安全资讯归档（2026-04-17）

2Libra
- MacBook Neo 需求激增四月已全部售罄
- 《逆天邪神》
- 【投票】你对 Vibe Coding 产出的代码信任度是多少？
- 【💰】ai 进行 web 测试有什么好用的工具吗
- 【💰】【小游戏】猜猜我是谁？
- 【💰】我的第一个 AI 小弟
- 免費體驗 Grok 3 和 Veo 3.1 的 AI 平台分享！
- 关于“产品派”存在漏洞可能导致信息泄漏的风险提示
- 前端规范化
- 国内掀信用卡停发潮较历史高点量缩 13.75%
- 天才车道设计师
- 当今社会快乐是一种生产力 By 九边
- 有没有拼脆脆鲨的？哈哈
- 求一个 LINUX DO 账号链接
- 看新闻，当你生命受到威胁时，请忽略一切规则和法律，没有什么比性命更重要。
- 证券市场，昨天做多赚了 40 块，今天行情亏了 170+，股市风险大，入市需谨慎呢
- 说说你觉得最好/推荐的动漫作品
- 马上下班，周末怎么安排
36氪
- *ST花王：撤销退市风险警示及其他风险警示，4月21日起证券简称变更为“花王股份”
- 136家化工行业上市公司发布2025年年报，过半企业净利增长头部公司业绩亮眼
- 2连板可川科技：全资子公司可川光子正在积极地进行市场开拓工作，暂未形成营收
- 36氪首发 | “华为天才少年”创业连融超4亿元，做新一代推理芯片重构显存成本
- 3连板均瑶健康：公司业务不涉及保健食品的注册及生产，AKK菌粉销售目前对公司利润影响极小
- 4月17日人民币对美元中间价调贬6个基点
- 5连板博云新材：股东高创投4月14日至4月16日减持407.2万股持股比例降至5%以下
- 7只游戏股年内获融资资金加仓超1亿元
- 8点1氪丨全季大连某酒店账号公开多名客人特殊订单备注；金立手机创始人被曝在印尼卖家具；雷军将连播15小时测试新SU7续航
- AI PC下半场，荣耀想让所有人先用上消费级龙虾
- Anthropic正与美国政府洽谈，拟向其提供Mythos模型使用权限
- Anthropic计划在伦敦进行大规模扩张
- A股三大指数午间休盘涨跌不一，源杰科技股价超越茅台成A股新“股王”
- A股三大指数开盘涨跌不一，贵州茅台跌超4%
- A股三大指数收盘涨跌不一，源杰科技登顶A股新股王
- A股优质企业掀起赴港上市的热潮，AH股溢价持续收窄
- A股半导体产业链整体业绩向好，算力、AI仍是关键变量
- B站发布2025年度ESG报告：日活用户达1.12亿
- Canva可画正式发布Canva AI 2.0
- Meta宣布Quest 3/3S VR头显涨价
- OpenAI发布Codex的升级版
- SpaceX最快或6月上市，谷歌或从SpaceX上市获巨额收益
- Stellantis与微软合作部署逾百款AI工具
- Uber斥资3.18亿美元增持德国食品配送公司Delivery Hero股份
- Xiaomi miclaw通过首批中国信通院可信AI手机端智能助手（Claw）评测
- “加速进化”完成近10亿元融资
- “行云”完成Pre-A及Pre-A+多轮融资
- “龙虾出行”完成近亿元天使轮融资
- “龙虾出行”完成近亿元天使轮融资，致力于打造AI出行助理
- 「日清」换高周转，钱大妈筑牢生鲜护城河
- 三安光电：终止联合境外投资人收购Lumileds 100%股权
- 上交所：本周对117起拉抬打压、虚假申报等证券异常交易行为采取了自律监管措施
- 专访荣耀AI专家李向东：端侧AI方向还没收敛，但AI手机是最好的载体
- 东吴证券：技术革新、规模量产、国产替代共同驱动环卫无人设备降本逻辑
- 东风本田：目前没有工厂关停计划
- 两市融资余额增加107.35亿元
- 两连板宝丽迪：控股子公司COFs材料项目商业化进程目前处于初始阶段
- 中信建投：房地产行业整体发展持续受政策支撑，继续看好物管及经营服务赛道
- 中信建投：继续看好锂电设备与固态电池板块配置价值
- 中信证券：覆铜板全面涨价持续，看好后续利润提升弹性
- 中国核建：一季度新签合同192.04亿元营收224.52亿元
- 中基协：基金管理公司应当全面建立以基金投资收益为核心的绩效考核体系
- 中基协：基金管理公司应当建立阶梯化的绩效薪酬调整机制
- 中金财富期货：预计短期钢材期价反弹空间受限，维持承压运行
- 丸红旗下公司斥资2.04亿欧元收购Factor Energy 85%股份
- 仕佳光子：拟12.65亿元投建高速光芯片与器件开发及产业化项目
- 优步斥资2.7亿欧元增持Delivery Hero股份
- 依米康：向特定对象发行股票获证监会同意注册批复
- 光线传媒在北京成立文化娱乐公司
- 全球最大船用风力旋筒助推系统今日发布
- 共处罚没款35.97亿元,7家电商平台涉“幽灵外卖”系列案被处罚
- 具身智能领域首个国际标准成功立项
- 凌云光：参股公司长光辰芯在港交所挂牌上市
- 创业板指涨超1%，继续刷新近11年新高
- 券商调研风向三度切换，4月重回价值防御
- 加拿大邮政将终止住宅邮件投递
- 北方稀土：2025年净利润23亿元，同比增长124%
- 北证50涨超5%
- 半日主力资金加仓电子板块，抛售医药生物板块
- 华盛锂电申请港股上市，至多筹资约3亿美元
- 协创数据在天津成立词元智算科技公司，含AI业务
- 协创数据：供需缺口格局在3年—5年内难以改变，存储行业缺货状态将持续
- 南京江北新区科技投资集团增资至约31.1亿元
- 南向资金今日净买入170.10亿港元
- 南向资金净买入额达100亿港元
- 南向资金净买入额达60亿港元
- 厦门科拓通讯技术股份有限公司港股IPO获中国证监会备案
- 发改委：加快有序投放8000亿元新型政策性金融工具资金
- 发改委：着力扩大国内有效需求，将制定2026年—2030年扩大内需战略实施方案
- 发改委：要深入实施“十五五”规划纲要，加快推进109项重大工程项目实施
- 发改委：预计到2030年非化石能源供应规模将比2025年显著增长
- 告别野蛮生长，信用卡发行按下减速键
- 商汤科技拟配售约32亿港元，即将推出“Token Plan”AI词元计划
- 国信证券：2025年净利润110.73亿元，同比增长34.76%
- 国家发展改革委和交通运输部正在牵头编制《现代综合交通运输体系发展“十五五”规划》
- 国家发展改革委：一季度投资、消费、价格等指标明显改善
- 国家发改委：今年将重点在“人工智能+”基础设施等领域，开展一系列扩大有效投资行动
- 国家统计局：一季度金融业产值同比增长6.5%
- 国泰航空：3月载客量同比增加24%
- 大立光第一季度营收155.4亿元台币，同比增长6.6%
- 奈飞第一季度营收122.5亿美元，同比增长16%
- 小米汽车重磅任命：胡峥楠任CTO，宋钢任参谋长｜36氪独家
- 小红书在上海成立红擎创科技新公司
- 工业富联：GB200、GB300出货顺畅，CPO全光交换机样机开始生产
- 年内外资机构合计调研沪市公司近1400次，重点集中在半导体、高端装备等领域
- 广东：《支持中山在参与粤港澳大湾区建设中加快高质量发展的意见》正式发布
- 广州：培育智能建造产业集群，推动建筑机器人、自动化施工机械创新应用
- 广汽本田型格部分版本停产，涉手动挡车型
- 店匠科技首发AI-Native电商操作系统，多款Agent产品落地
- 引入储架发行制度，创业板精准适配创新企业融资需求
- 德意志银行预计美联储将在2026年维持利率不变
- 恒指午间休盘跌1.32%，恒生科技指数跌1.66%
- 恒指开盘跌0.69%，恒生科技指数跌0.72%
- 恒指收跌0.89%，恒生科技指数跌0.97%
- 恩力动力正式发布面向电摩市场的“恩力磐石”系列半固态电池
- 成都燃气：2025年净利润4.81亿元，同比下降1.54%
- 我国核电总装机容量达到1.25亿千瓦，居全球第一
- 我国科学家找到了大脑皮层的起源
- 托伦斯创业板IPO定于4月24日上会
- 扬杰科技：第一季度净利润同比增长41.01%
- 拓璞数控港股IPO获中国证监会备案
- 招商局融资租赁公司董事长变更
- 拿森智能科技（浙江）股份有限公司港股IPO获中国证监会备案
- 捷捷微电：IGBT成品价格预计5月1日起上调10%-20%
- 新华文轩：副总经理马晓峰因工作调整辞职
- 方一天离任万家基金董事长
- 明德生物：2025年业绩预亏，股票或被实施退市风险警示
- 星源材质港股上市获中国证监会备案
