安全资讯归档（2026-04-22）

2Libra
- Github Copilot pro/pro+ 下线 Claude opus 模型
- GPT-image-2 灰度了，你看到什么离谱的很真实的生成图？
- 【问题报告】微信无法打开 2 站网址
- 【💰】没做过体检，要不要先买保险再做？
- 为什么本地照片总是上传失败啊
- 五一大家都有什么安排？
- 你们的爸妈存在思想固化吗？
- 免费白嫖混果汁了
- 公司电脑加了系统级隐水印了
- 刷 B 站看到一个死装哥，脸都不要了，开源项目直接改
- 刷到两张图片，现在的 AI 真是一天一个新闻
- 吸尘器有无推荐
- 大佬们看下什么情况，上传图片失败
- 广东移动 token plan 免费体验包，有人抢到吗？
- 极氪 001 vs 小米 yu7
- 梯子 PC 客户端工具推荐
- 爱快_naixi 版
- 狐蒂云（szhdy.com）是否靠谱？
- 现在的中国，就是 30 年前的日本？从各方面看，太像了。
- 编码高手
- 编程 0 基础，用 codex 写的网站，有大神么指点一下
- 跟家里沟通说不回去了，五一不知道干啥。一个人发呆，跟家里沟通说我一个人出去玩结果跟我说还不如回家。
- 零跑这么厉害吗？半年内身边有两个朋友都买了零跑，没咋听过这车。
- 马斯克的 SpaceX 决定收购 Cursor ，今年晚些时候以 600 亿美元收购该公司。有钱就是太牛逼了。曺。
36氪
- *ST创兴：预计触及财务类终止上市情形
- 10天6板沃格光电：第一季度净亏损5110.30万元
- 15部门提出18项举措深化青年发展型城市建设
- 36氪研究院 | 2026年中国银发经济产业研究报告
- 4月22日人民币对美元中间价调贬41个基点
- 8点1氪丨MCN机构回应女孩挪用上千万打赏主播；苹果更换CEO原因曝光；国内油价2026年首次下调
- A股三大指数午间休盘集体上涨，长光华芯涨超18%
- A股三大指数集体低开，商业航天概念下挫
- A股三大指数集体收涨
- A股公司可转债再融资升温，监管“扶优限劣”严防盲目跨界投资
- GE Vernova一季度营收、每股收益均好于市场预期
- GPT-Image-2正式发布
- Keurig与雀巢续签协议，延续星巴克咖啡分销合作
- LG人工智能研究院与英伟达同意加强AI合作
- Meta拟追踪美员工��击及击键数据训练AI，官方称数据不用于绩效评估
- OpenAI据悉正洽谈向一家私募股权合资企业投资至多15亿美元
- SK海力士将投资19万亿韩元建设新的芯片工厂
- SpaceX宣布有权在今年晚些时候以600亿美元收购Cursor
- SpaceX放出“IPO重磅炸弹”：公司太空AI技术未经验证，未必能商业化
- TUMI途明“邂逅地中海”限时空间在上海港汇恒隆广场启幕
- VINFAST创始人：公司预计将于2027年实现息税前盈亏平衡
- “中科天塔”完成近亿元A+轮融资
- “奕行智能”完成15亿元B轮融资
- “恒宇医疗”获超亿元融资
- “欧拉万象”完成数千万元种子轮融资
- “清听声学”完成B+轮数亿元融资
- 《资产服务信托管理暂行办法（征求意见稿）》已下发
- 一季度公募基金重点增配信息技术等板块
- 一季度我国邮政行业寄递业务量同比增长4.5%
- 一季度长三角区域进出口总值创历史同期新高
- 三大指数集体翻红
- 东岳硅材：第一季度净利润同比增长427%，有机硅行业主要产品价格上涨
- 两市融资余额增加64.03亿元
- 中信建投：预计2027年钠电进入平价放量时代，碳酸锂涨价预期加速进程
- 中信证券：人形机器人放量在即，电机绕线设备快速发展
- 中信证券：医美行业当前竞争较为激烈，但结构性机会持续存在
- 中信证券：运动鞋服仍将是兼具高景气和清晰格局的优质消费赛道
- 中国摩托车商会：1—3月我国摩托车整车出口量同比增长13.49%
- 中国船舶：下属子公司签订约90亿元12艘9200TEU集装箱船建造合同
- 中天科技：若未来光纤光缆行业市场需求不及预期、核心原材料供应紧张或价格大幅波动，可能对公司产生影响
- 中油工程：2026年一季度新签合同额316.72亿元
- 乐聚智能IPO辅导状态变更为“辅导验收”
- 事关节能降碳工作，中办、国办重磅文件对外发布
- 京北方：控股股东终止协议转让公司3702.31万股股份
- 今日MMLC电池级碳酸锂（早盘）价格较昨日下跌1350元/吨
- 优德精密：2025年归母净利润791.77万元，同比下降42.20%
- 便利店运营商Yesway在美国首次公开募股中募得2.8亿美元
- 光库科技：一季度归母净利润4473.64万元，同比增长312.52%
- 全日空将在2027财年考虑对日本国内航班收取附加费
- 关键量子机制揭示芯片运行为何“变慢”
- 具微科技两个月狂揽4轮数亿元融资，产业资本“天团”强势入局 | 36氪首发
- 农业农村部：今日全国农产品批发市场猪肉平均价格为14.68元/公斤，比昨天下降0.7%
- 出门问问发布AI原生协作平台CodeBanana
- 券商交出资管业务“成绩单”，头部集中趋势有所加剧
- 北京圆心科技集团股份有限公司向港交所提交上市申请书
- 半日主力资金加仓电子板块，抛售传媒板块
- 华康医疗：中标1.06亿元下一代异构集成先进封装技术及DDIC项目工程总承包
- 华泰证券：关注光模块上游核心材料发展机遇
- 南京化纤：股票将于4月24日被实施退市风险警示
- 南钢股份：一季度归母净利润5.97亿元，同比增加3.23%
- 印尼央行关键利率维持在4.75%
- 印尼计划推出电动摩托车购买奖励计划
- 原子钟技术验证时间存在量子叠加态
- 厦钨新能：控股子公司拟7.34亿元投建年产4万吨磷酸铁（锰）锂项目
- 双向脑机接口同步恢复患者行走与感觉
- 口子窖：一季度净利润3.29亿元，同比下降46.16%
- 圆通速递：一季度归母净利润13.78亿元，同比增长60.76%
- 地平线发布舱驾融合芯片星空Starry 6P/6H
- 多家银行创新金融服务赋能人形机器人赛道
- 天孚通信：1.6T光引擎处于量产状态目前因为个别物料缺料尚未达到预期产量
- 央行今日开展60亿元7天期逆回购操作
- 奥特维：2025年归母净利润4.45亿元，同比下降64.64%
- 宁德时代：正与数家中国高端车企探讨凝聚态电池合作
