安全资讯归档（2026-04-15）

2Libra
- Firefox 免费提供 VPN，每月 50G 流量，启用方法
- 【💰】俺的幸运儿呢？
- 【💰】大圆满之境
- 【💰】我承认我有赌的成分
- 【💰】聊聊“平替”这事儿，我是真上头，你有啥好物平替吗？
- 【💰】请教中年人可以干什么工作?
- 【🔒】【💰】金币我的金币
- 不写代码还能干啥？
- 五一昆明有什么玩的
- 你站挂了，diudiuu
- 发现了个小优化点
- 外包太难听了，有没有什么好听一点的名称。
- 徽章怎么获取？有商城之类的吗？
- 快讯，天才程序员要实名制了
- 支持 2Libra 登录的网站
- 新版本页面布局调整为常驻 3 栏布局
- 是不是人的审美水平倒退了
- 生命的中点其实是 18 岁，愿你我活的全程无尿点
- 突然发现土区的 gpt plus 只要不到八十块钱
- 签到获得一个金币(可怜.jpg)
- 随机发送 L 站邀请码
36氪
- 13家上市银行金融科技投入超1800亿元，大模型应用规模化落地
- 2026年以来消费品以旧换新销售额突破5000亿元
- 361度：主品牌产品第一季度零售额同比录得约10%正增长
- 3月韩国汽车出口额为63.7亿美元，同比增长2.2%
- A股三大指数午间休盘涨跌不一，沐曦股份涨超13%
- A股三大指数收盘涨跌不一
- A股三大指数集体高开，创业板指高开1.06%创10年新高
- CoreWeave与Jane Street签署60亿美元AI云计算协议
- CPO概念延续强势华盛昌12天6板续创历史新高
- ETF资金流向分化，公募策略趋于多元
- IBM宣布推出新的网络安全措施，以帮助企业应对“智能体攻击”
- IDC：2026年第一季度全球智能手机出货量下降4.1%
- IMF下调2026年世界经济增长预期
- KKR将通过购买可转换债券向三星SDS投资8.2亿美元
- OLED版iPad Air或明年推出
- OpenAI向部分用户发布Cyber模型，与Mythos展开竞争
- OpenAI推出旨在增强网络安全能力的迭代模型
- Snap宣布将裁员约1000人
- Stellantis第一季度合并出货量为140万台，同比增长12%
- 蓝思科技：一季度净利润亏损1.5亿元，同比转亏
- “智象未来”完成超5亿元新一轮融资
- “源升智能”完成上亿元Pre-A轮融资
- “达美盛（DMS）”完成新一轮过亿元股权融资
- 《明末》团队解散背后，国产单机究竟还缺什么？
- 一季度A股IPO市场“量质齐升”，未来产业踊跃“报考”
- 一季度银行理财规模排名调整，行业竞争关键从渠道转向投研能力
- 万达电影在北京成立新公司，含体育经纪人服务业务
- 业绩亮眼股价承压，上市券商将多措并举推动价值回归
- 东风天元智舱Plus平台搭载黑芝麻智能武当C1296芯片，打造首个本土舱驾一体量产化平台
- 两市融资余额较上日增加163.45亿元
- 两部门：调整银行业金融机构境外贷款业务有关事宜
- 个人养老金基金新增5只，“双线扩容”助力长期投资
- 中信建投：历次原油供给大冲击之后，全球将寻求能源供应多元化
- 中信证券：看好铜板块在2026年第二季度重回市场配置主线
- 中国巨石：一季度净利润同比预增60%至80%
- 中煤能源：3月商品煤销量1946万吨，同比下降21.4%
- 中粮集团联手国家自然科学基金委员会打造农粮食品领域首个企业创新发展联合基金
- 中航机载系统公司注册资本增至约93.6亿元
- 中金公司：一季度净利同比预增65%到90%
- 亚马逊将收购全球星，并为苹果iPhone提供卫星服务支持
- 人民币兑美元中间价调升11个基点
- 仪表盘显示屏故障，克莱斯勒在美召回超6.5万辆汽车
- 伊藤忠商事与JR东日本宣布合并房地产业务
- 优步承诺投入100亿美元发展机器人出租车，实现战略转型
- 传抖音电商将迎调整，成立红果电商，官方暂无回应
- 债基大额赎回频现，帮忙资金或“卡点”撤离
- 光合创投完成开年最大VC募集
- 光通信进入可持续景气周期，产业链多环节成长空间打开
- 刘强东章泽天再成立新公司知周
- 千问AI眼镜S1宣布正式开售
- 半日主力资金加仓电子股，抛售有色金属股
- 华勤技术：拟发售5854.8万股H股
- 华泰证券：4月中国出口或仍有望维持较高景气度
- 华泰证券：AI眼镜有望从当前的信息提示工具升级为智能体感知世界的信息入口
- 华泰证券：风电齿轮箱供需向好，产业链或迎来发展机遇
- 华西证券：看好锂电产业链高景气度趋势
- 华谊兄弟：被债权人申请重整及预重整
- 博通宣布与Meta扩大合作，总裁兼CEO陈福阳将转任Meta顾问
- 台光电、台耀、联茂等高阶CCL供应商集体调价，涨幅至高达40%
- 哈啰回应超量投放共享单车被行政处罚
- 国内首个智能体界面设计及用户体验评估团体标准发布
- 国家外汇局：3月银行结汇18889亿元人民币，售汇17786亿元人民币
- 国家铁路局：一季度全国铁路累计完成旅客发送量同比增长5.5%
- 境外机构今年已发行熊猫债超1022亿元
- 外资机构年内调研沪市公司近1400次，科创板公司尤受青睐
- 多家欧洲航司呼吁欧盟采取行动确保航油供应
- 多氟多：2025年净利润2.13亿元，同比扭亏
- 央行公开市场开展5亿元7天期逆回购操作
- 奈飞公司CEO与美国影院行业负责人举行会谈，双方未来或将合作？
- 威迈斯：2025年5.58亿元，同比增长39.51%
- 字节启动新一轮期权回购
- 宁德时代：2025年度每10股派69.57元，分红总额超304亿元
- 宁德时代：二季度产能利用率预计维持在八到九成以上
- 宁德时代：拟设立时代资源集团，注册资本300亿元
- 安全气囊可能意外弹出，本田在美召回超44万辆汽车
- 小米汽车公布降噪处理新专利
- 年报审计提前被亮“非标”意见，*ST公司扎堆拉响退市“预警”
- 广州推出优化营商环境三十条，将设400亿基金支持关键产业
- 广州：争取率先实现燃料电池汽车推广突破10000辆
- 广州：加快打造陆海空全空间无人体系，全域开放无人驾驶场景
- 广州：组建人工智能产业投资基金，总规模200亿元
- 广汽集团旗下公司成立智行科技公司
- 广电总局发布微短剧精品创作传播计划
- 微软计划扩建美国怀俄明州夏延数据中心
- 快手马宏彬：可灵AI服务超3万家企业
- 恒指午间休盘涨0.76%，恒生科技指数涨1.88%
- 恒指开盘涨1.14%，恒生科技指数涨2.26%
- 恒指收涨0.29%，恒生科技指数涨1.23%
- 惠丰钻石回应产品涨价：原材料涨价，工业金刚石单晶主要依靠外采
- 惠丰钻石：5月1日起，对工业金刚石产品价格进行8%-12%结构性上调
- 我国网络视听用户规模10.99亿人，稳居各互联网应用首位
- 我国首艘万吨级纯电动智能集装箱船正式投入商业运营
- 抖音集团将投入5亿专项资金扶持真人短剧
- 报告：东南亚电商2025年GMV突破万亿
- 招金黄金：一季度净利润1.87亿元，同比扭亏为盈
- 拟赴港上市？接近度小满人士：不实
- 摩根士丹利一季度净营收205.8亿美元
- 摩根大通CEO警告人工智能技术引发的网络攻击风险
- 新世界旗下Gmarket与阿里合资后GMV实现双位数增长
- 新华制药：布美他尼注射液获得药品注册证书
- 新诺威：控股子公司SYS6051注射液药物临床试验获批
- 晓鸣股份：一季度净亏损2271.87万元，同比转亏
- 智谱：同意购买安狮红钻投资有限公司持有的目标公司100%股权
- 最前线｜追觅生态企业娲宝科技发布宠物智能项圈，布局“项圈+宠粮”数据闭环
- 机构今日买入长源东谷等20股，卖出佛塑科技2.19亿元
- 机构：全球智能手机出货量同比下降6%，荣耀、苹果逆势增长
- 李力耘将加入众擎机器人，曾是小鹏智驾负责人
- 李成钢会见美国福特汽车公司全球执行副总裁兼首席政务官柯立
- 杨利娟辞任特海CEO，接手海底捞红石榴计划
- 氪星晚报｜Snap宣布将裁员约1000人；字节启动新一轮期权回购；苹果CEO库克斥资106万美元增持耐克
- 沪深两市成交额突破1万亿
- 沪深两市成交额连续第6个交易日突破2万亿元
- 波音一季度共交付143架民用飞机
- 海南矿业锂矿增储遭合资方公开质疑，公司回应：不存在此问题，目前在进行沟通交流
- 海口市人民政府与中科曙光签署战略合作协议
- 海思科：HSK47388片（I）新增适应症获批临床试验
- 深成指、创业板指均跌超1%