- 智元发布358宏图计划，目标2030年实现1000亿+营收
- 智元邓泰华：智元2025年度营收达10.5亿元
- 智平方与西子联合达成合作
- 最前线｜大疆发布 Pocket 4 并预告双摄版本，起售价下调500元
- 有赞登陆港交所主板
- 本田据悉将暂停部分在华燃油车厂的运营
- 机器人租赁平台擎天租官宣出海动作，首批业务落地13国
- 机构：受存储价格大幅上涨冲击低端市场影响，2025年下半年ODM/IDH智能手机出货量同比下滑10%
- 武汉长江存储一季度收入已超200亿元，正进行“史诗级扩产”
- 求购长征火箭老股份额；求购多家机器人公司老股份额｜资情留言板第182期
- 江苏索普：2025年归母净利润8838.39万元，同比下降58.62%
- 沪深两市成交额突破2万亿元
- 波音推出新型卫星平台，预计2026年交付26颗
- 派拉蒙承诺电影至少上映45天再上流媒体
- 海星股份：一季度净利润同比增长74.74%
- 淡水河谷一季度铁矿石总产量6970万吨，同比增长3%
- 淮北矿业：信湖煤矿获准复工复产
- 港交所发布有关缩短香港股票现货市场结算周期的谘询文件
- 港股科技板块强势反弹，专家对后市投资前景表示乐观
- 源杰科技股价超越茅台，成A股新“股王”
- 潘功胜：中国人民银行将实施好适度宽松的货币政策
- 点众科技发布“双十亿”计划
- 热门中概股美股盘前多数走强，拼多多涨超3%
- 爱立信第一季度销售净额493.3亿瑞典克朗，不及预期
- 特斯拉据悉禁止Model S/X签名版一年内转售，违者罚款5万美元并列入黑名单
- 王腾今日宜休在深圳成立科技新公司
- 玩腻了AI的年轻人，爱上桔子酒店的「手搓」生活？
- 现货白银日内涨超1%
- 瑞幸将上线瓶装咖啡，售价6-7元
- 瑞幸已为即享咖啡小罐子登记作品著作权
- 生意社：尿素供应短缺影响持续，需关注产能恢复
- 生意社：短期预计丙二醇市场将继续维持高位窄幅震荡格局
- 用友网络：2025年净亏损13.89亿元
- 申能股份：一季度公司控股发电企业完成发电量139.61 亿千瓦时
- 盛新锂能：董事及高管拟合计减持不超0.091%股份
- 盛美上海：筹划发行H股股票并在香港联交所上市
- 禾赛发布全球首款6D全彩激光雷达
- 科氪 | 享刻智能：不追人形机器人，深耕餐饮场景做具身智能落地派
- 索尼与本田将继续在移动出行领域展开合作
- 红杉资本据悉筹集70亿美元押注AI浪潮，新领导层首次募资
- 纽威股份：拟投12亿元建设高性能流体控制阀门项目
- 美国货币市场基金规模缩水1758.1亿美元
- 美股三大指数集体收涨，纳指十二连涨再创收盘新高
- 美股大型科技股盘前多数上涨，奈飞跌超9%
- 联想开天正式对外发布全新一代AI智能体“天禧AI Pro”
- 聚焦科技与医药板块，港股主题基金年内已成立46只
- 臻镭科技：因信披违规将被实施其他风险警示，股票停牌
- 芯源微：2025年净利润7170.51万元，同比下降64.64%
- 苏高新集团注册资本增至约89.1亿元
- 英特尔聘请三星资深高管韩升勋，力拓代工客户版图
- 苹果31年元老、营销副总裁斯坦·吴宣布退休
- 药品定价新政赋能创新，海外授权加速行业双轮驱动
- 蓝佛安出席2026年二十国集团财长和央行行长第一次会议并举行多场双边会见
- 蓝思科技：实际控制人拟增持不低于1亿元公司股份
- 藏格矿业：一季度净利润15.74亿元，同比增长110.6%
- 证监会同意臻宝科技科创板IPO注册
- 调查：美联储4月维持利率不变的概率为99.5%
- 谷歌推出用于生成合成人工智能数据集的Simula
- 豪掷200亿美元，OpenAI据称将与Cerebras达成重磅协议
- 豫光金铅：2025年归母净利润8.6亿元，同比增长6.55%
- 财政部等两部门：调整平潭综合实验区有关增值税和消费税退税货物范围
- 近八成A股上市民企去年实现盈利
- 远景动力或考虑通过港股IPO至多募资20亿美元
- 远景动力据悉考虑通过香港IPO筹资至多20亿美元
- 迦南科技：2025年归母净利润同比下降18.27%，拟10派0.58元
- 迪拜启用全球首个综合空中出租车起降场
- 追觅科技受邀出席国家商务部中意企委会圆桌会，作为中方企业代表发言
- 通义千问关联公司增资至2亿元
- 避险需求消退，弱美元或逐步回归
- 金螳螂：与越南Sun Group签署的备忘录中不涉及任何具体项目及具体金额
- 金龙鱼：2025年归母净利润31.53亿元，同比增长26.01%
- 长沙经开区先进制造产业基金注册成立
- 长盈精密：2025年度净利润5.98亿元，同比下降22.53%
- 长芯博创：终止收购鸿辉光联通讯93.81%股权意向
- 长鑫存储、长江存储现“先款排产”
- 问界加入逸安启，与宝马、奔驰三方各持有33.3%股份
- 阿里云国内短信服务价格上涨
- 阿里开源千问3.6系列中等尺寸模型
- 零跑D19正式上市
- 雷军：小米未来几年不会做十万元以内车型
- 韩国三星电子工会：若按计划罢工，公司今年将损失203亿美元
- 韵达股份：3月快递服务业务收入45.9亿元，同比增长4.08%
- 飞猪AI开放平台上线
- 首创证券港股上市获中国证监会备案
- 高盛两名亚洲资深银行家据悉将离职
404 Media
- App Stores Push Users Toward Nudify Apps, New Research Shows
- Behind the Blog: Jazz and Journalism
- The Destroyed Remnants of a Lost World Are Falling to Earth, Scientists Discover
Ars Technica
- Ad firms settle with Trump FTC over claims they boycotted conservative media
- OpenAI starts offering a biology-tuned LLM
Corelan Team
- Debugging - WinDBG(X) Automation & Scripting - Part 1
Daniel Miessler
- Jensen vs. Dwarkesh on China Chips
daringfireball.net
- App Store Reviews Are Busted
- Apple Pay Express Transit Mode, When Used With a Visa Card, Is Vulnerable to Scam Tap-to-Pay Readers
- Chance Miller: ‘Netflix Ruined Its Apple TV App by Switching to a Custom Video Player’
- Colliding With Reality, Indeed
- Freecash Was More Like Scamcash
- How to Format 10-Digit Phone Numbers
darkreading
- 'Harmless' Global Adware Transforms Into an AV Killer
- Coast Guard's New Cybersecurity Rules Offers Lessons for CISOs
- Every Old Vulnerability Is Now an AI Vulnerability
defend.network
- Daily Threat Briefing – April 17, 2026
EFF
- How Push Notifications Can Betray Your Privacy (and What to Do About It)
- Stop New York's Attack on 3D Printing
Emergent Minds | paddo.dev
- Opus 4.7: Smarter, Stricter, Hungrier
Hacker News Frontpage
- A Better R Programming Experience Thanks to Tree-sitter
- George Orwell Predicted the Rise of "AI Slop" in Nineteen Eighty-Four (1949)