- 宁德时代：钠电将在乘用车换电体系中率先搭载
- 宝洁公司已成功注册WHITELOCK商标
- 希音一季度向供应商交付自主研发工具设备1200件
- 并购整合夯实根基，券商协同价值持续兑现
- 广东：加快先进卫星平台、载荷及太空算力相关技术研发
- 广东：开发高能效人工智能芯片和异构计算架构
- 广东：推动整车企业积极按程序争取L3级自动驾驶车型准入和上路通行试点
- 广东：推动脑机接口和具身智能等人工智能前沿技术的融合
- 库克亮相苹果员工大会，称身体健康并计划长期担任执行董事长
- 张雪机车发布召回通告
- 微软下调Xbox Game Pass价格，取消《使命召唤》首发入库
- 德国汉莎航空将取消2万个夏季航班以节省燃油
- 德赛电池：拟投不超25亿开展消费电芯业务，项目达产后将形成年产2亿只消费类软包锂离子电芯产能
- 必和必拓：已与中国矿产资源集团完成铁矿石销售合同谈判
- 快手618商家大会于杭州启动
- 恒指午间休盘跌1.31%，恒生科技指数跌2.19%
- 恒指开盘跌0.69%，恒生科技指数跌1.02%
- 恒指收跌1.22%，恒生科技指数跌1.93%
- 恩捷股份：2025年净利润1.43亿元，同比扭亏为盈
- 成都交子期货公司增资至约6.4亿元
- 报告：65%的小额交易已发生在移动端
- 押注AAV体内CAR-T，「西湖云谷智药」即将启动IIT研究
- 拓斯达：一季度净利润4808.33万元，同比增长1147%
- 敷尔佳：一季度归母净利润1.72亿元，同比增加87.73%
- 新易盛午后涨逾4%，总市值突破6000亿
- 新氧与锦波生物达成战略合作
- 方邦股份：FCCL等产品的后续客户导入存在不确定性风险
- 晋控电力：一季度归母净利润6288.67万元，同比增长3.56%
- 景旺电子：第一季度净利润2.33亿元，同比下降28.37%
- 晶核能源与阳光新能源正式达成战略合作
- 智平方发布AlphaBrain Platform一站式具身智能模型开源社区
- 最前线｜华为猛士深化战略合作，新技术将逐步落地4款以上全新车型
- 机构：千问AI眼镜线上市场份额达53%，持续位居市场第一
- 杉杉股份：实际控制人将变更为安徽省国资委
- 果麦文化：一季度归母净利润亏损822.76万元，上年同期归母净利润亏损196.88万元
- 柳钢股份：筹划购买广西钢铁部分股权并募集配套资金，股票停牌
- 欢瑞世纪：因涉嫌信息披露违法违规被证监会立案
- 比特币升破78000美元
- 氪星晚报｜快手618商家大会于杭州启动；OpenAI据悉正洽谈向一家私募股权合资企业投资至多15亿美元；事关节能降碳工作，中办、国办重磅文件对外发布
- 永鼎股份：100G EML及硅光高功率芯片具备批量生产能力，启动扩产计划
- 汇丰或将寻求以至多20亿美元的价格出售汇丰人寿新加坡公司
- 汇丰新加坡寿险业务的竞购者名单据悉缩减至安联、第一生命和住友生命
- 沪指午后站上4100点
- 沪深两市成交额突破2.5万亿元
- 沪深两市成交额突破2万亿
- 沪电股份：一季度净利润同比增长62.90%
- 波音公司第一季度总营收为222亿美元，同比增长14%
- 洽洽食品：新采购季葵花籽采购价同比有所下降，坚果部分原料价格仍较坚挺
- 消息人士：Anthropic计划很快向欧洲的银行开放Mythos使用权限
- 热门中概股美股盘前涨跌不一，小鹏集团跌超1%
- 牧原股份：2026年公司对屠宰量级增长与盈利水平提升有信心
- 牧原股份：预计二季度生猪养殖成本仍会进一步下降
- 特斯拉AI语音功能即将上线
- 特朗普媒体科技集团任命凯文·麦格恩为临时首席执行官
- 环球音乐任命胡译友为中国董事总经理
- 现货白银向上触及78美元/盎司
- 甘咨询：一季度ESG咨询、绿色建筑认证等领域无相关订单落地
- 甘李药业：2025年归母净利润11.44亿元，同比增长86.05%
- 百度联盟发布“星云计划”，全面开放百度猎户座AI引擎
- 盛达资源：一季度净利同比预增745%-986%，矿山主要产品销售均价较上年同期上涨
- 看好权益资产后市，今年以来新发基金规模超3500亿元
- 秀强股份：目前不涉及玻璃基板业务
- 秋田微：暂未涉及印制电路板（PCB）产品领域
- 科达利：拟投12亿元建设江苏锂电池精密结构件四期项目
- 空港股份：2025年归母净利润亏损1.02亿元，同比亏损扩大
- 罗宾汉创投或向OpenAI投资7500万美元
- 美联储主席候选人沃什多次强调独立性，但对利率路径含糊其辞
- 美联航下调今年盈利预期
- 美股三大指数集体收跌，热门中概股普跌
- 美股大型科技股盘前普涨，谷歌涨超1%
- 腾讯与阿里巴巴洽谈投资DeepSeek，估值超过200亿美元
- 航天电器：子公司江苏奥雷的CPO项目正在推进，尚未实现商品化
- 航旅纵横：App各项功能已恢复正常
- 艾力斯：2025年净利润21.89亿元，同比增长53.10%
- 英力股份：一季度归母净利润亏损568.19万元，同比盈转亏
- 英国3月CPI同比上涨3.3%
- 英思特：一季度归母净利润亏损1262.44万元，同比盈转亏
- 英维克：全球2025年液冷渗透率已很高，但国内相对滞后
- 英维克：公司液冷相关业务收入持续快速增长
- 英维克：目前趋势来看，电子散热业务2026年增速会加快
- 英维克：经过产能扩张和优化后，当前产能已不是瓶颈制约
- 萤石发布搭“星辰世界模型”的蒸汽洗地机
- 蓝色光标：第一季度净利润1.26亿元，同比增长32.04%
- 蚂蚁百灵Ling-2.6-flash正式发布，定价每百万token 0.1美元
- 证监会主席吴清：加大力度支持北京科技创新和产业创新深度融合，推动科创板、创业板等改革在京落地见效
- 诺德股份：第一季度净利润为4008.97万元，同比扭亏为盈
- 谷歌云AI使用量达到每分钟160亿Tokens
- 谷歌云发布用于人工智能的新型TPU芯片
- 谷歌云推出7.5亿美元基金，助力合作伙伴加速智能体人工智能开发
- 财政部今日在港发行155亿元人民币国债
- 越南网约车公司GSM计划于2028年上市
- 迎驾贡酒：2025年归母净利润同比下降23.31%，拟10派15元
- 追觅硅谷发布会定档，4月27日-30日登陆北美
- 通用汽车据悉无限期推迟下一代电动皮卡项目
- 银行理财规模近三周累计增长4395亿元
- 锂矿企业重启“赚钱模式”