- 港股AI储能赛道：思格新能暗盘暴涨超90%，市值破1500亿港元，明日正式上市
- 澳洲会计师公会调查：85%的受访企业有计划在2026年开展创新业务
- 热门中概股美股盘前多数下跌，百度跌超1%
- 爱马仕第一季度总收入为40.7亿欧元，销售额同比增长5.6%
- 特斯拉机器人出租车推进引发现金流担忧，不断增加的支出给财务带来压力
- 特斯拉高管称上海工厂将为擎天柱机器人量产提供“金钥匙”
- 猪价大降超30%，处7年低点
- 现货黄金向下跌破4800美元/盎司
- 硅业分会：多晶硅价格跌幅收窄成交初现回暖
- 科大讯飞发布AstronClaw智能体矩阵
- 算力紧缺之下，Anthropic调整定价模式，按企业AI使用量计费
- 粗门完成数千万A+轮融资，在AI时代让更多人“出门”｜36氪首发
- 紧抓基本面掘金市场机遇，两大板块最受机构青睐
- 红旗连锁：一季度净利润1.43亿元，同比下降8.97%
- 美团申请注册2枚美团装备商标
- 美国3月进口价格环比上涨0.8%
- 美国海关将于本月20日启动关税退款
- 美国证券交易委员会批准取消投资者日内交易限制的计划
- 美国财长贝森特：汽油价格将很快开始下降
- 美格智能：拟3亿元投建AI研发及先进制造产业项目
- 美联储4月维持利率不变的概率为98.4%
- 美联储主席提名人沃什披露夫妻资产总额逾1.9亿美元，实际还远远不止
- 美股三大指数集体收涨，纳指连续十个交易日上涨
- 美股大型科技股盘前涨跌不一，微软涨超1%
- 美财政部寻求接入Anthropic旗下Mythos模型，以发现系统漏洞
- 腾讯轻量云独家上线Hermes Agent应用模板
- 自动驾驶初创公司Glydways洽谈2.5亿美元融资
- 英国广播公司据悉将裁员2000人
- 英特尔据悉将在未来几周向员工披露参与马斯克Terafab项目的细节
- 苹果CEO库克斥资106万美元增持耐克
- 苹果官微发文提醒iPhone用户立即更新设备
- 苹果提高印度iPhone产量，塔塔集团组装份额应能达到10-15%
- 荷兰全球保险集团将以27亿美元向标准人寿出售英国子公司
- 菜鸟发布攀爬机器人ZeeBot，实测智能化存取效率提升一倍
- 蓝色光标：2025年净利润2.25亿元，同比扭亏
- 诺和诺德携手OpenAI加速药物研发，旨在提升效率
- 诺基亚联手Orange与英伟达推进AI-RAN创新
- 财政部将于4月在香港发行155亿元人民币国债
- 轮胎行业掀涨价潮，多家企业宣布产品最高提价5%
- 轻舟试验飞船已在轨完成多项关键技术验证
- 迪拜帆船酒店宣布将停业1年半进行大规模修复工程
- 速卖通：2026年帮2000个中国品牌实现出海规模翻倍
- 长春城投建设投资集团注册资本增至56亿元
- 阿斯麦第一季度营收87.67亿欧元，高于市场预期
- 阿里ATH事业群发布首款AI开发工具秒悟
- 阿里云发布DDoS防护产品调价公告
- 阿里云：将对部分MU模型单元的服务价格进行适度调整
- 险资去年四季度重点增持高股息标的
- 集邦咨询：零部件交期拉长抑制通用型服务器成长动能，预估2026年整体服务器出货量年增13%
- 韩国3月进口物价同比劲升18.4%，创逾三年最高涨幅
- 风险投资机构争相向Anthropic抛出投资要约，估值最高达8000亿美元
- 飞天茅台全线上涨，今日26年飞天原箱批价报1665元/瓶
- 马斯克旗下xAI因孟菲斯数据中心项目遭NAACP起诉
- 马斯克：特斯拉AI5芯片成功流片，将成为产量最高AI芯片之一
404 Media
- Emails Reveal Space Force’s Hardest Mission Is Writing a Song
- Podcast: How the FBI Extracted Deleted Signal Messages
- Thomson Reuters Fired Worker For Speaking Out About ICE, Former Employee Says
Ars Technica
- Americans ask AI for health care. Hospitals think the answer is more chatbots.
- Rockets and spaceships are cool, but the humanity of Artemis II resonated most
- UK gov's Mythos AI tests help separate cybersecurity threat from hype
- What’s the deal with Alzheimer’s disease and amyloid?
Black Hills Information Security
- Signed, Trusted, and Abused: Proxy Execution via WebView2
CXSecurity: World Laboratory of Bugtraq 2
- Easy File Sharing Web Server v7.2 Buffer Overflow
- FortiWeb 8.0.2 Remote Code Execution
- WordPress Madara Local File Inclusion
Daniel Miessler
- Good and Bad Harness Engineering
daringfireball.net
- Amazon to Acquire Globalstar, Announces Agreement With Apple to Continue Service for iPhone and Apple Watch
- Apple Has Hidden the Pre-Creator-Studio Versions of Keynote, Numbers, and Pages in the Mac App Store
- Google Will Finally Begin Punishing Sites for Back-Button Hijacking in June
- John Calhoun on Steve Lemay
- On the Name of Apple’s Foldable iPhone
- Richard Moss’s 2010 Interview With John Calhoun on the Origins of Glider
- Screen Zooming on iOS
- Speaking of Tips
darkreading
- Audit: Big Tech Often Ignores CA Privacy Law Opt-Out Requests
- EDR-Killer Ecosystem Expansion Requires Stronger BYOVD Defenses
- Microsoft, Salesforce Patch AI Agent Data Leak Flaws
- Privilege Elevation Dominates Massive Microsoft Patch Update
Der Flounder
- DUNS number no longer required to sign up for Apple Business in the United States
EFF
- Digital Hopes, Real Power: The Rise of Network Shutdowns
- EFF Calls on Kuwait to Release Journalist Ahmed Shihab-Eldin
Emergent Minds | paddo.dev
- Benchmarks Are Bullshit
Ethical hacking and penetration testing
- 11. Transforming non-photographic images into photographs (photorealistic images) using AI
experimental-history.com
- Nothing ever dies. It merely becomes embarrassing.