- German Dog Commands
- Healthchecks.io Now Uses Self-Hosted Object Storage
- It Is Time to Ban the Sale of Precise Geolocation
- New unsealed records reveal Amazon's price-fixing tactics, California AG claims
- Show HN: Spice simulation → oscilloscope → verification with Claude Code
- Starlink outage hit drone tests, exposing Pentagon's growing reliance on SpaceX
- Substrate AI Is Hiring Harness Engineers
- U.S. to Create High-Tech Manufacturing Zone in Philippines
HackerNews
- ZionSiphon ćść„č˝Żäťśä¸“ç›Żć°´ĺ¤„ç†çłťçťŸćžç ´ĺ
- äşşĺˇĽć™şčƒ˝ĺšłĺ° n8n č˘ŤćťĽç”¨äşŽéšç§˜ç˝‘çťœé’“éąźĺŠćść„č˝Żäťśäź ć’
- çť§ Anthropic ĺ‘ĺ¸ƒ Mythos ĺŽďźŒOpenAI ć‰Šĺ¤§ĺ…śç˝‘çťœĺŽ‰ĺ…¨ć¨Ąĺž‹ä˝żç”¨ćƒé™
HackerNoon
- People Aren’t Using AI as Much as You Think
Hexacorn
- WerReportCreate API
Horizon3.ai
- Using Iranian Tradecraft to Eliminate a Critical AD Risk
ICT Security Magazine
- La responsabilità penale dell’ethical hacker: confini incerti tra ricerca e reato
- Usato una volta, hackerato due volte: il debito di sicurezza dei dispositivi IoT ricondizionati
IEEE Spectrum
- IEEE Entrepreneurship Connects Hardware Startups With Investors
InfoSec Write-ups - Medium
- [13Cubed] Chaos at Cobalt Challenge — Investigating Windows Endpoint
infosecurity-magazine.com
- Commercial AI Models Show Rapid Gains in Vulnerability Research
IT Service Management News
- Privacy: Modello di DPIA dell'EDPB
MIT Technology Review
- The Download: bad news for inner Neanderthals, and AI warfare’s human illusion
pluralistic.net
- Pluralistic: Tiktokification shall set us free (17 Apr 2026)
Product Hunt
- SpeechPal
Recent Commits to cve:main
- Update Fri Apr 17 11:17:27 UTC 2026
SANS Internet Storm Center, InfoCON: green
- [Guest Diary] Compromised DVRs and Finding Them in the Wild, (Thu, Apr 16th)
- ISC Stormcast For Friday, April 17th, 2026 https://isc.sans.edu/podcastdetail/9896, (Fri, Apr 17th)
- Lumma Stealer infection with Sectop RAT (ArechClient2), (Fri, Apr 17th)
Schneier on Security
- Mythos and Cybersecurity
Sec-News 安全文摘
- Codex Security代码审计初体验
Security Affairs
- Cisco fixed four critical flaws in Identity Services and Webex
- DraftKings hacker sentenced to prison, ordered to pay $1.4 Million
- Operation PowerOFF: 53 DDoS domains seized and 3 Million criminal accounts uncovered
- U.S. CISA adds a flaw in Apache ActiveMQ to its Known Exploited Vulnerabilities catalog
SentinelOne
- Frontier AI Reinforces the Future of Modern Cyber Defense
- The Good, the Bad and the Ugly in Cybersecurity – Week 16
shkspr.mobi
- Book Review: How To Kill A Witch - A Guide For The Patriarchy by Claire Mitchell and Zoe Venditozzi ★★★⯪☆
simonwillison.net
- llm-anthropic 0.25
- Qwen3.6-35B-A3B on my laptop drew me a better pelican than Claude Opus 4.7
Sploitus.com Exploits RSS Feed
- Exploit for CVE-2026-0740 exploit
- Exploit for CVE-2026-29000 exploit
- Exploit for CVE-2026-37749 exploit
- Exploit for CVE-2026-37750 exploit
- Exploit for CVE-2026-39842 exploit
- Exploit for Improper Input Validation in Unrealircd exploit
- Exploit for Missing Authentication for Critical Function in Nginxui Nginx_Ui exploit
- Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft exploit
- exploitra exploit
- ffensive-playbook exploit
- n-days-poc-benchmark-and-dataset exploit
- poc exploit
- reconauto exploit
- web-vulnerability-scanner exploit
Taxodium
- Album#35 - The Gift
TechCrunch
- AI traffic to US retailers rose 393% in Q1, and it’s boosting their revenue too
- Anthropic CPO leaves Figma’s board after reports he will offer a competing product
- Anthropic launches Claude Design, a new product for creating quick visuals
