安全资讯归档（2026-04-19）

2Libra
- 【💰】来试试新网盘
- 【💰】被 AI 惊艳到！用 AI 做了一个 TLMC 音乐播放器，有没有对音乐播放器感兴趣或者有经验的？
- 我搞不懂开发需要出差的逻辑
- 距离 2027 还有 257 天! 祝大家新年快乐 ! ! !距离羊年还有 293 天! 祝大家羊年大吉 ! ! !
- 金币统计脚本更新
- 链式代理
36氪
- 36氪首发 | 前华为工程师创业，实现临时键合载板存量循环，龙头客户已验证
- C3安全大会成立多项AI安全生态联盟，华为、阿里云、ABB等参与
- Hitch Open联合智元发起全球首个AI自主决策机器人乒乓球赛事
- WSBK荷兰站第二轮正赛将举行 “张雪机车”今日再战
- “闪电”完成2026人形机器人半马
- 万达电影：4月20日起证券简称变更为“儒意电影”
- 三星停产两大内存
- 东升宇航完成新一轮融资
- 东方环宇：2025年归母净利润同比增长9.43%，拟10派9元
- 东方证券：拟收购上海证券100%股权，4月20日起停牌
- 五一假期售票开始以来，12306已拒绝“抢票软件”出票105.6万张
- 五家AIC去年净赚超184亿元
- 力源信息：第一季度净利润同比增长241%
- 北京产权交易所去年交易规模超10万亿元
- 北京首个交警机器人亮相街头参与指挥亦庄半程马拉松比赛
- 匠心家居：持续关注美国相关税收及退税政策，目前具体适用情况及对公司的实际影响仍存在不确定性
- 国产光纤全球爆单部分产品价格暴涨650%
- 天迈科技：筹划收购芬能自动化100%股权预计构成重大资产重组明起停牌
- 宇树称打破人类1500米世界纪录
- 年内26只FOF募集规模超10亿元
- 我国摧毁特大假酒网络
- 新突破我国首个十万户级天然气掺氢应用项目启动
- 沙特能源公司与沙特电力采购公司签署购电协议
- 河南省脑机接口康复设备技术创新中心揭牌
- 油价上涨催生丹麦“电车热”
- 燃油成本飙升冲击航空业多家航司上调费用并削减航线
- 特斯拉将自动驾驶出租车服务扩展至达拉斯和休斯顿
- 科氪 | 荣耀齐天大圣队机器人“闪电”夺冠领跑2026亦庄人形机器人马拉松赛场
- 第二人生获数千万融资，加码全彩3D打印与世界大模型
- 联翔股份：预计2025年净亏损1080万元至1550万元公司股票可能在年报披露后被实施退市风险警示
- 荣耀包揽北京亦庄人形机器人半马前六，新能安电池助力荣耀元气仔斩获“最佳步态控制奖”
- 荣耀家族机器人包揽冠亚季军
- 荣耀齐天大圣队“闪电”机器人获得北京亦庄半马冠军
- 蔚来：全国建成8,766座充换电站
- 飞荣达：现有产能可灵活应对当前订单交付需求适时规划专用产能
- 首创证券冲击第14家“A+H”上市券商获证监会备案。
- 香港明天将公布新一批重点引进企业
- 高德发布全球首个面向AGI的全栈具身技术体系“ABot”
Ars Technica
- I’ve fired one of America’s most powerful lasers—here’s what a shot day looks like
daringfireball.net
- Apple’s Mac Mini Went Viral. Why Can’t You Buy One Right Now? - WSJ
- ★ ‘A Reading Room on Wheels, a Lover’s Lane, and, After 11 PM, a Flophouse’
defend.network
- Daily Threat Briefing – April 19, 2026
Didier Stevens
- Update: cut-bytes.py Version 0.0.18
Hacker News Frontpage
- Airline worker arrested after sharing photos of bomb damage in WhatsApp group
- America will come to regret its war on taxes
- Android 15's hidden Linux Terminal is a real Debian VM – and it runs Claude Code
- SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit [pdf]
- Vercel April 2026 security incident
- Young sons of legendary U.S. marshal ride horseback from Oklahoma to New York
HackerNoon
- Cognitive Offloading Systems Shift How Knowledge Work Is Managed
IEEE Spectrum
- How Engineers Kick-Started the Scientific Method
InfoSec Write-ups - Medium
- Borderlands — Git History API Key Leak + BGP Hijacking to Flag Interception | TryHackMe
- Ehx | LLMNR/NBT-NS Poisoning in Depth
- Hardening Gophish: Implementing AES-256-GCM Database Encryption in Anglerphish
- North Korea-Linked Hackers Use GitHub as C2 Infrastructure to Attack South Korea
- PicoCTF Writeup — AutoRev 1
- Postman Secret Scanning: A Practical Guide to Finding Exposed APIs
- Security Questions Bypassed to Change User’s Password
- Sumeru AI CTF 2026 Writeup