- 长盈精密：一季度归母净利润1.25亿元，同比下降28.39%
- 阿里巴巴发布千问AI数字人形象“千问小酒窝”
- 集成光路芯片能发出多种颜色激光
- 雪龙集团：股东贺频艳、贺群艳及宁波联展拟合计减持不超4.00%股份
- 震裕科技等在苏州成立星算科技公司
- 韩国3月份PPI环比上涨1.6%，创近四年最大涨幅
- 韩国现代重工签署价值5148亿韩元的销售和供应合同
- 韩国预计到2040年用电量将增长近30%
- 飞龙股份：第一季度净利润同比下降52.84%
- 高铁电气：第一季度净利润1227.21万元，同比增长150.92%
- 鲍斯股份：冷媒压缩机业务板块产品销售占比较少，暂不涉及液冷类产品
404 Media
- Podcast: How Algorithms Make Us Feel Bad and Weird
- Startups Brag They Spend More Money on AI Than Human Employees
Ars Technica
- Framework Laptop 13 Pro is a major overhaul for the modular, upgradeable laptop
- Framework Laptop 16 upgrades make it look less like an unfinished prototype
- Indian med student rakes in thousands with AI-generated MAGA hottie
- Microsoft removes Call of Duty from Game Pass, lowers subscription pricing
- Our favorite gear at Sea Otter Classic wasn't the bikes—it was the accessories
Blog - Praetorian
- 500,000 Vulnerabilities, 14 That Matter: How Exploit Chain Analysis Cuts Through the Noise
daniel.haxx.se
- High-Quality Chaos
daringfireball.net
- [Sponsor] Rec League
- Trump on Tim Apple
darkreading
- DPRK Fake Job Scams Self-Propagate in 'Contagious Interview'
- Exploits Turn Windows Defender into Attacker Tool
- Ransomware Negotiator Pleads Guilty to BlackCat Scheme
Der Flounder
- Apple enforcing stricter network security requirements for future versions of Apple’s platform operating systems
dfarq.homeip.net
- When Escom bought Commodore
Fidelis Security
- How to Detect & Prevent Remote Code Execution (RCE)
gilesthomas.com
- Writing an LLM from scratch, part 32m -- Interventions: conclusion
Hacker News Frontpage
- Books Are Not Remotely Too Expensive
- Britannica11.org – a structured edition of the 1911 Encyclopædia Britannica
- DuckDB 1.5.2 – SQL database that runs on laptop, server, in the browser
- Global growth in solar "the largest ever observed for any source"
- I'm Sick of AI Everything
- Iran claims US exploited networking equipment backdoors during strikes
- OpenAI reinvents Recall except everything is stored remotely
- Our eighth generation TPUs: two chips for the agentic era
- San Diego rents declined more than 19 of 20 top US markets after surge in supply
- Show HN submissions tripled and are now mostly vibe-coded
- Show HN: Daemons – we pivoted from building agents to cleaning up after them
- SpaceX Strikes Deal With Cursor for $60 Billion
- The Vercel breach: OAuth attack exposes risk in platform environment variables
HackerNews
- äšŒĺ…‹ĺ…°ćŁćŻĺ‘äż„ç˝—ć–Żé—´č°ćäž›ć•°ĺƒč™šĺ‡ Telegram č´Śĺˇçš„"ćœşĺ™¨äşşĺ†œĺœş"
- ćł•ĺ›˝ć”żĺşœćœşćž„çĄŽčŽ¤éĺ…ĽäžľďźŒéť‘ĺŽ˘ćĺ‡şĺ‡şĺ”Žć•°ćŽ
- ćœŞĺ—äżćŠ¤çš„ Perforce ćœĺŠĄĺ™¨ćš´éœ˛ä¸ťčŚçť„çť‡çš„ć•ć„Ÿć•°ćŽ
- ć–°ĺž‹ Lotus ć•°ćŽć“Śé™¤ĺ™¨č˘Ťç”¨äşŽć”ťĺ‡ťĺ§”ĺ†…ç‘žć‹‰čƒ˝ćşĺ’Œĺ…Źç”¨äş‹ä¸šĺ…Źĺ¸