- Bluesky confirms DDoS attack is cause of continued app outages
- European police email 75,000 people asking them to stop DDoS attacks
- Everything we like is a psyop
- Factory hits $1.5B valuation to build AI coding for enterprises
- From the Startup Battlefield stage to the International Space Station: geCKo Materials built a sticky product
- Google adds Nano Banana-powered image generation to Gemini’s Personal Intelligence
- Google now lets you explore the web side-by-side with AI Mode
- Google’s AI Mode can now help you find products in stock nearby
- InsightFinder raises $15M to help companies figure out where AI agents go wrong
- It’s not just you — Bluesky is (sorta) down
- Loop raises $95M to build supply chain AI that predicts disruptions
- Luma launches AI-powered production studio with faith-focused Wonder Project
- Netflix co-founder and chair Reed Hastings to leave board
- Netflix plans to add a vertical video feed, use AI for recommendations
- New leaders, new fund: Sequoia has raised $7B to expand its AI bets
- OpenAI takes aim at Anthropic with beefed-up Codex that gives it more power over your desktop
- Physical Intelligence, a hot robotics startup, says its new robot brain can figure out tasks it was never taught
- Roblox’s AI assistant gets new agentic tools to plan, build, and test games
- SaySo is a new short-form video app that aims to restore users’ trust in news
- Slash, a Ramp competitor founded by teenagers, raises $100M at $1.4B valuation
- Two Americans sentenced for helping North Korea steal $5 million in fake IT worker scheme
- Uber will now pick up your returns from your doorstep
- Upscale AI in talks to raise at $2B valuation, says report
- With US spy laws set to expire, lawmakers are split over protecting Americans from warrantless surveillance
The Decoder
- Beijing brands Meta's Manus acquisition as "conspiratorial" and bars founders from leaving China
- Google finds new ways to keep you from ever clicking a link again
- Google launches native Gemini app for Mac
- India's 1.5 million annual IT graduates face an industry that's moving on without them
- Nvidia wants to scale robot simulation training with Lyra 2.0
- OpenAI launches GPT-Rosalind, a reasoning model built for life sciences research
- OpenAI says more women than men now use ChatGPT, flipping an 80-20 male split at launch
- OpenAI turns Codex into an always-on coding agent that watches your screen
- Physical Intelligence shows robot model with LLM-like generalization, flaws included
The Verge
- Ballmer gives $80 million to NPR, with strings attached.
- Casely has reannounced a power bank recall from 2025 following a fatality
- Gemini can now pull from Google Photos to generate personalized images
- Ghost orchid in the machine
- Google’s AI Mode update lets you open links without leaving the page
- Gucci-branded Google smart glasses are coming next year
- Microsoft planning Surface Laptop with an OLED display
- Microsoft’s new Xbox chief starts making her mark
- Netflix co-founder Reed Hastings is officially leaving the company
- Netflix embraces vertical video with major mobile app update
- OpenAI’s big Codex update is a direct shot at Anthropic’s Claude Code
- Peloton, stay in your lane
- The only way to fight deepfakes is by making deepfakes
- The South Korean president is doing quote-post diplomacy
- The ‘AI is inevitable’ trap
- YouTube’s mobile app finally lets you share timestamped videos
Trail of Bits Blog
- We beat Google’s zero-knowledge proof of quantum cryptanalysis
troyhunt.com
