31.0 Name cross site scripting (GHSA-fc46-r95f-hq7g)
- CVE-2026-24032 | Siemens SINEC NMS up to 4.0 SP2 UMC signature verification (ssa-801704)
- CVE-2026-24069 | Kiuwan SAST prior 2.8.2509.4 User Account authorization
- CVE-2026-2449 | upKeeper Instant Privilege Access up to 1.5.0 argument injection
- CVE-2026-2450 | upKeeper Instant Privilege Access up to 1.5.0 impersonation
- CVE-2026-25654 | Siemens SINEC NMS up to 4.0 SP2 Password Reset authorization (ssa-605717)
- CVE-2026-2582 | vendidero Germanized for WooCommerce Plugin up to 3.20.5 on WordPress Shortcode account_holder code injection
- CVE-2026-27668 | Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary up to 5.7 Device Group privileges assignment (ssa-741509)
- CVE-2026-27674 | SAP NetWeaver Application Server Java 7.50 code injection
- CVE-2026-28291 | steveukx git-js up to 3.31.x os command injection (GHSA-jcxm-m3jx-f287)
- CVE-2026-29955 | KubePlus 4.14 kubeconfiggenerator /registercrd subprocess.Popen chartName command injection
- CVE-2026-30480 | LibreNMS 22.11.0-23-gd091788f2 NFSen nfsen.inc.php nfsen path traversal
- CVE-2026-30804 | Artica Pandora FMS up to 800 unrestricted upload
- CVE-2026-30806 | Artica Pandora FMS up to 800 os command injection
- CVE-2026-30809 | Artica Pandora FMS up to 800 WebServerModuleDebug os command injection
- CVE-2026-30811 | Artica Pandora FMS up to 800 Configuration Endpoint default permission
- CVE-2026-30812 | Artica Pandora FMS up to 800 cross site scripting
- CVE-2026-30813 | Artica Pandora FMS up to 800 sql injection
- CVE-2026-31048 | Pyro 3.x Pickled privilege escalation
- CVE-2026-31908 | Apache APISIX up to 3.15.0 Forward Auth Plugin injection
- CVE-2026-31923 | Apache APISIX up to 3.14.x Openid-connect tls_verify cleartext transmission
- CVE-2026-31924 | Apache APISIX up to 3.14.x tencent-cloud-cls cleartext transmission
- CVE-2026-32270 | Craft CMS up to 4.10.2/5.5.4 actionPay email/shipping address/billing address information disclosure (GHSA-3vxg-x5f8-f5qf)
- CVE-2026-32316 | jqlang jq up to 1.8.1 jvp_string_append/jvp_string_copy_replace_bad heap-based overflow (GHSA-q3h9-m34w-h76f)
- CVE-2026-32605 | nimiq core-rs-albatross up to 1.2.x validators.num_validators out-of-bounds
- CVE-2026-33555 | HAProxy up to 3.3.5 HTTP3 Parser length parameter
- CVE-2026-33892 | Siemens Industrial Edge Management Pro V1 up to 2.7.x authentication bypass (ssa-609469)
- CVE-2026-33929 | Apache PDFBox Examples up to 2.0.36/3.0.7 ExtractEmbeddedFiles path traversal
- CVE-2026-33947 | jqlang jq up to 1.8.1 src/jv_aux.c jv_setpath/jv_getpath/delpaths_sorted path recursion (GHSA-xwrw-4f8h-rjvg)
- CVE-2026-34186 | Artica Pandora FMS up to 800 Custom Fields sql injection
- CVE-2026-34188 | Artica Pandora FMS up to 800 os command injection
- CVE-2026-34257 | SAP NetWeaver Application Server ABAP up to 816 redirect
- CVE-2026-34262 | SAP HANA Cockpit/HANA Database Explorer SAP_HANA_COCKPIT 2.0 insufficiently protected credentials
- CVE-2026-36937 | SourceCodester Online Resort Management System 1.0 view_details.php sql injection
- CVE-2026-36938 | SourceCodester Online Resort Management System 1.0 view_room.php sql injection
- CVE-2026-36948 | SourceCodester Online Thesis Archiving System 1.0 /otas/view_archive.php sql injection
- CVE-2026-36950 | SourceCodester Online Thesis Archiving System 1.0 projects_per_department.php sql injection