Google AI Blog
- Turn your best AI prompts into one-click tools in Chrome
Hacker News Frontpage
- 40% of lost calories globally are from beef, needing 33 cal of feed per 1 cal
- 5NF and Database Design
- California ghost-gun bill wants 3D printers to play cop, EFF says
- Civilization Is Not the Default. Violence Is
- ClawRun – Deploy and manage AI agents in seconds
- Daily Claude outage is upon us. Waiting for Claude Status to update
- Gas Town: From Clown Show to v1.0
- Good Sleep, Good Learning (2012)
- H.R.8250 – To require operating system providers to verify the age of any user
- MCP as Observability Interface: Connecting AI Agents to Kernel Tracepoints
- The cost of building a workflow editor on React Flow
- Trusted access for the next era of cyber defense
- Vibe Coding Fails
- Want to Write a Compiler? Just Read These Two Papers (2008)
HackerNews
- PHP Composer ć›ĺ‡şä¸¤ĺ¤„éŤ˜ĺąćźć´žďźŒĺŻĺŻźč‡´äťťć„ĺ‘˝äť¤ć‰§čĄŒ
- Rockstar Games ĺˆ†ćžć•°ćŽéĺ‹’ç´˘ĺ›˘äź™ćł„éœ˛
- çžŽč‹ąĺŠ č”ĺˆ"ĺ¤§čĽżć´‹čĄŒĺŠ¨"ç ´čŽˇ 4500 ä¸‡çžŽĺ…ƒĺŠ ĺŻ†č´§ĺ¸ç›—çŞƒćĄˆ
- ćŹ§ć´˛ĺĽčşŤĺˇ¨ĺ¤´ Basic-Fit ć•°ćŽćł„éœ˛ďźŒĺ˝ąĺ“ 100 ä¸‡äźšĺ‘˜
- ć–°ĺž‹ Mirax ĺŽ‰ĺ“čżœćŽ§ćœ¨éŠŹĺ°†čŽžĺ¤‡č˝Źä¸ş SOCKS5 äťŁç†ďźŒé€ščż‡ Meta ĺšżĺ‘Šč§ŚĺŠ 22 ä¸‡ç”¨ćˆˇ
- ć•™č‚˛ĺ…Źĺ¸çĄŽčŽ¤ć•°ćŽćł„éœ˛ďźŒéĺ‹’ç´˘ĺ›˘äź™ĺ¨čƒ
- č‹šćžœ App Store ĺ‡şçŽ°ĺ‡ĺ†’ Ledger Live ĺş”ç”¨ďźŒç›—ĺ– 950 ä¸‡çžŽĺ…ƒĺŠ ĺŻ†č´§ĺ¸
- ĺŠ ĺŻ†č´§ĺ¸äş¤ć˜“ć‰€ Kraken éĺ†…éƒ¨äşşĺ‘˜ćł„éœ˛ĺŽĺ—éť‘ĺŽ˘ĺ‹’ç´˘
HackerNoon
- The $12.6 Million "Patient Zero": Healthcare’s Identity Crisis
- The Complete Guide to Migrating From UIKit to SwiftUI in Large Production Apps
- TinyBrain++: A Compact, Interpretable Alternative to Black-Box AI
Horizon3.ai
- CVE-2026-21643
- From Patch Tuesday to Pentest Wednesday®: When “Clean” Didn’t Mean Secure
ICT Security Magazine
- Oltre le Terze Parti, la cybersecurity della supply chain nel 2026
- Risk management nella sanità digitale: prevenire e mitigare i rischi informatici
IEEE Spectrum
- Crypto Faces Increased Threat from Quantum Attacks
- OpenAI Engineer Helps Companies Attract Buyers and Boost Sales
- Stealth Signals Are Bypassing Iran’s Internet Blackout
InfoSec Write-ups - Medium
- Breaking 2FA in WordPress: Account Takeover via CSRF in Google Authenticator
- DVRIP/Sofia Protocol Dissector for Wireshark (Written in Lua)
- How To Hack Part 4
- Lazy RC4: Payload Encryption Using SystemFunction032
infosecurity-magazine.com
- AI Companies To Play Bigger Role in CVE Program, Says CISA
- Microsoft Fixes Two Zero-Days in April Patch Tuesday
- Researchers Spot Surge in Brute-Force Attacks from Middle East
jeffgeerling.com
- An Arm Mainboard for the Framework Laptop
johndcook.com
- Oppenheimer’s legacy: How the national labs forged the age of hyperscale AI
krebsonsecurity.com
- Patch Tuesday, April 2026 Edition
Malware-Traffic-Analysis.net - Blog Entries
- 2026-04-13: XLoader (Formbook) infection
MIT Technology Review
- Cyberscammers are bypassing banks’ security with illicit tools sold on Telegram
- The Download: NASA’s nuclear spacecraft and unveiling our AI 10
NowSecure
- Emulator vs Real Device Testing in Mobile App Security: Closing Critical Coverage Gaps
NVIDIA AI Blog
- New Adobe Premiere Color Grading Mode Accelerated on NVIDIA GPUs
- Rethinking AI TCO: Why Cost per Token Is the Only Metric That Matters
rtl-sdr.com
- New YouTube Tutorials for SatDump V2.x.x
- Receiving the Artemis 2 S-Band Carrier With a Wi-Fi Dish and Airspy R2
- Saveitforparts: Receiving Artemis 2 Signals
- Stream1090: A New Approach to ADS-B Demodulation Using CRC-Based Framing Instead of Preamble Detection
SANS Internet Storm Center, InfoCON: green
- ISC Stormcast For Wednesday, April 15th, 2026 https://isc.sans.edu/podcastdetail/9892, (Wed, Apr 15th)
- Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)
- Scanning for AI Models, (Tue, Apr 14th)
Schneier on Security
- Defense in Depth, Medieval Style
- Upcoming Speaking Engagements
SecLists - Full Disclosure
- CyberDanube Security Research 20260408-0 | Remote Operation Denial of Service in Siemens SICAM A8000
- CyberDanube Security Research 20260408-1 | Multiple Vulnerabilities in Siemens SICAM A8000
- SEC Consult SA-20260414-0 :: Improper Enforcement of Locked Accounts in WebUI (SSO) in Kiuwan SAST on-premise (KOP) & cloud/SaaS
Securelist
- Threat landscape for industrial automation systems in Q4 2025
Security Affairs
- Microsoft Patch Tuesday for April 2026 fixed actively exploited SharePoint zero-day
- Mirax malware campaign hits 220K accounts, enables full remote control
- Personal data of 1 million gym members compromised in Basic-Fit security incident
- PHP Composer flaws enable remote command execution via Perforce VCS
Security Boulevard
- Claude Mythos and the AI Vulnerability Arms Race – What CISOs Must Know Now
Seebug Paper
- 合法终端管理软件遭滥用：疑似银狐攻击事件分析与溯源
SentinelOne
- Securing the Software Supply Chain: How SentinelOne’s AI EDR Autonomously Blocked the CPU-Z Watering Hole Cyber Attack
shkspr.mobi
- Why is it so hard to passively stalk my friends' locations?