- ĺ‹’ç´˘č˝Żäťśč°ˆĺˆ¤ĺ‘˜ć‰żčŽ¤ĺĺŠŠ 2023 ĺš´ BlackCat ć”ťĺ‡ť
HackerNoon
- Beyond the Tokenization Hype: How GCL New Energy and Pharos Are Putting Real Energy Assets on Chain
- The FBI Got Hacked. Here's What That Actually Means
herman.bearblog.dev
- The commodification of travel
Hexacorn
- Some unintelligent fun with ms-notepad protocol
ICT Security Magazine
- Attribuzione degli attacchi cyber: dal naming and shaming alle conseguenze giuridiche
- Da Internet of Things ad Intelligence of Things: analisi degli impatti della tecnologia nei servizi segreti e nell’antiterrorismo
- Sentenza Tribunale di Siracusa 338/2026: colpa grave per uso non verificato dell’IA negli atti processuali
- Sicurezza AI: i router LLM diventano il punto debole della supply chain (caso LiteLLM)
idiallo.com
- How to Come Up With Great Ideas
IEEE Spectrum
- Building an Interregional Transmission Overlay for a Resilient U.S. Grid
- What to Consider Before You Accept a Management Role
infosecurity-magazine.com
- Former Ransomware Negotiator Pleads Guilty to Working For BlackCat Cyber Gang
- NCSC Unveils SilentGlass, a Plug-In Device to Protect Monitors from Cyber-Attacks
- Researchers Uncover ProxySmart Software Powering 90+ SIM Farms
- Surge in Silent Subject Phishing Attacks Targets VIP Users
- Trojanized Android App Fuels New Wave of NFC Fraud
- UK Commits £90m for Cybersecurity and Pushes for ‘Resilience Pledge’
johndcook.com
- An AI Odyssey, Part 4: Astounding Coding Agents
MIT Technology Review
- Building agent-first governance and security
- Roundtables: Unveiling The 10 Things That Matter in AI Right Now
- The Download: introducing the 10 Things That Matter in AI Right Now
NVIDIA AI Blog
- From Rainforests to Recycling Plants: 5 Ways NVIDIA AI Is Protecting the Planet
Recent Commits to cve:main
- Update Wed Apr 22 11:21:14 UTC 2026
rtl-sdr.com
- Build a Cubesat Reviews a Discovery Drive Prototype and Sets up SatNOGS
- Hacking a Secondhand Marine Satellite Dish to Track Satellites with Gpredict
- RTL-SDR 433: A New Android App for Decoding 433 MHz Sensors with rtl_433
SANS Internet Storm Center, InfoCON: green
- [Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident, (Wed, Apr 22nd)
- ISC Stormcast For Wednesday, April 22nd, 2026 https://isc.sans.edu/podcastdetail/9902, (Wed, Apr 22nd)
Schneier on Security
- ICE Uses Graphite Spyware
Security Affairs
- Critical BRIDGE:BREAK flaws impact Lantronix and Silex Technology converters
- North Korea’s Lazarus APT stole $290M from Kelp DAO
- Ransomware negotiator caught secretly assisting BlackCat extortion scheme
- Venezuela energy sector targeted by highly destructive Lotus wiper
shkspr.mobi
- [RSS Club] How do you preserve an RSS feed?