- Here's What Agentic AI Can Do With Have I Been Pwned's APIs
VulDB Recent Entries
- CVE-2024-58343 | Vision Helpdesk up to 5.6.9 User Profile vis_client_id direct request
- CVE-2025-15622 | Sparx Systems Sparx Enterprise Architect up to 16.1.1627/17.1.1713 insufficiently protected credentials
- CVE-2025-15623 | Sparx Systems Sparx Pro Cloud Server 6.0.163 private personal information
- CVE-2025-15624 | Sparx Systems Sparx Pro Cloud Server 6.0.163 primary credentials storage
- CVE-2025-15625 | Sparx Systems Sparx Pro Cloud Server 6.0.163 sql injection
- CVE-2025-36568 | Dell PowerProtect Data Domain BoostFS up to 8.5 insufficiently protected credentials (dsa-2026-060)
- CVE-2025-36579 | Dell Client Platform BIOS password recovery (dsa-2025-153)
- CVE-2025-43935 | Dell PowerScale OneFS up to 9.12.0.0 denial of service (dsa-2025-347)
- CVE-2025-46605 | Dell PowerProtect Data Domain up to 8.5 session fixiation (dsa-2026-060)
- CVE-2025-46606 | Dell PowerProtect Data Domain up to 8.5 excessive authentication (dsa-2026-060)
- CVE-2025-46607 | Dell PowerProtect Data Domain up to 8.5 improper authentication (dsa-2026-060)
- CVE-2025-46641 | Dell PowerProtect Data Domain up to 8.5 improper authentication (dsa-2026-060)
- CVE-2025-66335 | Apache Doris MCP Server up to 0.6.0 sql injection
- CVE-2026-21719 | CubeCart up to 6.5.x os command injection
- CVE-2026-22734 | Cloud Foundry UUA up to 78.8.0 SAML 2.0 Bearer Assertion authentication spoofing
- CVE-2026-2336 | Microchip IStaX up to 2026.2 webstax_auth entropy
- CVE-2026-23775 | Dell PowerProtect Data Domain appliances up to 8.0/8.3.1.0/8.3.1.10/8.5 log file (dsa-2026-060)
- CVE-2026-23776 | Dell PowerProtect Data Domain up to 8.5 certificate validation (dsa-2026-060)
- CVE-2026-23777 | Dell PowerProtect Data Domain up to 8.5 information disclosure (dsa-2026-060)
- CVE-2026-23778 | Dell PowerProtect Data Domain up to 8.5 command injection (dsa-2026-060)
- CVE-2026-23779 | Dell PowerProtect Data Domain up to 8.5 command injection (dsa-2026-060)
- CVE-2026-23853 | Dell PowerProtect Data Domain up to 7.13.1.50/8.3.1.20/8.5 weak credentials (dsa-2026-060)
- CVE-2026-24749 | SilverStripe Assets Module up to 2.4.4/3.1.2 getSourceURL authorization (GHSA-jgcf-rf45-2f8v)
- CVE-2026-27820 | ruby zlib up to 3.0.0/3.1.1/3.2.2 zlib::GzipReader buffer overflow (GHSA-g857-hhfv-j68w)
- CVE-2026-28263 | Dell PowerProtect Data Domain up to 8.5 cross site scripting (dsa-2026-060)
- CVE-2026-30656 | fio 3.41 Job File Parser str_fdp_pli_cb null pointer dereference (Issue 2055)
- CVE-2026-33082 | DataEase up to 2.10.20 exportDataset expressionTree sql injection (GHSA-xxpw-2c8q-g693)
- CVE-2026-33083 | DataEase up to 2.10.20 enumValueDs Order2SQLObj sql injection (GHSA-f443-95cf-m837)
- CVE-2026-33084 | DataEase up to 2.10.20 DatasetDataManage Service Layer enumValueObj sort sql injection
- CVE-2026-33121 | DataEase up to 2.10.20 API deTableName sql injection
- CVE-2026-33122 | DataEase up to 2.10.20 API Datasource Update Process update deTableName sql injection
- CVE-2026-33207 | DataEase up to 2.10.20 getTableField tableName sql injection
- CVE-2026-3324 | Zoho ManageEngine Log360 up to 13013 Filter Configuration authentication bypass
- CVE-2026-3330 | 10web Form Maker Plugin up to 1.15.40 on WordPress validate_data sql injection
- CVE-2026-33392 | JetBrains YouTrack up to 2025.3.121962 special elements used in a template engine
- CVE-2026-33472 | Cryptomator up to 1.19.1 Hub API CheckHostTrustController.getAuthority authentication bypass (GHSA-9q8x-whrw-x44p)
- CVE-2026-33557 | Apache Kafka 4.1.0 JWT Token improper authentication