simonwillison.net
- Cybersecurity Looks Like Proof of Work Now
- Trusted access for the next era of cyber defense
Sploitus.com Exploits RSS Feed
- CloudStorageHunter-Pro exploit
- Exploit for Code Injection in Flowiseai Flowise exploit
- Exploit for Code Injection in Flowiseai Flowise exploit
- Exploit for Code Injection in Langflow exploit
- Exploit for CVE-2025-24000 exploit
- Exploit for CVE-2026-39987 exploit
- Exploit for Improper Control of Dynamically-Managed Code Resources in N8N exploit
- Exploit for Missing Authentication for Critical Function in Flowiseai Flowise exploit
- Exploit for Missing Encryption of Sensitive Data in Apache Tomcat exploit
- Exploit for Missing Encryption of Sensitive Data in Apache Tomcat exploit
- Exploit for Missing Encryption of Sensitive Data in Apache Tomcat exploit
- Exploit for Path Traversal in Gogs exploit
- Exploit for Use After Free in Adobe Acrobat_Dc exploit
- File-Cleaner- exploit
- pentest-with-LLM exploit
- ps459 exploit
- tp-xss exploit
- Venom_xss exploit
StefLan's Security Blog
- Certified Azure Red Team Expert (CARTE) Review
TechCrunch
- Adobe’s new Firefly AI assistant can use Creative Cloud apps to complete tasks
- After sale of its shoe business, Allbirds pivots to AI
- AI datacenter startup Fluidstack in talks for $1B round at $18B valuation months after hitting $7.5B, says report
- Amazon unveils a slimmer Fire TV Stick HD, opens Ember Artline TVs for preorder
- Anthropic co-founder confirms the company briefed the Trump administration on Mythos
- Anthropic’s rise is giving some OpenAI investors second thoughts
- Chipmakers AMD, Arm, and Qualcomm are all investing in this buzzy self-driving tech startup
- Gitar, a startup that uses agents to secure code, emerges from stealth with $9 million
- Google adds AI Skills to Chrome to help you save favorite workflows
- HBO Max comes to India via exclusive JioHotstar deal
- How the rewards app Freecash scammed its way to the top of the app stores
- London gets closer to its first robotaxi service as Waymo begins testing
- Max Hodak’s Science Corp. is preparing to place its first sensor in a human brain
- Snap is cutting 1,000 jobs, 16% of its workforce
- Someone planted backdoors in dozens of WordPress plug-ins used in thousands of websites
- Spotify launches the ability to purchase physical books in the US and UK
- Sweden blames Russian hackers for attempting ‘destructive’ cyberattack on thermal plant
- This energy startup’s bet on 100-year-old grid tech is paying off
- This startup is betting tokenmaxxing will create the next compute giant
- YouTube livestreams will now hold back ads during peak engagement to protect the vibe
The Decoder
- Anthropic prepares Opus 4.7 and AI design tool, VCs offer up to 800 billion dollars
- Claude beat human researchers on an alignment task, and then the results vanished in production
- Claude Code routines let AI fix bugs and review code on autopilot
- Claude Mythos can autonomously compromise weakly defended enterprise networks end-to-end
- Google Chrome's new "Skills" feature lets you save AI prompts and reuse them with a single click
- Greg Brockman predicts AI will let small teams match the output of large ones if they can afford the compute
- Microsoft Copilot in Word can now track changes and manage comments
- OpenAI releases GPT-5.4-Cyber, a model built specifically for defensive cybersecurity
- OpenAI's European Stargate plans shrink as Microsoft and Google take over capacity
- OpenAI's GPT-5.4 Pro reportedly solves a longstanding open Erdős math problem in under two hours
The Verge
- Adobe embraces conversational AI editing, marking a ‘fundamental shift’ in creative work
- Amazon’s new Fire TV Stick HD is its ‘slimmest ever’
- Chrome now lets you turn AI prompts into repeatable ‘Skills’
- Dozens of 4K Blu-rays are included in Amazon’s three for $33 sale
- Google’s Spotlight-like desktop search bar for Windows is available for everyone
- Grok’s sexual deepfakes almost got it banned from Apple’s App Store. Almost.
- Leaked images reveal a dual-lens pro version of DJI’s next Osmo Pocket camera
- Microsoft faces fresh Windows Recall security concerns
- Microsoft’s finally giving up on its massive Surface Hub touchscreen displays
- More phone cameras should come with silly telephoto lenses
- Nothing makes it easy to share files between any Android phone and a Mac
- Prime Video is bundling Apple TV Plus and Peacock for a limited time
- Privacy advocates want Google to stop handing consumer data over to ICE
- Snap is laying off 16 percent of its staff as it leans into AI
- Sony’s latest gaming headset offers great open-back audio
- Sony’s new 1440p OLED gaming monitor seems a lot better than its first
- Spotify now sells printed books
- The new Tomodachi Life is made to be shared — even if Nintendo doesn’t want you to
- The world’s oldest art, now in 6K IMAX
- Walmart is updating its 4K streaming box with Gemini and Matter support
VulDB Recent Entries
- CVE-2023-20585 | Microsoft Windows 11 24H2/11 25H2/Server 2025 buffer overflow
- CVE-2024-23104 | Fortinet FortiVoice/FortiNDR HTTP information disclosure (FG-IR-26-124)
- CVE-2024-33618 | Bosch DIVAR IP all-in-one 6000 up to 12.0.1 Network Interface resource consumption
- CVE-2025-15565 | cartasi Nexi XPay Plugin up to 8.3.0 on WordPress redirect authorization
- CVE-2025-53847 | Fortinet FortiOS up to 7.6.3 missing authentication (FG-IR-26-125)
- CVE-2025-54550 | Apache Airflow up to 3.1.x example_xcom code injection
- CVE-2025-61624 | Fortinet FortiOS/FortiProxy/FortiSwitchManager/FortiPAM path traversal (FG-IR-26-122)
- CVE-2025-61848 | Fortinet FortiManager sql injection (FG-IR-26-111)
- CVE-2025-63939 | anirudhkannan Grocery Store Management System 1.0 POST Parameter search_products_itname.php sitem_name sql injection
- CVE-2025-65132 | Public Scripting 1.0 GET Parameter edit_room.php room_id cross site scripting
- CVE-2025-65133 | manikandan580 School Management System 1.0 Endpoint sql injection
- CVE-2025-65135 | manikandan580 School-Management-System up to 1.0 POST Parameter between-date-reprtsdetails.php fromdate sql injection
- CVE-2025-68649 | Fortinet FortiManager Cloud up to 7.0.16/7.2.12/7.4.7/7.6.4 CLI path traversal (FG-IR-26-120)
- CVE-2025-70023 | transloadit uppy 0.25.6 type confusion
- CVE-2026-0207 | PureStorage FlashBlade up to 4.4.8/4.5.13/4.6.3 log file
- CVE-2026-0209 | PureStorage FlashArray up to 6.10.0 operator precedence logic error
- CVE-2026-0390 | Microsoft Windows up to Server 2022 UEFI Secure Boot reliance on untrusted inputs in a security decision
- CVE-2026-1782 | Wpmet MetForm Pro Plugin up to 3.9.7 on WordPress Form Submission mf-calculation input validation
- CVE-2026-20806 | Microsoft Windows up to Server 2025 COM Server type confusion
- CVE-2026-20928 | Microsoft Windows up to Server 2025 Recovery Environment improper removal of sensitive information before storage or transfer