- CVE-2026-36952 | SourceCodester Online Thesis Archiving System 1.0 manage_curriculum.php sql injection
- CVE-2026-37589 | SourceCodester Storage Unit Rental Management System 1.0 manage_storage_unit.php sql injection
- CVE-2026-37590 | SourceCodester Storage Unit Rental Management System 1.0 manage_rent.php sql injection
- CVE-2026-37591 | Sourcecodester Storage Unit Rental Management System 1.0 view_details.php sql injection
- CVE-2026-37592 | SourceCodester Storage Unit Rental Management System 1.0 manage_pricing.php sql injection
- CVE-2026-37593 | SourceCodester Online Employees Work from Home Attendance System 1.0 view_att.php sql injection
- CVE-2026-37594 | SourceCodester Online Employees Work from Home Attendance System 1.0 view_employee.php sql injection
- CVE-2026-37595 | SourceCodester Online Employees Work from Home Attendance System 1.0 manage_employee.php sql injection
- CVE-2026-37596 | SourceCodester Online Employees Work from Home Attendance System 1.0 manage_department.php sql injection
- CVE-2026-37597 | SourceCodester Online Employees Work from Home Attendance System 1.0 attendance_list.php sql injection
- CVE-2026-37598 | SourceCodester Patient Appointment Scheduler System 1.0 SystemSettings.php?f=update_settings privilege escalation
- CVE-2026-37600 | SourceCodester Patient Appointment Scheduler System 1.0 view_details.php sql injection
- CVE-2026-37601 | SourceCodester Patient Appointment Scheduler System 1.0 manage_appointment.php. sql injection
- CVE-2026-37602 | SourceCodester Patient Appointment Scheduler System 1.0 manage_user.php sql injection
- CVE-2026-39417 | 1Panel-dev MaxKB up to 2.7.x Workflow Creation API mcp_servers behavioral workflow (GHSA-pw52-326g-r5xj)
- CVE-2026-39418 | 1Panel-dev MaxKB up to 2.7.x socket.sendto server-side request forgery (GHSA-w9g4-q3gm-6q6w)
- CVE-2026-39419 | 1Panel-dev MaxKB up to 2.7.x Service injection (GHSA-f3c8-p474-xwfv)
- CVE-2026-39420 | 1Panel-dev MaxKB up to 2.7.x Tool Debug API sandbox.so LD_PRELOAD protection mechanism (GHSA-7wgv-v2r3-7f7w)
- CVE-2026-39421 | 1Panel-dev MaxKB up to 2.7.x ToolExecutor sandbox.so LD_PRELOAD protection mechanism (GHSA-9c6w-j7w5-3gf7)
- CVE-2026-39422 | 1Panel-dev MaxKB up to 2.7.x Public Chat Interface /ui/chat/ name/icon cross site scripting (GHSA-wf7p-3jq5-q52w)
- CVE-2026-39423 | 1Panel-dev MaxKB up to 2.7.x AI Chat Interface cross site scripting (GHSA-462x-99gf-mp79)
- CVE-2026-39425 | 1Panel-dev MaxKB up to 2.7.x Chatbot Interface /admin/api/workspace/ prologue cross site scripting (GHSA-3rq5-pgm7-pvp4)
- CVE-2026-39426 | 1Panel-dev MaxKB up to 2.7.x cross site scripting (GHSA-q2qg-43vq-f2wv)
- CVE-2026-39940 | ChurchCRM up to 6.x DonatedItemEditor.php redirect (GHSA-5g52-rvjf-6wwf)
- CVE-2026-39979 | jqlang jq jv_parse_sized length out-of-bounds (GHSA-2hhh-px8h-355p)
- CVE-2026-39984 | sigstore timestamp-authority up to 2.0.5 certificate validation
- CVE-2026-40038 | Pachno 1.0.6 getParameter cross site scripting (ZSL-2026-5980)
- CVE-2026-40039 | Pachno 1.0.6 return_to authentication bypass (ZSL-2026-5981)
- CVE-2026-40040 | Pachno 1.0.6 /uploadfile unrestricted upload (ZSL-2026-5982)
- CVE-2026-40041 | Pachno 1.0.6 cross-site request forgery (ZSL-2026-5983)
- CVE-2026-40042 | Pachno 1.0.6 XML Parser simplexml_load_string file descriptor (ZSL-2026-5984)
- CVE-2026-40043 | Pachno 1.0.6 runSwitchUser authorization (ZSL-2026-5985)
- CVE-2026-40044 | Pachno 1.0.6 deserialization (ZSL-2026-5986)