- CVE-2026-33558 | Apache Kafka/Kafka Clients up to 3.9.1/4.0.0 log file
- CVE-2026-34018 | CubeCart up to 6.5.x sql injection
- CVE-2026-34164 | valtimo up to 13.21.0 Admin UI Logging log file (ID 653)
- CVE-2026-3488 | veronalabs WP Statistics Plugin up to 14.16.4 on WordPress AJAX check_ajax_referer authorization
- CVE-2026-35072 | Dell PowerProtect Data Domain up to 8.7.0.0 os command injection (dsa-2026-060)
- CVE-2026-35073 | Dell PowerProtect Data Domain up to 8.7.0.0 os command injection (dsa-2026-060)
- CVE-2026-35074 | Dell PowerProtect Data Domain up to 8.7.0.0 os command injection (dsa-2026-060)
- CVE-2026-35153 | Dell PowerProtect Data Domain up to 8.7.0.0 argument injection (dsa-2026-060)
- CVE-2026-35469 | moby spdystream up to 0.5.0 SPDY3 Frame Parser allocation of resources (GHSA-pc3f-x583-g7j2)
- CVE-2026-35496 | CubeCart up to 6.5.x path traversal
- CVE-2026-3605 | HashiCorp Vault/Vault Enterprise up to 1.21.0 Policy authentication bypass
- CVE-2026-37100 | Yamaha SR-B30A Sound Bar 2.40 Bluetooth Low Energy improper authentication
- CVE-2026-37336 | SourceCodester Simple Music Cloud Community System 1.0 /music/view_music.php sql injection
- CVE-2026-37337 | SourceCodester Simple Music Cloud Community System 1.0 /music/view_playlist.php sql injection
- CVE-2026-37338 | SourceCodester Simple Music Cloud Community System 1.0 /music/view_user.php sql injection
- CVE-2026-37339 | SourceCodester Simple Music Cloud Community System 1.0 /music/view_genre.php sql injection
- CVE-2026-37340 | SourceCodester Simple Music Cloud Community System 1.0 /music/edit_music.php sql injection
- CVE-2026-37341 | SourceCodester Vehicle Parking Area Management System 1.0 manage_category.php sql injection
- CVE-2026-37342 | SourceCodester Vehicle Parking Area Management System 1.0 view_parked_details.php sql injection
- CVE-2026-37343 | SourceCodester Vehicle Parking Area Management System 1.0 /parking/manage_user.php sql injection
- CVE-2026-37344 | SourceCodester Vehicle Parking Area Management System 1.0 manage_location.php sql injection
- CVE-2026-37345 | SourceCodester Vehicle Parking Area Management System 1.0 /parking/manage_park.php sql injection
- CVE-2026-37346 | SourceCodester Payroll Management and Information System 1.0 view_account.php?emp_id= sql injection
- CVE-2026-37347 | SourceCodester Payroll Management and Information System 1.0 view_employee.php sql injection
- CVE-2026-39313 | QuantGeekDev mcp-framework up to 0.2.21 Model Context Protocol /mcp readRequestBody maxMessageSize allocation of resources (GHSA-353c-v8x9-v7c3)
- CVE-2026-40002 | ZTE Red Magic 11 Pro up to V1.0.0B14MR1 Service Interface privileges management
- CVE-2026-40170 | ngtcp2 up to 1.22.0 ngtcp2_qlog_parameters_set_transport_params stack-based overflow (GHSA-f523-465f-8c8f)
- CVE-2026-40246 | Free5GC up to 1.4.2 UDR Service improper authorization (GHSA-g9cw-qwhf-24jp)
- CVE-2026-40247 | Free5GC up to 1.4.2 UDR Service improper authorization (GHSA-x5r2-r74c-3w28)
- CVE-2026-40248 | Free5GC up to 1.4.2 UDR Service notificationUri improper authorization (GHSA-jgq2-qv8v-5cmj)
- CVE-2026-40249 | Free5GC up to 4.2.1 UDR Service {subsId} unusual condition (GHSA-gx38-8h33-pmxr)
- CVE-2026-40253 | openCryptoki up to 3.26.0 on Linux/AIX asn1.c length out-of-bounds (GHSA-c9cf-6vr4-wfxm)
- CVE-2026-40255 | adonisjs http-server/http-core prior v7.8.1 response.redirect (GHSA-6qvv-pj99-48qm)
- CVE-2026-40259 | SiYuan up to 3.6.3 removeUnusedAttributeView ID improper authorization (GHSA-7m5h-w69j-qggg)
- CVE-2026-40260 | py-pdf pypdf up to 6.9.x XMP Metadata xml entity expansion (GHSA-3crg-w4f6-42mx)