- CVE-2026-20930 | Microsoft Windows up to Server 2025 Management Services race condition
- CVE-2026-20945 | Microsoft SharePoint Server cross site scripting
- CVE-2026-21331 | Adobe Connect up to 12.10/2025.3 cross site scripting (apsb26-37)
- CVE-2026-21741 | Fortinet FortiNAC-F up to 7.2.9/7.4.3/7.6.5 CSV File Parser redirect (FG-IR-26-118)
- CVE-2026-21742 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.1/7.6.2 Secure Message cleartext transmission (FG-IR-26-106)
- CVE-2026-22155 | Fortinet FortiSOAR on-premise/FortiSOAR PaaS cleartext transmission (FG-IR-26-106)
- CVE-2026-22573 | Fortinet FortiSOAR on-premise/FortiSOAR PaaS up to 7.3.3/7.4.5/7.5.3/7.6.3 File Content path traversal (FG-IR-26-116)
- CVE-2026-22574 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise LDAP Configuration password recoverable (FG-IR-26-105)
- CVE-2026-22576 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.3.3/7.4.5/7.5.2/7.6.4 Connector Configuration password recoverable (FG-IR-26-104)
- CVE-2026-22692 | October CMS up to 3.7.12/4.1.4 collect protection mechanism (GHSA-m5qg-jc75-4jp6)
- CVE-2026-22828 | Fortinet FortiAnalyzer Cloud/FortiManager Cloud up to 7.6.4 heap-based overflow (FG-IR-26-121)
- CVE-2026-23653 | Microsoft Visual Studio Code CoPilot Chat Extension prior 0.37.3 command injection
- CVE-2026-23657 | Microsoft Office LTSC 2024 Word use after free
- CVE-2026-23666 | Microsoft .NET Framework prior 4.8.9332.0 exceptional condition
- CVE-2026-23670 | Microsoft Windows up to Server 2025 Virtualization-Based Security untrusted pointer dereference
- CVE-2026-23708 | Fortinet FortiSOAR PaaS/FortiSOAR on-premise up to 7.5.2/7.6.3 improper authentication (FG-IR-26-101)
- CVE-2026-2399 | Schneider Electric PowerChute Serial Shutdown /REST/upssleep path traversal (SEVD-2026-104-01)
- CVE-2026-2400 | Schneider Electric PowerChute Serial Shutdown /setPCBEDesc crlf injection (SEVD-2026-104-01)
- CVE-2026-2401 | Schneider Electric PowerChute Serial Shutdown File log file (SEVD-2026-104-01)
- CVE-2026-2402 | Schneider Electric PowerChute Serial Shutdown excessive authentication (SEVD-2026-104-01)
- CVE-2026-2403 | Schneider Electric PowerChute Serial Shutdown /logsettings improper validation of specified quantity in input (SEVD-2026-104-01)
- CVE-2026-2405 | Schneider Electric PowerChute Serial Shutdown ZIP File Creation /helpabout resource consumption (SEVD-2026-104-01)
- CVE-2026-24893 | openITCOCKPIT up to 5.5.1 input validation (GHSA-789q-pw85-j2q2)
- CVE-2026-24906 | October CMS up to 3.7.13/4.1.9 Setting cross site scripting (GHSA-6qmh-j78v-ffp7)
- CVE-2026-24907 | October CMS up to 3.7.13/4.1.9 Mail Message cross site scripting (GHSA-j4j5-9x6g-rgxc)
- CVE-2026-25125 | October CMS up to 3.7.13/4.1.9 Environment Variable parse_ini_string information disclosure (GHSA-g6v3-wv4j-x9hg)
- CVE-2026-25133 | October LMS up to 3.7.13/4.1.9 SVG File Parser cross site scripting (GHSA-gcqv-f29m-67gr)
- CVE-2026-25184 | Microsoft Windows up to Server 2025 Applocker Filter Driver applockerfltr.sys race condition
- CVE-2026-25250 | Microsoft Windows up to Server 2025 Secure Boot missing cryptographic step
- CVE-2026-25691 | Fortinet FortiSandbox PaaS/FortiSandbox Cloud/FortiSandbox path traversal (FG-IR-26-115)
- CVE-2026-26143 | Microsoft PowerShell 7.4/7.5 input validation
- CVE-2026-26149 | Microsoft Power Apps prior 3.26032.10.0 control sequence
- CVE-2026-26151 | Microsoft Windows up to Server 2025 Remote Desktop insufficient warning
- CVE-2026-26152 | Microsoft Windows up to Server 2025 Cryptographic Services sensitive information
- CVE-2026-26153 | Microsoft Windows up to Server 2025 Encrypted File System out-of-bounds
- CVE-2026-26154 | Microsoft Windows prior 10.0.26100.32690 Server Update Service denial of service
- CVE-2026-26155 | Microsoft Windows up to Server 2025 Local Security Authority Subsystem Service buffer over-read
- CVE-2026-26156 | Microsoft Windows up to Server 2025 Hyper-V heap-based overflow
- CVE-2026-26159 | Microsoft Windows up to Server 2025 Remote Desktop Licensing Service missing authentication
- CVE-2026-26160 | Microsoft Windows up to Server 2025 Remote Desktop Licensing Service missing authentication
- CVE-2026-26161 | Microsoft Windows up to Server 2025 Sensor Data Service untrusted pointer dereference
- CVE-2026-26162 | Microsoft Windows up to Server 2025 OLE type confusion
- CVE-2026-26163 | Microsoft Windows up to Server 2025 Kernel double free
- CVE-2026-26165 | Microsoft Windows up to Server 2025 Shell use after free
- CVE-2026-26166 | Microsoft Windows up to Server 2025 Shell double free
- CVE-2026-26167 | Microsoft Windows up to Server 2025 Push Notifications race condition
- CVE-2026-26168 | Microsoft Windows up to Server 2025 Ancillary Function Driver for WinSock race condition
- CVE-2026-26169 | Microsoft Windows up to Server 2025 Kernel buffer over-read
- CVE-2026-26170 | Microsoft Windows up to Server 2025 PowerShell input validation
- CVE-2026-26171 | Microsoft .NET prior 8.0.26/9.0.15/10.0.6 resource consumption
- CVE-2026-26172 | Microsoft Windows up to Server 2025 Push Notifications race condition
- CVE-2026-26173 | Microsoft Windows up to Server 2025 Ancillary Function Driver for WinSock race condition
- CVE-2026-26174 | Microsoft Windows up to Server 2025 Server Update Service race condition
- CVE-2026-26175 | Microsoft Windows up to Server 2025 Boot Manager uninitialized resource
- CVE-2026-26176 | Microsoft Windows up to Server 2025 Client Side Caching Driver csc.sys heap-based overflow
- CVE-2026-26177 | Microsoft Windows up to Server 2025 Ancillary Function Driver for WinSock use after free
- CVE-2026-26178 | Microsoft Windows up to Server 2025 Advanced Rasterization Platform numeric conversion
- CVE-2026-26179 | Microsoft Windows up to Server 2025 Kernel double free
- CVE-2026-26180 | Microsoft Windows up to Server 2025 Kernel heap-based overflow
- CVE-2026-26181 | Microsoft Windows up to Server 2025 Brokering File System use after free
- CVE-2026-26182 | Microsoft Windows up to Server 2025 Ancillary Function Driver for WinSock use after free
- CVE-2026-26183 | Microsoft Windows prior 10.0.26100.32690 RPC Server access control
- CVE-2026-26184 | Microsoft Windows up to Server 2025 Projected File System buffer over-read
- CVE-2026-26291 | GROWI up to 7.4.6 cross site scripting
- CVE-2026-27222 | Adobe Bridge up to 15.1.4/16.0.2 File divide by zero (apsb26-39)
- CVE-2026-27238 | Adobe InDesign Desktop up to 20.5.2/21.2 File heap-based overflow (apsb26-32)
- CVE-2026-27243 | Adobe Connect up to 12.10/2025.3 cross site scripting (apsb26-37)
- CVE-2026-27245 | Adobe Connect up to 12.10/2025.3 cross site scripting (apsb26-37)
- CVE-2026-27246 | Adobe Connect up to 12.10/2025.3 cross site scripting (apsb26-37)
- CVE-2026-27258 | Adobe DNG SDK up to 1.7.1 2502 File out-of-bounds write (apsb26-41)