simonwillison.net
- Changes to GitHub Copilot Individual plans
- Is Claude Code going to cost $100/month? Probably not - it's all very confusing
- Quoting Andreas Påhlsson-Notini
- Quoting Bobby Holley
- Where's the raccoon with the ham radio? (ChatGPT Images 2.0)
Sploitus.com Exploits RSS Feed
- Bug-Bounty-Hunting-Methodology-2026 exploit
- Exploit for Code Injection in Glpi-Project Glpi exploit
- Exploit for CVE-2026-26903 exploit
- Exploit for Improper Input Validation in Apache Tomcat exploit
- Exploit for Improper Input Validation in Microsoft exploit
- Exploit for Injection in Ghost exploit
- Exploit for Insufficient Granularity of Access Control in Microsoft exploit
- Exploit for Origin Validation Error in Apache Airflow_Providers_Amazon exploit
- Exploit for OS Command Injection in Fortinet Fortisandbox exploit
- Exploit for OS Command Injection in Webmin exploit
- Exploit for Race Condition in Microsoft exploit
- Exploit for Type Confusion in Handlebarsjs Handlebars exploit
- smartaudit exploit
- SQLi-Injection-Payloads exploit
- vulnscanx_v2 exploit
- xss-demo-blog exploit
TechCrunch
- A look at Tim Cook’s 15-year legacy as CEO of Apple
- AI Dungeon maker Latitude unveils Voyage, a platform for creating AI-powered RPGs
- AI is spitting out more potential drugs than ever. This start-up wants to figure out which ones matter.
- AI research lab NeoCognition lands $40M seed to build agents that learn like humans
- Apple’s Cal AI crackdown signals it’s still policing the App Store
- Apple’s John Ternus will run one of the world’s most powerful companies; the job is a minefield
- Cathie Woods’ ARK makes its first lead investment in startup Lucra — and it isn’t AI
- ChatGPT’s new Images 2.0 model is surprisingly good at generating text
- Clarifai deletes 3 million photos that OkCupid provided to train facial recognition AI, report says
- Duolingo is now giving free users access to advanced learning content
- Exclusive: Google deepens Thinking Machines Lab ties with new multi-billion-dollar deal
- Former Pinterest team redesigns email with Extra — and it’s actually good
- Google Maps is about to get a big dose of AI
- Meta will record employees’ keystrokes and use it to train its AI models
- OpenAI teams up with Infosys to bring AI tools to more businesses
- Redwood Materials lays off 10% in restructuring to chase energy storage business
- Sam Altman throws shade at Anthropic’s cyber model, Mythos: ‘fear-based marketing’
- Snap Map’s new ‘Place Loyalty’ badges will show the spots you visit most often
- SpaceX is working with Cursor and has an option to buy the startup for $60 billion
- SusHi Tech Tokyo isn’t a conference — it’s a deal room with 60,000 people
- The most interesting startups showcased at Google Cloud Next 2026
- Tim Cook is stepping down as CEO of Apple. Here’s a look at his 15-year legacy, from new products and services to China expansion.
- Unauthorized group has gained access to Anthropic’s exclusive cyber tool Mythos, report claims
- X makes it more expensive to post links through its API
The Decoder
- Anthropic manager hints that Pro and Max plans are outgrown by today's Claude workloads
- Google launches Deep Research and Deep Research Max agents to automate complex research
- Meta tracks US employees' clicks and keystrokes to train AI agents
- Musk's SpaceX bets $60 billion on Cursor to fix xAI's coding gap
- OpenAI's ChatGPT Images 2.0 thinks before it generates, adding reasoning and web search to image creation
- Unauthorized users breach Anthropic's restricted Mythos AI model
The DFIR Report
- Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting
The Verge
- AI backlash is coming for elections
- Anker made its own chip to bring AI to all its products
- Anthropic’s most dangerous AI model just fell into the wrong hands
- BMW’s flagship 7 Series gets its ‘Neue Klasse’ upgrade
- Call of Duty never made much sense for Xbox Game Pass
- Celebrities will be able to find and request removal of AI deepfakes on YouTube
- Dyson’s newest floor scrubber is already on sale for 20 percent off
- First vacuums — then the world
- Framework announces Laptop 13 Pro, ‘the MacBook Pro for Linux users’
- Framework’s first eGPUs turn its laptop into a desktop PC
- Framework’s Laptop 13 Pro launch event
- Govee’s new rechargeable table lamp is less than half the price of Hue’s
- ISS astronauts are getting new laptops
- It’s amazing how good Alienware’s $350 OLED monitor is