- The Bug Hunting Mistake That Slowed My Progress
- TryHackMe W1seGuy: XOR Challenge Walkthrough
IT Service Management News
- Gli uomini possono fare tutto - Aprile 2026
Recent Commits to cve:main
- Update Sun Apr 19 11:20:17 UTC 2026
righto.com
- The electromechanical angle computer inside the B-52 bomber's star tracker
Sec-News 安全文摘
- 免费代理背后的攻击者行为分析
Security Affairs
- Security Affairs newsletter Round 573 by Pierluigi Paganini – INTERNATIONAL EDITION
shkspr.mobi
- Reprojecting Dual Fisheye Videos to Equirectangular (LG 360)
Sploitus.com Exploits RSS Feed
- CVE-protobufjs-GHSA-xq3m-2v4x-88gg exploit
- Exploit for Code Injection in Agentfront Enclave exploit
- Exploit for Code Injection in Anthropic Claude_Code exploit
- Exploit for CVE-2025-15403 exploit
- Exploit for CVE-2025-15521 exploit
- Exploit for CVE-2025-6389 exploit
- Exploit for CVE-2025-68001 exploit
- Exploit for CVE-2026-0920 exploit
- Exploit for CVE-2026-4257 exploit
- Exploit for CVE-2026-4447 exploit
- Exploit for CVE-2026-4631 exploit
- Exploit for Improper Certificate Validation in Wolfssl exploit
- Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller exploit
- POC---Aikido-Security-BV exploit
- WebVuln-Chain-Framework exploit
Taxodium
- 日常#13 - I Am Here 深圳 Live
TechCrunch
- AI chip startup Cerebras files for IPO
- Blue Origin successfully re-uses a New Glenn rocket for the first time ever
- Cracks are starting to form on fusion energy’s funding boom
- Tesla brings its robotaxi service to Dallas and Houston
- VC Ron Conway says he has a ‘rare form of cancer’
tedium.co
- A Taxing Discussion
The Decoder
- AI-generated influencers flood social media with pro-Trump content ahead of midterms
- Always-on Ray-Ban Meta glasses powered by OpenClaw speed up everyday tasks in new study
- Anthropic's revenue surge reportedly fuels talk of trillion-dollar valuation
- Even the best AI models lose about half their performance when charts get complicated, new benchmark finds
- First token counts reveal Opus 4.7 costs significantly more than 4.6 despite Anthropic's flat pricing
- Google launches generative UI standard for AI agents
The Verge
- Nothing’s modular CMF Headphone Pro are down to their lowest price to date
- The RAM shortage could last years
- The Stars My Destination is classic proto-cyberpunk
VulDB Recent Entries
- CVE-2026-0868 | turn2honey EMC Plugin up to 4.4 on WordPress calendly cross site scripting
- CVE-2026-6564 | EMQ EMQX Enterprise up to 6.1.0 Session Handling improper authorization
- CVE-2026-6568 | kodcloud KodExplorer up to 4.52 Public Share share.class.php initShareOld path path traversal
- CVE-2026-6569 | kodcloud KodExplorer up to 4.52 fileGet Endpoint share.class.php fileUrl improper authentication