- CVE-2026-27282 | Adobe ColdFusion up to 2023.18/2025.6 input validation (apsb26-38)
- CVE-2026-27283 | Adobe InDesign Desktop up to 20.5.2/21.2 File use after free (apsb26-32)
- CVE-2026-27284 | Adobe InDesign Desktop up to 20.5.2/21.2 File Parser out-of-bounds (apsb26-32)
- CVE-2026-27285 | Adobe InDesign Desktop up to 20.5.2/21.2 File heap-based overflow (apsb26-32)
- CVE-2026-27286 | Adobe InDesign Desktop up to 20.5.2/21.2 File heap-based overflow (apsb26-32)
- CVE-2026-27287 | Adobe InCopy up to 20.5.2/21.2 File Parser out-of-bounds (apsb26-33)
- CVE-2026-27288 | Adobe Experience Manager up to FP11.7 form cross site scripting (apsb26-34)
- CVE-2026-27289 | Adobe Photoshop Desktop up to 27.4 File Parser out-of-bounds (apsb26-40)
- CVE-2026-27291 | Adobe InDesign Desktop up to 20.5.2/21.2 File out-of-bounds write (apsb26-32)
- CVE-2026-27299 | Adobe Framemaker up to 2022.8 File information disclosure (apsb26-36)
- CVE-2026-27303 | Adobe Connect up to 12.10/2025.3 deserialization (apsb26-37)
- CVE-2026-27304 | Adobe ColdFusion up to 2023.18/2025.6 input validation (apsb26-38)
- CVE-2026-27305 | Adobe ColdFusion up to 2023.18/2025.6 path traversal (apsb26-38)
- CVE-2026-27306 | Adobe ColdFusion up to 2023.18/2025.6 File input validation (apsb26-38)
- CVE-2026-27307 | Adobe ColdFusion up to 2023.18/2025.6 resource consumption (apsb26-38)
- CVE-2026-27308 | Adobe ColdFusion up to 2023.18/2025.6 resource consumption (apsb26-38)
- CVE-2026-27310 | Adobe Bridge up to 15.1.4/16.0.2 File heap-based overflow (apsb26-39)
- CVE-2026-27311 | Adobe Bridge up to 15.1.4/16.0.2 File heap-based overflow (apsb26-39)
- CVE-2026-27312 | Adobe Bridge up to 15.1.4/16.0.2 File heap-based overflow (apsb26-39)
- CVE-2026-27313 | Adobe Bridge up to 15.1.4/16.0.2 File heap-based overflow (apsb26-39)
- CVE-2026-27316 | Fortinet FortiSandbox/FortiSandbox PaaS up to 4.4.9/5.0.5 LDAP insufficiently protected credentials (FG-IR-26-113)
- CVE-2026-27906 | Microsoft Windows 10 21H2/11 23H2/11 24H2/11 25H2/11 26H1 Hello Security information disclosure
- CVE-2026-27907 | Microsoft Windows up to Server 2025 Storage Spaces Controller integer underflow
- CVE-2026-27908 | Microsoft Windows up to Server 2025 TDI Translation Driver tdx.sys use after free
- CVE-2026-27909 | Microsoft Windows up to Server 2025 Search Service use after free
- CVE-2026-27910 | Microsoft Windows up to Server 2025 Installer insufficient permissions or privileges
- CVE-2026-27911 | Microsoft Windows up to Server 2025 User Interface Core race condition
- CVE-2026-27912 | Microsoft Windows prior 10.0.26100.32690 Kerberos improper authorization
- CVE-2026-27913 | Microsoft Windows prior 10.0.25398.2274 BitLocker input validation
- CVE-2026-27914 | Microsoft Windows up to Server 2025 Management Console access control
- CVE-2026-27915 | Microsoft Windows up to Server 2025 UPnP Device Host use after free
- CVE-2026-27916 | Microsoft Windows up to Server 2025 UPnP Device Host use after free
- CVE-2026-27917 | Microsoft Windows up to Server 2025 WFP NDIS Lightweight Filter Driver wfplwfs.sys use after free
- CVE-2026-27918 | Microsoft Windows up to Server 2025 Shell race condition
- CVE-2026-27919 | Microsoft Windows up to Server 2025 UPnP Device Host untrusted pointer dereference
- CVE-2026-27920 | Microsoft Windows up to Server 2025 UPnP Device Host untrusted pointer dereference
- CVE-2026-27921 | Microsoft Windows up to Server 2025 TDI Translation Driver tdx.sys race condition
- CVE-2026-27922 | Microsoft Windows up to Server 2025 Ancillary Function Driver for WinSock use after free
- CVE-2026-27923 | Microsoft Windows up to Server 2025 Desktop Window Manager use after free
- CVE-2026-27924 | Microsoft Windows 10 21H2/11 23H2/Server 2022/Server 2022 23H2 use after free
- CVE-2026-27925 | Microsoft Windows up to Server 2025 use after free
- CVE-2026-27926 | Microsoft Windows up to Server 2025 race condition
- CVE-2026-27927 | Microsoft Windows up to Server 2025 race condition
- CVE-2026-27928 | Microsoft Windows input validation
- CVE-2026-27929 | Microsoft Windows up to Server 2025 toctou
- CVE-2026-2834 | tokenoftrust Age Verification & Identity Verification by Token of Trust Plugin cross site scripting
- CVE-2026-30778 | Apache SkyWalking up to 10.3.0 OAP Endpoint /debugging/config/dump information disclosure
- CVE-2026-32082 | Microsoft Windows up to Server 2025 Simple Search/Discovery Protocol race condition
- CVE-2026-32083 | Microsoft Windows up to Server 2025 Simple Search/Discovery Protocol race condition
- CVE-2026-32084 | Microsoft Windows up to Server 2025 Print Spooler information disclosure
- CVE-2026-32085 | Microsoft Windows up to Server 2025 Remote Procedure Call information disclosure
- CVE-2026-32086 | Microsoft Windows up to Server 2025 Function Discovery Service fdwsd.dll race condition
- CVE-2026-32087 | Microsoft Windows up to Server 2025 Function Discovery Service fdwsd.dll heap-based overflow
- CVE-2026-32088 | Microsoft Windows up to Server 2025 Biometric Service race condition
- CVE-2026-32089 | Microsoft Windows up to Server 2025 Speech Brokered API use after free
- CVE-2026-32090 | Microsoft Windows up to Server 2025 Speech Brokered API race condition
- CVE-2026-32091 | Microsoft Windows up to Server 2025 Brokering File System race condition
- CVE-2026-32093 | Microsoft Windows up to Server 2025 Function Discovery Service fdwsd.dll race condition
- CVE-2026-32149 | Microsoft Windows up to Server 2025 Hyper-V input validation
- CVE-2026-32150 | Microsoft Windows up to Server 2025 Function Discovery Service fdwsd.dll race condition
- CVE-2026-32151 | Microsoft Windows up to Server 2025 Shell information disclosure
- CVE-2026-32152 | Microsoft Windows up to Server 2025 Desktop Window Manager use after free
- CVE-2026-32153 | Microsoft Windows up to 11 26H1 Speech Runtime use after free
- CVE-2026-32154 | Microsoft Windows up to Server 2025 Desktop Window Manager use after free
- CVE-2026-32155 | Microsoft Windows up to Server 2025 Desktop Window Manager use after free
- CVE-2026-32156 | Microsoft Windows up to Server 2025 UPnP Device Host use after free
- CVE-2026-32157 | Microsoft Windows up to Server 2025 Remote Desktop Client use after free
- CVE-2026-32158 | Microsoft Windows up to Server 2025 Push Notifications race condition
- CVE-2026-32159 | Microsoft Windows up to Server 2025 Push Notifications race condition
- CVE-2026-32160 | Microsoft Windows up to Server 2025 Push Notifications race condition
- CVE-2026-32162 | Microsoft Windows up to Server 2025 COM acceptance of extraneous untrusted data with trusted data
- CVE-2026-32163 | Microsoft Windows up to Server 2025 User Interface Core race condition
- CVE-2026-32164 | Microsoft Windows up to Server 2025 User Interface Core race condition
- CVE-2026-32165 | Microsoft Windows up to Server 2025 User Interface Core use after free