- CVE-2026-40262 | enchant97 note-mark up to 0.19.1 SVG File cross site scripting (GHSA-9pr4-rf97-79qh)
- CVE-2026-40263 | enchant97 note-mark up to 0.19.1 Login Endpoint timing discrepancy (GHSA-w6m9-39cv-2fwp)
- CVE-2026-40265 | enchant97 note-mark up to 0.19.1 Asset Download Endpoint assets authorization (GHSA-p5w6-75f9-cc2p)
- CVE-2026-40308 | joedolson my-calendar up to 3.7.6 on WordPress mc_ajax_mcjs_action AJAX Endpoint parse_str authorization (GHSA-2mvx-f5qm-v2ch)
- CVE-2026-40318 | SiYuan up to 3.6.3 removeUnusedAttributeView ID path traversal (GHSA-vw86-c94w-v3x4)
- CVE-2026-40322 | SiYuan up to 3.6.3 Mermaid cross site scripting (GHSA-x63q-3rcj-hhp5)
- CVE-2026-40899 | DataEase up to 2.10.20 getJdbc permissive list of allowed inputs
- CVE-2026-40900 | DataEase up to 2.10.20 Endpoint previewSql sql injection (GHSA-vqxf-84ph-j3vx)
- CVE-2026-40901 | DataEase up to 2.10.20 CommonsCollections6 deserialization (GHSA-gm5q-g72w-c466)
- CVE-2026-40922 | SiYuan up to 3.6.3 Bazaar cross site scripting (GHSA-4663-4mpg-879v)
- CVE-2026-41113 | sagredo qmail up to 2026.04.06 qmail-remote.c tls_quit os command injection
- CVE-2026-4525 | HashiCorp Vault/Vault Enterprise up to 1.21.0 Header Authorization insertion of sensitive information into sent data
- CVE-2026-4659 | unitecms Unlimited Elements for Elementor Plugin up to 2.0.6 on WordPress Setting URLtoRelative/URLToPath URL path traversal
- CVE-2026-4666 | tomdever wpForo Forum Plugin up to 2.4.16 on WordPress classes/Posts.php posts::edit post authorization
- CVE-2026-4817 | stylemix MasterStudy LMS WordPress Plugin up to 3.7.25 on WordPress REST API Endpoint /lms/stm-lms/order/items esc_sql orderby sql injection
- CVE-2026-4853 | backupguard JetBackup Plugin up to 3.1.19.8 on WordPress Invalid File sanitize_text_field fileName path traversal
- CVE-2026-5052 | HashiCorp Vault/Vault Enterprise up to 1.21.0 PKI Engine ACME Validation server-side request forgery
- CVE-2026-5131 | Nomios Poland GREENmod up to 2.8.32 server-side request forgery
- CVE-2026-5162 | wproyal Royal Addons for Elementor Plugin up to 1.7.1056 on WordPress Instagram Feed Widget instagram_follow_text cross site scripting
- CVE-2026-5231 | veronalabs WP Statistics Plugin up to 14.16.4 on WordPress utm_source cross site scripting
- CVE-2026-5234 | LatePoint Plugin up to 5.3.2 on WordPress Error Message create_payment_intent_for_transaction transaction_intent_key authorization
- CVE-2026-5426 | Digital Knowledge KnowledgeDeliver prior 20260224 ViewState machineKey hard-coded key (MNDT-2026-0009)
- CVE-2026-5427 | extendthemes Kubio AI Page Builder Plugin up to 2.7.2 on WordPress REST API kubio_rest_pre_insert_import_assets authorization
- CVE-2026-5502 | themeum Tutor LMS Plugin up to 3.9.8 on WordPress tutor_update_course_content_order content_parent authorization
- CVE-2026-5797 | expresstech Quiz and Survey Master Plugin up to 10.1.0 on WordPress do_shortcode cross site scripting
- CVE-2026-5807 | HashiCorp Vault/Vault Enterprise up to 1.x Token Generation allocation of resources
- CVE-2026-6080 | themeum Tutor LMS Plugin up to 3.9.8 on WordPress prepare Date sql injection
- CVE-2026-6409 | Protocol Buffers Protobuf-php up to 4.33.5/5.33.x Structured Message denial of service (GHSA-p2gh-cfq4-4wjc)
- CVE-2026-6421 | Mobatek MobaXterm Home Edition up to 26.1 msimg32.dll uncontrolled search path
- CVE-2026-6434 | GNU Coreutils Temporary File uu_sort information disclosure
- CVE-2026-6435 | rust-coreutils File Permission permission
- CVE-2026-6439 | jconti VideoZen Plugin up to 1.0.1 on WordPress Setting videozen_conf lang cross site scripting