- CVE-2026-6570 | kodcloud KodExplorer up to 4.52 systemMember.class.php initInstall path authorization
- CVE-2026-6571 | kodcloud KodExplorer up to 4.52 systemRole.class.php roleGroupAction group_role authorization
- CVE-2026-6572 | Collabora KodExplorer up to 4.52 fileUpload Endpoint share.class.php improper authorization
- CVE-2026-6574 | osuuu LightPicture up to 1.2.2 API Upload Endpoint /public/install/lp.sql key hard-coded credentials
- CVE-2026-6576 | liangliangyy DjangoBlog up to 2.1.0.0 WeChat Bot Interface commonapi.py CommandHandler Source command injection
- CVE-2026-6577 | liangliangyy DjangoBlog up to 2.1.0.0 logtracks Endpoint owntracks/views.py missing authentication
- CVE-2026-6578 | liangliangyy DjangoBlog up to 2.1.0.0 Setting djangoblog/settings.py SECRET_KEY hard-coded credentials
- CVE-2026-6579 | liangliangyy DjangoBlog up to 2.1.0.0 Clean Endpoint blog/views.py missing authentication
- CVE-2026-6580 | liangliangyy DjangoBlog up to 2.1.0.0 Amap API Call owntracks/views.py key hard-coded key
- CVE-2026-6581 | H3C Magic B1 up to 100R004 /goform/aspForm SetMobileAPInfoById param buffer overflow
- CVE-2026-6588 | serge-chat serge up to 1.4TB Model API Endpoint model.py download_model/delete_model missing authentication
- CVE-2026-6603 | modelscope agentscope up to 1.0.18 _python.py execute_python_code/execute_shell_command code injection
- CVE-2026-6604 | modelscope agentscope up to 1.0.18 Cloud Metadata Endpoint _openai_tools.py _parse_url/prepare_image/openai_audio_to_text image_url/audio_file_url server-side request forgery
- CVE-2026-6605 | modelscope agentscope up to 1.0.18 Internal Service _common.py _get_bytes_from_web_url server-side request forgery
- CVE-2026-6606 | modelscope agentscope up to 1.0.18 _agent_base.py _process_audio_block url server-side request forgery
Wired
- Hisense U7SG TV Review (2026): Better Design, Great Value
- Our Favorite Apple Watch Has Never Been Less Expensive
不安全
- $$, Looking for someone to hack into my boyfriends Facebook and messenger, willing to $$$
- Hacking pvp games for accessibility purposes.
- Security Questions Bypassed to Change User’s Password
- Tmobile rep
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
博客
- -march=generic vs -march=native
奇客Solidot–传递最新科技情报
- 人形机器人打破人类半马世界纪录
- 内存芯片短缺可能持续到 2030 年
白帽Wiki - 一个简单的wiki
- [2026]通过微调+MCP让小模型也能拥有大模型一样的知识
量子位 QbitAI
- Kimi新论文：把KVCache玩成新商业模式了
- 大模型架构的下半场
- 教龙虾玩手机！打通GUI智能体训练-评测-部署全流程，训练、真机、评测一站解决
- 横扫全球15项SOTA！高德首个面向AGI的全栈具身技术体系大公开
- 王濛代言的方盒子19万开卖，头顶激光雷达，底盘能“预瞄”路况
- 马斯克来抖音卖老干妈了？？
- 高德发布全球首个面向AGI的全栈具身技术体系“ABot”：15项SOTA，构建持续进化的具身智能闭环
- 黄仁勋都被问毛了：顶级AI厂商在去CUDA？“你的前提就是错的”
黑海洋
- 严禁向未成年人提供虚拟亲密关系服务
- 荣耀“闪电”获2026人形机器人半马冠军