- Now Meta will track what employees do on their computers to train its AI agents
- OpenAI’s updated image generator can now pull information from the web
- Ordering with the Starbucks ChatGPT app was a true coffee nightmare
- Sony’s PlayStation 5 is $200 off for the first time since December
- SpaceX cuts a deal to maybe buy Cursor for $60 billion
- The AirPods are Tim Cook’s most underrated achievement
- The Mac is in good hands in Apple’s post-Cook era
- The year’s weirdest game is hard to explain and even harder to put down
- Tim Cook was an innovator — just not the Jobs kind
- Twelve South’s magnetic PowerBug charger is down to just $35
- X makes it 1,900 percent more expensive to post links
troyhunt.com
- Weekly Update 500
VulDB Recent Entries
- CVE-2017-20230 | NWCLARK Storable up to 3.04 on Perl retrieve_hook stack-based overflow (Issue 15831)
- CVE-2025-10354 | Semantic MediaWiki 5.0.2 URL Speciaal:GefacetteerdZoeken cross site scripting
- CVE-2025-15638 | ATRODO Net::Dropbear up to 0.13 on Perl libtomcrypt vulnerable third-party component
- CVE-2025-31981 | HCL BigFix Service Management 23 Discovery cleartext transmission (KB0127605)
- CVE-2025-41011 | PHP Point of Sale 19.4 specific_customer start_date_formatted/end_date_formatted cross site scripting
- CVE-2025-41029 | Zeon Global Tech Zeon Academy Pro POST Request continue-upload.php phonenumber sql injection
- CVE-2025-70420 | Genesys Latitude 25.1.0.420 sql injection
- CVE-2026-0539 | pcvisit Remote Host Modul up to 22.6.22.1329 on Windows Service Binary default permission
- CVE-2026-1354 | Zero Motorcycles Firmware up to 44 Update key exchange without entity authentication (icsa-26-111-06)
- CVE-2026-1379 | zinoui HTTP Headers Plugin up to 1.19.2 on WordPress Setting cross site scripting
- CVE-2026-1913 | gallagherwebsitedesign Gallagher Website Design Plugin up to 2.6.4 on WordPress Shortcode login_link cross site scripting
- CVE-2026-1930 | hanicker Emailchef Plugin up to 3.5.1 on WordPress Setting page_options_ajax_disconnect authorization
- CVE-2026-21571 | Atlassian Bamboo Data Center up to 9.6.24/10.2.17/12.1.5 Release Note os command injection
- CVE-2026-21999 | Oracle Database Server up to 23.26.1 XML Database improper authorization
- CVE-2026-22003 | Oracle Java SE/GraalVM Enterprise Edition Hotspot denial of service
- CVE-2026-22006 | Oracle PeopleSoft Enterprise HCM Human Resources 9.2 Employee Snapshot improper authorization
- CVE-2026-22007 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Security improper authorization
- CVE-2026-22008 | Oracle Java SE 25.0.1 Libraries improper authorization
- CVE-2026-22011 | Oracle Applications DBA up to 12.2.15 ADPatch access control
- CVE-2026-22013 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JGSS improper authorization
- CVE-2026-22014 | Oracle User Management up to 12.2.15 Business Events improper authorization
- CVE-2026-22016 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JAXP improper authorization
- CVE-2026-22018 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Libraries denial of service
- CVE-2026-22019 | Oracle PeopleSoft Enterprise HCM Shared Components 9.2 Person Search improper authorization
- CVE-2026-22021 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JSSE denial of service
- CVE-2026-22746 | Vmware Spring Security up to 7.0.4 DaoAuthenticationProvider UserDetails information disclosure
- CVE-2026-22747 | Vmware Spring Security up to 7.0.4 x.509 Certificate certificate validation
- CVE-2026-22748 | Vmware Spring Security up to 6.3.14/6.4.14/6.5.9/7.0.4 JWT Decoding NimbusJwtDecoder/NimbusReactiveJwtDecoder
- CVE-2026-22753 | Vmware Spring Security up to 7.0.4 improper authorization
- CVE-2026-22754 | Vmware Spring Security up to 7.0.4 Authorization Rule authorization
- CVE-2026-24176 | NVIDIA KAI Scheduler authorization
- CVE-2026-25542 | tektoncd pipeline up to 1.11.0 incorrect regex
- CVE-2026-26067 | October CMS up to 3.7.13/4.1.9 CSS Preprocessor File authorization
- CVE-2026-2714 | weblizar Institute Management Plugin up to 5.5 on WordPress Setting cross site scripting
- CVE-2026-27937 | October CMS up to 3.7.15/4.1.15 DataTable Widget cross site scripting
- CVE-2026-30452 | Textpattern CMS 4.9.0 txp_article.php duplicate-and-save article ID access control
- CVE-2026-31013 | Softwares ADPhonebook up to 4.0.1.0 ADPhonebook?Department=HR Search cross site scripting
- CVE-2026-31014 | Dovestones AD Self Update up to 4.0.0.4 Endpoint cross-site request forgery