- CVE-2026-32167 | Microsoft SQL Server 2016/2017/2019/2022/2025 sql injection
- CVE-2026-32168 | Microsoft Azure Monitor Agent 1.26.0 input validation
- CVE-2026-32171 | Microsoft Azure Logic Apps prior 1.35.9 insufficiently protected credentials
- CVE-2026-32176 | Microsoft SQL Server 2016/2017/2019/2022/2025 sql injection
- CVE-2026-32178 | Microsoft .NET 2016/2017/2019/2022/2025 special element
- CVE-2026-32181 | Microsoft Windows up to Server 2025 Connected User Experiences privileges management
- CVE-2026-32183 | Microsoft Windows up to Server 2025 Snipping Tool command injection
- CVE-2026-32184 | Microsoft HPC Pack 2019 deserialization
- CVE-2026-32188 | Microsoft Office 2019/LTSC/LTSC 2021/LTSC 2024 Excel out-of-bounds
- CVE-2026-32189 | Microsoft Office 2019/LTSC/LTSC 2021/LTSC 2024 Excel use after free
- CVE-2026-32190 | Microsoft Office 2016/2019/LTSC/LTSC 2021/LTSC 2024 use after free
- CVE-2026-32192 | Microsoft Azure Monitor Agent 1.26.0/1.35.9 deserialization
- CVE-2026-32195 | Microsoft Windows 11 26H1 Kernel stack-based overflow
- CVE-2026-32196 | Microsoft Admin Center 2.6.2.6/2.6.4 cross site scripting
- CVE-2026-32197 | Microsoft Office 2019/LTSC/LTSC 2021/LTSC 2024 Excel use after free
- CVE-2026-32198 | Microsoft Office 2019/LTSC/LTSC 2021/LTSC 2024 Excel use after free
- CVE-2026-32199 | Microsoft Office 2019/LTSC/LTSC 2021/LTSC 2024 Excel use after free
- CVE-2026-32200 | Microsoft Office 2019/LTSC 2021/LTSC 2024 PowerPoint use after free
- CVE-2026-32201 | Microsoft SharePoint Server 2019/LTSC 2021/LTSC 2024 input validation
- CVE-2026-32202 | Microsoft Windows up to Server 2025 Shell protection mechanism
- CVE-2026-32203 | Microsoft .NET/Visual Studio prior 8.0.26/9.0.15/10.0.6/17.12.19/17.14.30 stack-based overflow
- CVE-2026-32212 | Microsoft Windows up to Server 2025 link following
- CVE-2026-32214 | Microsoft Windows up to Server 2025 upnp.dll access control
- CVE-2026-32215 | Microsoft Windows up to Server 2025 Kernel log file
- CVE-2026-32216 | Microsoft Windows 11 26H1 Redirected Drive Buffering System null pointer dereference
- CVE-2026-32217 | Microsoft Windows up to Server 2025 Kernel log file
- CVE-2026-32218 | Microsoft Windows up to Server 2025 Kernel log file
- CVE-2026-32219 | Microsoft Windows 11 24H2/11 25H2/11 26H1/Server 2025 Brokering File System double free
- CVE-2026-32220 | Microsoft Windows 11 24H2/11 25H2/11 26H1/Server 2025 UEFI Secure Boot access control
- CVE-2026-32221 | Microsoft Windows 11 24H2/11 25H2/11 26H1/Server 2025 Graphics heap-based overflow
- CVE-2026-32222 | Microsoft Windows 11 24H2/11 25H2/11 26H1/Server 2025 Win32k untrusted pointer dereference
- CVE-2026-32223 | Microsoft Windows 11 24H2/11 25H2/11 26H1/Server 2025 USB Printing Stack usbprint.sys heap-based overflow
- CVE-2026-32224 | Microsoft Windows 11 26H1 Server Update Service use after free
- CVE-2026-32225 | Microsoft Windows up to Server 2025 Shell protection mechanism
- CVE-2026-32226 | Microsoft .NET Framework prior 4.8.9332.0 race condition
- CVE-2026-32631 | Microsoft Visual Studio prior 15.9.79/16.11.55/17.12.19/17.14.30 private personal information
- CVE-2026-33018 | saitoha libsixel up to 1.8.6 SIXEL Encoder load_gif use after free
- CVE-2026-33020 | saitoha libsixel up to 1.8.6 SIXEL Encoder sixel_frame_convert_to_rgb888 heap-based overflow
- CVE-2026-33095 | Microsoft Office LTSC/LTSC 2021/LTSC 2024 Word use after free
- CVE-2026-33096 | Microsoft Windows up to Server 2025 HTTP.sys out-of-bounds
- CVE-2026-33098 | Microsoft Windows up to Server 2025 Container Isolation FS Filter Driver use after free
- CVE-2026-33099 | Microsoft Windows up to Server 2022 23H2 Ancillary Function Driver for WinSock use after free
- CVE-2026-33100 | Microsoft Windows up to Server 2025 Ancillary Function Driver for WinSock use after free
- CVE-2026-33101 | Microsoft Windows Print Spooler use after free
- CVE-2026-33103 | Microsoft Dynamics 365 3.24104.15/8/8.2/9.0/9.1 access control
- CVE-2026-33104 | Microsoft Windows up to Server 2025 Win32k race condition
- CVE-2026-33114 | Microsoft Office LTSC/LTSC 2021/LTSC 2024 Word untrusted pointer dereference
- CVE-2026-33115 | Microsoft Office LTSC/LTSC 2021/LTSC 2024 Word use after free
- CVE-2026-33116 | Microsoft .NET Framework prior 10.0.6 infinite loop
- CVE-2026-33120 | Microsoft SQL Server untrusted pointer dereference
- CVE-2026-33146 | docmost up to 0.70.2 Public Search Endpoint /api/search/share-search improper authorization (GHSA-qq4c-8rjr-w42c)
- CVE-2026-33193 | Docmost up to 0.69.x MIME cross site scripting
- CVE-2026-33414 | containers podman up to 5.8.1 VM Image Parser stubber.go os command injection (GHSA-hc8w-h2mf-hp59)
- CVE-2026-33714 | Chamilo LMS up to 1.x AJAX Endpoint statistics.ajax.php Security::remove_XSS date_start/date_end sql injection (GHSA-w8c4-c7r8-qgw2)
- CVE-2026-33715 | Chamilo LMS up to 2.0-RC.2 AJAX Endpoint global.inc.php test_mailer missing authentication (GHSA-mxc9-9335-45mc)
- CVE-2026-33806 | Fastify up to 5.8.4 Header Content-Type improper validation of specified type of input
- CVE-2026-33807 | fastify express up to 4.0.4 onRegister interpretation conflict
- CVE-2026-33808 | fastify express up to 4.0.4 interpretation conflict
- CVE-2026-33822 | Microsoft Office LTSC Word out-of-bounds
- CVE-2026-33824 | Microsoft Windows up to Server 2025 double free
- CVE-2026-33825 | Microsoft insufficient granularity of access control
- CVE-2026-33826 | Microsoft input validation
- CVE-2026-33827 | Microsoft race condition
- CVE-2026-34160 | Chamilo LMS up to 2.0-RC.2 Exchange Notification Service pens.php package-url missing authentication (GHSA-g2xj-4cch-j276)
- CVE-2026-34161 | Chamilo LMS up to 2.0.0-RC.2 social_post_attachments cross site scripting (GHSA-273p-jw9w-3g22)
- CVE-2026-34212 | docmost up to 0.70.x cross site scripting (GHSA-cf68-cff9-hq4w)
- CVE-2026-34213 | docmost up to 0.70.x Attachments /api/files/upload attachmentId authorization (GHSA-89fp-2hch-j9gp)
- CVE-2026-34370 | Chamilo LMS up to 2.0.0-RC.2 Notebook updateNote/delete_note notebook_id improper authorization
- CVE-2026-34454 | oauth2-proxy OAuth2 Proxy up to 7.15.1 Logout/Sign-out session expiration (GHSA-f24x-5g9q-753f)
- CVE-2026-34602 | Chamilo LMS up to 2.0.0-RC.2 /api/course_rel_users authorization
- CVE-2026-34614 | Adobe Connect up to 12.10/2025.3 cross site scripting (apsb26-37)
- CVE-2026-34615 | Adobe Connect up to 12.10/2025.3 deserialization (apsb26-37)
- CVE-2026-34617 | Adobe Connect up to 12.10/2025.3 URL cross site scripting (apsb26-37)
- CVE-2026-34618 | Adobe Illustrator up to 29.8.5/30.2 File out-of-bounds write (apsb26-42)
- CVE-2026-34619 | Adobe ColdFusion up to 2023.18/2025.6 path traversal (apsb26-38)
- CVE-2026-34622 | Adobe Acrobat Reader up to 24.001.30360/24.001.30362/26.001.21411 File prototype pollution (apsb26-44)
- CVE-2026-34623 | Adobe Experience Manager prior 6.5.24/FP11.7 cross site scripting (apsb26-34)