- CVE-2026-40164 | jqlang jq JSON Object Hash Table weak hash (GHSA-wwj8-gxm6-jc29)
- CVE-2026-40287 | MervinPraison PraisonAI/praisonaiagents up to 4.5.138 tools.py import_tools_from_file code injection (GHSA-g985-wjh9-qxxc)
- CVE-2026-40288 | MervinPraison PraisonAI/praisonaiagents YAML File Parser job_workflow.py subprocess.run os command injection (GHSA-vc46-vw85-3wvm)
- CVE-2026-40289 | MervinPraison PraisonAI/praisonaiagents WebSocket Endpoint /ws missing authentication (GHSA-8x8f-54wf-vv92)
- CVE-2026-4109 | arraytics Eventin Plugin up to 4.1.8 on WordPress get_item_permissions_check authorization
- CVE-2026-4344 | Autodesk Fusion up to 2702.1.46 component name cross site scripting
- CVE-2026-4345 | Autodesk Fusion up to 2702.1.46 cross site scripting
- CVE-2026-4369 | Autodesk Fusion up to 2702.1.46 cross site scripting
- CVE-2026-4913 | Ivanti Neurons for ITSM up to 2025.3 improper protection of alternate path
- CVE-2026-4914 | Ivanti Neurons for ITSM up to 2025.3 cross site scripting
- CVE-2026-6100 | Python CPython up to 3.14.x Decompression Call use after free (ID 148395)
- CVE-2026-6227 | wp_media BackWPup Plugin up to 5.6.6 on WordPress REST Endpoint getblock str_replace block_name path traversal
- CVE-2026-6231 | MongoDB C Driver up to 1.30.4/2.0.1 bson_validate input validation
Wired
- $20 Chewy Promo Code | April 2026
- 30% Off Samsung Promo Code | April 2026
- 50% Off DoorDash Promo Code | April 2026
- A New Horror Movie Depicts Realistic Snuff. That’s Not the Most Disturbing Thing About It
- Bremont Is Sending a Watch to the Moon’s Surface
- Government Workers Say They're Getting Inundated With Religion
- Marine Animals in the Strait of Hormuz Don’t Get a Ceasefire
- Medicube Coupon Code: 40% Off for April 2026
- Meta Is Warned That Facial Recognition Glasses Will Arm Sexual Predators
- Silicon Valley Is Spending Millions to Stop One of Its Own
- Staunch Trump Supporters Are Now Asking If He’s the Antichrist
- The 23 Best iPhone 17 Cases and Accessories Out of More Than 100 (2026)
- The Best Mattresses for Stomach Sleepers, According to a Sleep Science Coach (2026)
- The Best Streaming Bundles and Streaming Deals of April 2026
- The Fanfare Around the Band Geese Actually Was a Psyop
- The Gamblers Behind One of Chess's Weirdest Unsolved Cheating Mysteries Have Been Unmasked
- The Moms Who Sponcon Their Daughters’ First Periods
- The Most WIRED Watches at Watches and Wonders 2026
- Top iRestore Deals for Hair Growth and LED Therapy Devices
- What’s in Hasan Piker’s Starter Pack? Creatine, Zyns, Signal
- Why You Should Consider a Coros Watch Instead of a Garmin (2026)
- You Can Soon Buy a $4,370 Humanoid Robot on AliExpress
不安全
- 108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users
- Built a Telegram scam honeypot bot for detection research — looking for feedback/testers
- Dumb question. Is it possible to find someone IP address from their game ign or uid?
- 亚马逊接近达成收购GlobalStar的交易
- 微软在Windows 11更新中增加手选日期不再强制自动更新系统
- 欧盟拟加增钢铁关税防堵中国廉价钢冲击
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
爱范儿
- 年轻与豪华兼得，12.99 万元起的奇瑞风云 T9L ，是真正的家用「六边形战士」
- 数字排毒，我们这代人的赎罪券｜硬哲学
- 早报｜iOS 26.5 Beta 2曝光地图广告机制/华为公布大阔折叠外观/不到两天，奥特曼住所再遭袭击
量子位 QbitAI
- AI开始直接交付Excel，千问用Agent重构做表流程
- 不只是卖服务器，中兴通讯想做AI时代的基础设施商
- 荣耀PC家族大爆发！荣耀“打洲本”“养虾本”集中亮相
黑海洋
- 亚马逊拟收购全球星并继续为苹果提供服务
- 亚马逊接近达成收购GlobalStar的交易
- 欧盟拟加增钢铁关税防堵中国廉价钢冲击
- 比亚迪试验及报废车辆专用停放区发生火灾
- 金山毒霸与360安全卫士内核驱动曝高危漏洞