- CVE-2026-31019 | Dolibarr ERP CRM up to 22.0.4 Website permission
- CVE-2026-31192 | Raindrop Bookmark Manager Web App 5.6.76.0 information disclosure
- CVE-2026-31434 | Linux Kernel up to 6.19.10 btrfs create_space_info_sub_group sub_group[] memory leak
- CVE-2026-31435 | Linux Kernel up to 6.18.20/6.19.10 netfs infinite loop
- CVE-2026-31436 | Linux Kernel up to 6.12.79/6.18.20/6.19.10 dmaengine llist_abort_desc null pointer dereference
- CVE-2026-31437 | Linux Kernel up to 6.18.20/6.19.10 fs/netfs/direct_write.c netfs_unbuffered_write null pointer dereference
- CVE-2026-31450 | Linux Kernel up to 6.19.10 ext4 ext4_inode_attach_jinode memory corruption
- CVE-2026-31452 | Linux Kernel up to 6.19.10 ext4 ext4_setattr denial of service
- CVE-2026-31464 | Linux Kernel up to 6.19.10 ibmvfc_discover_targets_done out-of-bounds
- CVE-2026-31466 | Linux Kernel up to 6.19.10 huge_memory softleaf_to_folio privilege escalation
- CVE-2026-31469 | Linux Kernel up to 6.19.10 virtio_net lib/percpu_counter.c free_old_xmit use after free
- CVE-2026-31488 | Linux Kernel up to 6.12.79/6.18.20/6.19.10 pre_validate_dsc use after free
- CVE-2026-31490 | Linux Kernel up to 6.19.10 xe_sriov_pf_migration_restore_produce use after free
- CVE-2026-31505 | Linux Kernel up to 6.12.79/6.18.20/6.19.10 iavf iavf_get_ethtool_stats out-of-bounds write
- CVE-2026-31520 | Linux Kernel up to 6.19.10 HID apple_report_fixup memory leak
- CVE-2026-31530 | Linux Kernel up to 6.12.79/6.18.20/6.19.10 cxl_detach_ep use after free
- CVE-2026-3298 | Python CPython up to 3.14.x on Windows sock_recvfrom_into nbytes out-of-bounds write (ID 148808)
- CVE-2026-3307 | GitHub Enterprise Server up to 3.20.0 Request Body owner_id authorization
- CVE-2026-33256 | PowerDNS Recursor up to 5.2.8/5.3.5/5.4.0 denial of service
- CVE-2026-33257 | PowerDNS Authoritative/DNSdist/Recursor denial of service
- CVE-2026-33258 | PowerDNS Recursor up to 5.2.8/5.3.5/5.4.0 Zone allocation of resources
- CVE-2026-33259 | PowerDNS Recursor up to 5.2.8/5.3.5/5.4.0 use after free
- CVE-2026-33260 | PowerDNS Authoritative/DNSdist/Recursor denial of service
- CVE-2026-33261 | PowerDNS Recursor up to 5.2.8/5.3.5/5.4.0 denial of service
- CVE-2026-33262 | PowerDNS Recursor up to 5.2.8/5.3.5/5.4.0 null pointer dereference
- CVE-2026-33518 | Esri Portal for ArcGIS 11.5 privileges assignment
- CVE-2026-33519 | Esri Portal for ArcGIS 11.4/11.5/12.0 privileges assignment
- CVE-2026-33600 | PowerDNS Recursor up to 5.2.8/5.3.5/5.4.0 null pointer dereference
- CVE-2026-33601 | PowerDNS Recursor up to 5.2.8/5.3.5/5.4.0 zoneToCache null pointer dereference
- CVE-2026-33812 | x-image font sfnt up to 0.38.x Font File Parser memory allocation
- CVE-2026-33813 | x-image up to 0.38.x on 32-bit WEBP Image Parser integer overflow
- CVE-2026-34266 | Oracle PeopleSoft Enterprise HCM Absence Management 9.2 improper authorization
- CVE-2026-34268 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Security improper authorization
- CVE-2026-34269 | Oracle PeopleSoft Enterprise PeopleTools up to 8.62 Portal improper authorization
- CVE-2026-34275 | Oracle Advanced Inbound Telephony up to 12.2.15 Administration Remote Code Execution
- CVE-2026-34277 | Oracle PeopleSoft Enterprise PeopleTools up to 8.62 Fluid Core improper authorization
- CVE-2026-34279 | Oracle Enterprise Manager Base Platform 13.5/24.1 Event Management privilege escalation
- CVE-2026-34280 | Oracle PeopleSoft Enterprise HCM Human Resources 9.2 Job Profile Manager improper authorization
- CVE-2026-34282 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Networking denial of service
- CVE-2026-34285 | Oracle Identity Manager Connector 12.2.1.4.0 Core improper authorization
- CVE-2026-34286 | Oracle Identity Manager Connector 12.2.1.4.0 Core improper authorization
- CVE-2026-34287 | Oracle Identity Manager Connector 12.2.1.4.0 Core improper authorization
- CVE-2026-34288 | Oracle Identity Manager Connector 12.2.1.4.0 Core improper authorization
- CVE-2026-34289 | Oracle Identity Manager Connector 12.2.1.4.0 Core improper authorization
- CVE-2026-34291 | Oracle HTTP Server 12.2.1.4.0/14.1.2.0.0 Core improper authorization
- CVE-2026-34292 | Oracle WebLogic Server 12.2.1.4.0/14.1.1.0.0 Core privilege escalation
- CVE-2026-34294 | Oracle Identity Manager Connector 12.2.1.4.0 Microsoft Active Directory improper authorization
- CVE-2026-34295 | Oracle PeopleSoft Enterprise SCM Purchasing 9.2 improper authorization