- CVE-2026-34624 | Adobe Experience Manager up to 6.5.24/FP11.7 cross site scripting (apsb26-34)
- CVE-2026-34625 | Adobe Experience Manager up to 6.5.24/FP11.7 cross site scripting (apsb26-34)
- CVE-2026-34626 | Adobe Acrobat Reader up to 24.001.30360/24.001.30362/26.001.21411 File prototype pollution (apsb26-44)
- CVE-2026-34627 | Adobe InDesign Desktop up to 20.5.2/21.2 File heap-based overflow (apsb26-32)
- CVE-2026-34628 | Adobe InDesign Desktop up to 20.5.2/21.2 File heap-based overflow (apsb26-32)
- CVE-2026-34629 | Adobe InDesign Desktop up to 20.5.2/21.2 File heap-based overflow (apsb26-32)
- CVE-2026-34630 | Adobe Bridge up to 15.1.4/16.0.2 File heap-based overflow (apsb26-39)
- CVE-2026-34631 | Adobe InCopy up to 20.5.2/21.2 File out-of-bounds write (apsb26-33)
- CVE-2026-35032 | Jellyfin up to 10.11.6 /LiveTv/TunerHosts server-side request forgery (GHSA-8fw7-f233-ffr8)
- CVE-2026-35196 | Chamilo LMS up to 2.0.0-RC.2 gradebook.ajax.php api_get_course_id _cid os command injection
- CVE-2026-35589 | HKUDS nanobot up to 0.1.4 Bridge API bridge/src/server.ts BRIDGE_TOKEN missing origin validation in websockets (GHSA-v5j3-4q66-58cf)
- CVE-2026-3643 | onthemapmarketing Accessibly Plugin up to 3.0.3 on WordPress REST API Endpoint update-widget-options updateWidgetOptions widgetSrc cross site scripting
- CVE-2026-38526 | Krayin CRM 2.2.x /admin/tinymce/upload unrestricted upload
- CVE-2026-38528 | Krayin CRM 2.2.x /Lead/LeadDataGrid.php rotten_lead sql injection
- CVE-2026-38529 | Krayin CRM 2.2.x HTTP UserController.php improper authentication
- CVE-2026-38530 | Krayin CRM 2.2.x GET LeadController.php improper authorization
- CVE-2026-38532 | Krayin CRM 2.2.x GET PersonController.php improper authorization
- CVE-2026-38533 | Snipe-IT 8.4.0 PUT /api/v1/users/ improper authentication
- CVE-2026-39808 | Fortinet FortiSandbox/FortiSandbox PaaS up to 4.4.8 os command injection (FG-IR-26-100)
- CVE-2026-39809 | Fortinet FortiClientEMS up to 7.4.1/7.4.4 sql injection (FG-IR-26-102)
- CVE-2026-39811 | Fortinet FortiWeb up to 7.0.12/7.2.12/7.4.12/7.6.6/8.0.3 integer overflow (FG-IR-26-108)
- CVE-2026-39813 | Fortinet FortiSandbox/FortiSandbox Cloud up to 4.4.8/5.0.5 /filedir path traversal (FG-IR-26-112)
- CVE-2026-39814 | Fortinet FortiWeb up to 7.4.12/7.6.6/8.0.2 path traversal (FG-IR-26-114)
- CVE-2026-39815 | Fortinet FortiDDoS-F up to 7.2.2 sql injection (FG-IR-26-119)
- CVE-2026-39884 | Flux159 mcp-server-kubernetes up to 3.4.x Model Context Protocol port_forward.ts spawn argument injection
- CVE-2026-39906 | Unisys WebPerfect Image Suite 3.0.3960.22604/3.0.3960.22810 Network Configuration target file confused deputy
- CVE-2026-39907 | Unisys WebPerfect Image Suite 3.0.3960.22604/3.0.3960.22810 WCF SOAP Endpoint LFName file inclusion
- CVE-2026-4002 | petjeaf Petje.af Plugin up to 2.1.8 on WordPress ajax_revoke_token cross-site request forgery
- CVE-2026-40090 | zarf-dev zarf up to 0.74.1 Metadata.Name path traversal
- CVE-2026-40091 | authzed spicedb up to 1.51.0 log file
- CVE-2026-40096 | immich up to 2.7.2 Name cross site scripting
- CVE-2026-40105 | XWiki xwiki-platform up to 16.10.15/17.4.7/17.10.0 templates/changesdoc.vm cross site scripting
- CVE-2026-40261 | Composer Perforce Reference command injection
- CVE-2026-40291 | Chamilo LMS up to 2.0-RC.2 /api/users/ privileges management
- CVE-2026-40499 | radareorg radare2 up to 6.1.3 PDB Parser print_gvars os command injection
- CVE-2026-40683 | OpenStack Keystone up to 25.0.0/26.1.0/27.0.0/28.0.0 Configuration Options _ldap_res_to_model type confusion
- CVE-2026-40688 | Fortinet FortiWeb up to 7.4.11/7.6.6/8.0.3 out-of-bounds write (FG-IR-26-127)
- CVE-2026-40719 | MaraDNS 3.5.0036 Deadwood control flow
- CVE-2026-5088 | JDEGUEST Apache::API::Password up to 0.5.2 on Perl Crypt::Urandom weak prng
- CVE-2026-5397 | Omron Social Solutions PowerAttendant Standard Edition uncontrolled search path (OMSR-2026-001)
- CVE-2026-5713 | Python CPython up to 3.14.x profiling.sampling/asyncio stack-based overflow (ID 148178)
- CVE-2026-5752 | cohere-ai cohere-terrarium sandbox
- CVE-2026-5754 | Radware Alteon vADC 34.5.4.0 cross site scripting
- CVE-2026-5756 | Data Recognition Central Office Services 975 missing authentication
- CVE-2026-6293 | udamadu Inquiry Form to Posts or pages Plugin up to 1.0 on WordPress check_admin_referer inq_hidden cross-site request forgery
- CVE-2026-6328 | XQUIC up to 1.8.3 on Linux QUIC Protocol input validation
Vulnerabilities and Threat Research – Qualys Security Blog
- Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
wheresyoured.at
- I Will Never Respect A Website
Wired
- AI Slop Is Making the Internet Fake-Happy
- Allbirds Is Pivoting to AI Compute. Sure, Why Not
- Best GoPro Camera (2026): Compact, Budget, Accessories
- Best Smart Smoke Detector (and Why You Still Need a Dumb One)
- Best Wi-Fi Routers of 2026 for Working, Gaming, and Streaming
- Gik Acoustics SoundBlocks Review: Good-Looking Acoustic Treatment
- GoPro’s New Mission 1 Cameras Have 8K Video and Interchangeable Lenses
- How to Use Google Chrome’s New AI-Powered ‘Skills’
- I Watched 18 Hours of Coachella’s Vertical Livestream and All I Got Was This Lousy FOMO
- MAGA Is Starting to Look Beyond Trump
- Telegram Is Still Hosting a Sanctioned $21 Billion Crypto Scammer Black Market
- The Caves That Could Help Us Find, or Become, Aliens
- The Deepfake Nudes Crisis in Schools Is Much Worse Than You Thought
- The Most WIRED Watches at Watches and Wonders 2026
- X’s Big Bot Purge Wiped Out a Lot of People’s Secret Porn Feeds
不安全
- iPhone、安卓现在就能跑 Gemma 4 了：Google 开源 AI Edge Gallery 应用
- Scanning for AI Models, (Tue, Apr 14th)
- Stream1090: A New Approach to ADS-B Demodulation Using CRC-Based Framing Instead of Preamble Detection
- The n8n n8mare: How threat actors are misusing AI workflow automation
- Threat landscape for industrial automation systems in Q4 2025
- 今年1~3月全球智能手机出货量减少4%
- 微软在本月修复高达165个新安全漏洞很难说是不是AI在后面帮忙
- 苹果主要依赖的卫星紧急消息服务提供商Globalstar被亚马逊以116亿美元收购
- 隐私倡导者希望谷歌停止向ICE提供用户数据
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
奇客Solidot–传递最新科技情报
- 亚马逊收购 Globalstar
- 俄罗斯流行应用被发现会检测是否安装 VPN
- 安娜的档案被勒令向 Spotify 等赔偿 3.22 亿美元
- 斯坦福报告凸显了 AI 业内人士和公众之间的分歧
- 美国国会新法案要求操作系统验证用户年龄
- 英国首相表示社媒平台应停止无限滚动
安全研究GoSSIP
- G.O.S.S.I.P 阅读推荐 2026-04-15 大模型安全对齐新思路：让“该不该答”听“安不安全”的话
爱范儿
- 39.98 万元起，小鹏最贵 SUV GX 登场，要豪华有技术，要设计有堆料
- 一千块的录音卡片，凭什么还敢每年多收一千块钱？
- 刚刚，李飞飞最新成果发布，手机也能跑亿级粒子的 3D 世界了｜附体验地址
- 微软想给所有 Windows 电脑预装龙虾
- 拳打丰田，脚踢本田，吉利发布 i-HEV 技术，百公里油耗仅 2.22L
- 早报｜苹果：建议更新iOS保护iPhone数据安全/华为苹果一季度逆势领跑手机市场/比亚迪回应车库起火
- 英特尔发布「AI 高静」游戏本新标准：安静和性能也可兼得
- 首发即绝版！劳斯莱斯近亿元定制跑车「夜莺」问世，全部 100 辆已售光
绿盟科技技术博客
- 绿盟科技《Botnet趋势报告》（2026版）正式发布
- 绿盟科技携手统信软件，共筑成熟 · 智能国产创新生态——统信桌面操作系统V25发布
量子位 QbitAI
- 全球首创16cm极致外扩超级机械臂，MOVA扫地机开启清洁新纪元
黑海洋
- Meta承诺与博通合作打造1吉瓦定制芯片
- 今年1~3月全球智能手机出货量减少4%
- 新法案：游戏关服必出离线版不然全退款
- 缅因州议会通过大型数据中心建设禁令
- 隐私倡导者希望谷歌停止向ICE提供用户数据