- CVE-2026-6443 | essentialplugin Accordion and Accordion Slider Plugin 1.4.6 on WordPress malicious code
- CVE-2026-6451 | tholstkabelbwde cms-fuer-motorrad-werkstaetten Plugin up to 1.0.0 on WordPress check_ajax_referer cross-site request forgery
- CVE-2026-6482 | Rapid7 Insight Agent 4.1.0.2 Agent Service openssl.cnf inclusion of functionality from untrusted control sphere
- CVE-2026-6483 | Wavlink WL-WN530H4 20220721 /cgi-bin/internet.cgi strcat/snprintf os command injection
- CVE-2026-6488 | QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593 GET Request Parameter admin/editcourse.php ID sql injection
- CVE-2026-6489 | QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593 Background Management Page admin/addteacher.php image unrestricted upload
- CVE-2026-6490 | QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593 GET Request Parameter admin/deletecourse.php ID sql injection
- CVE-2026-6491 | libvips up to 8.18.2 nip2 vips7compat.c im_minpos_vec n heap-based overflow (Issue 4965)
- CVE-2026-6492 | arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea Health Check Endpoint /api/health/detailed information disclosure
- CVE-2026-6493 | lukevella rallly up to 4.7.4 Reset Password reset-password-form.tsx redirectTo cross site scripting
- CVE-2026-6494 | Red Hat Ansible Automation Platform 2 aap-mcp-server neutralization for logs
- CVE-2026-6496 | prasathmani TinyFileManager up to 2.6 POST Parameter /filemanager.php file[] path traversal
- CVE-2026-6497 | prasathmani TinyFileManager up to 2.6 File Upload filemanager.php?p= ajax=true&type=upload uploadurl server-side request forgery
Wired
- 6,000 Meters Under the Pacific, Japan Seeks Independence From China on Rare Earths
- Best Bluetooth Speakers (2026): JBL, Sonos, Bose, and More
- Canyon Spectral:ON CF 8 Electric Mountain Bike: Beginner-Friendly, Under $5K
- Coolfly Aura Review: More Angles, Fewer Advantages
- Dark Matter May Be Made of Black Holes From Another Universe
- Europe’s Online Age Verification App Is Here
- Google's AI Mode Update Tries to Kill Tab Hopping in Chrome
- How Can Astronauts Tell How Fast They’re Going?
- MAGA Is Increasingly Convinced the Trump Assassination Attempt Was Staged
- Nothing Phone (4a) Pro Review: A Close Second
- Spoofed Tankers Are Flooding the Strait of Hormuz. These Analysts Are Tracking Them
- The Battle for OpenAI’s Soul
- The Best MagSafe Accessories (for Android, Too!): Chargers, Wallets, and More
- The Influencers Normalizing Not Having Sex
- The Online Fiction Boom Reimagining China’s History
- The Shocking Secrets of Madison Square Garden's Surveillance Machine
- The UK Launches Its $675 Million Sovereign AI Fund
不安全
- [13Cubed] Chaos at Cobalt Challenge — Investigating Windows Endpoint
- A社发布Claude Opus 4.7 可以更长时间运行任务并严格遵循既定指令
- Jensen vs. Dwarkesh on China Chips
- Painkiller Pipeline: 300 Million Tapentadol Pills Sent from India to West Africa
- 前往美国定居的AI人才一年减少八成
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
奇客Solidot–传递最新科技情报
- SpaceX 将发射 ESA 的 Rosalind Franklin 火星漫游车
- 大自然仍然在铸造人类基因
- 美国主流媒体封禁互联网档案馆的存档机器人
爱范儿
- 35.68 万元起，1400 匹马力、零百 2.9 秒的极氪 8X，要做新能源时代的「公路之王」
- DJI Pocket 4：为点赞而生的相机
- 一句话，AI 直接给我建了个能跑能跳的「吉卜力」3D小镇
- 刚刚，Claude Opus 4.7突然发布：不是最强，但奥特曼又得失眠
- 预售 11.58 万元起！埃安 N60 标配激光雷达+端到端智驾，换电版也在路上
绿盟科技技术博客
- 以AI之名，聚伙伴之力，登峰向未来：绿盟科技2026年合作伙伴峰会在福州顺利召开
量子位 QbitAI
- ImageNet作者苏昊回国任教复旦！李飞飞高徒，具身第一高引，出任通用物理AI院长
黑海洋
- 38人遇难的阿客机坠毁系遭俄罗斯误击
- OpenAI将与芯片新贵Cerebras达成重磅协议
- 中国出台新规阻止外国公司对华“脱钩”
- 前往美国定居的AI人才一年减少八成
- 拼多多被罚没合计15.2亿元 7家平台中最高
- 比亚迪公司计划加入欧洲汽车制造商协会
- 简讯：Telegram移动端新增简体中文语言