- CVE-2026-34297 | Oracle HCM Common Architecture up to 12.2.15 Knowledge Integration improper authorization
- CVE-2026-34298 | Oracle Applications Framework up to 12.2.15 Personalization denial of service
- CVE-2026-34299 | Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 Work Order Management improper authorization
- CVE-2026-34300 | Oracle PeopleSoft Enterprise FIN Contracts 9.2 improper authorization
- CVE-2026-34301 | Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 Work Order Management improper authorization
- CVE-2026-34302 | Oracle Workflow up to 12.2.15 Loader denial of service
- CVE-2026-34305 | Oracle WebLogic Server 12.2.1.4.0/14.1.1.0.0/14.1.2.0.0/15.1.1.0.0 improper authorization
- CVE-2026-34306 | Oracle PeopleSoft Enterprise FIN Project Costing 9.2 Projects improper authorization
- CVE-2026-34307 | Oracle PeopleSoft Enterprise PeopleTools up to 8.62 Workflow improper authorization
- CVE-2026-34309 | Oracle PeopleSoft Enterprise PeopleTools up to 8.62 Security improper authorization
- CVE-2026-34315 | Oracle WebLogic Server 12.2.1.4.0/14.1.1.0.0/14.1.2.0.0/15.1.1.0.0 Web Service improper authorization
- CVE-2026-34325 | Oracle Financial Services Analytical Applications Infrastructure Oracle Financial Service Local Privilege Escalation
- CVE-2026-35451 | twentyhq twenty up to 1.20.5 FileBlock cross site scripting (GHSA-7w89-7q26-gj7q)
- CVE-2026-37748 | Visitor Management System 1.0 admin_user_insert.php move_uploaded_file unrestricted upload
- CVE-2026-40050 | CrowdStrike LogScale Self-Hosted up to 1.235.0 API Endpoint missing authentication
- CVE-2026-40161 | tektoncd pipeline up to 1.10.0 insertion of sensitive information into sent data (ID 9608)
- CVE-2026-40279 | bacnet-stack BACnet Stack up to 1.4.2 src/bacnet/bacint.c decode_signed32 reliance on undefined, unspecified, or implementation-defined behavior (GHSA-326g-j95f-gmxv)
- CVE-2026-40343 | Free5GC up to 1.4.2 UDR Service subs-to-notify unusual condition (GHSA-jwch-w7wh-gqjm)
- CVE-2026-40344 | MinIO up to 2023-05-18/2026-04-11 improper authentication (GHSA-9c4q-hq6p-c237)
- CVE-2026-40372 | Microsoft ASP.NET Core up to 10.0.6 signature verification
- CVE-2026-40448 | Samsung Open Source ONE up to 1.29.x integer overflow
- CVE-2026-40449 | Samsung Open Source ONE up to 1.29.x integer overflow
- CVE-2026-40450 | Samsung Open Source ONE up to 1.29.x integer overflow
- CVE-2026-40451 | DeepL Chrome Browser Extension 1.22.x cross site scripting (GHSA-4x2r-q3p9-xhx4)
- CVE-2026-40498 | freescout-help-desk freescout up to 1.8.212 GET Request /system/cron information disclosure
- CVE-2026-40565 | freescout-help-desk freescout up to 1.8.212 HTML Attribute app/Misc/Helper.php linkify HTML injection (GHSA-49pm-xwqj-vwjp)
- CVE-2026-40567 | freescout-help-desk freescout up to 1.8.212 From {%customer.fullName%} cross site scripting (GHSA-q8v4-v62h-5528)
- CVE-2026-40568 | freescout-help-desk freescout up to 1.8.212 Conversation app/Misc/Helper.php stripDangerousTags cross site scripting (GHSA-w2f5-6wcv-677r)
- CVE-2026-40569 | freescout-help-desk freescout up to 1.8.212 Mailbox Connection Settings Endpoint MailboxesController.php connectionIncomingSave access control (GHSA-hmqm-33wp-858j)
- CVE-2026-40574 | oauth2-proxy OAuth2 Proxy up to 7.15.1 authorization (GHSA-c5c4-8r6x-56w3)
- CVE-2026-40575 | oauth2-proxy OAuth2 Proxy up to 7.15.1 authentication spoofing (GHSA-7x63-xv5r-3p2x)
- CVE-2026-40576 | haris-musa excel-mcp-server up to 0.1.7 get_excel_path filepath path traversal (GHSA-j98m-w3xp-9f56)
- CVE-2026-40583 | UltraDAGcom Core 0.1 Transaction SmartOp::Vote cleanup (GHSA-q8wx-2crx-c7pp)
- CVE-2026-4076 | felipermendes Slider Bootstrap Carousel Plugin up to 1.0.7 on WordPress Shortcode extract Category cross site scripting
- CVE-2026-4082 | erithq ER Swiffy Insert Plugin up to 1.0.0 on WordPress Shortcode extract cross site scripting
- CVE-2026-40869 | Decidim up to 0.30.4/0.31.0 privileges assignment (GHSA-w5xj-99cg-rccm)
- CVE-2026-40870 | decidim up to 0.30.4/0.31.0 Setting /api Decidim::Apiauth commentable authorization (GHSA-ghmh-q25g-gxxx)
- CVE-2026-40871 | mailcow mailcow-dockerized prior 2026-03b API quarantine_category input validation (GHSA-r8fq-wrfm-cj2q)
- CVE-2026-40872 | mailcow mailcow-dockerized prior 2026-03b EMailAddress cross site scripting (GHSA-f9xf-vc72-rcgm)
- CVE-2026-40873 | mailcow mailcow-dockerized prior 2026-03b Attachment cross site scripting (GHSA-2xjc-rg88-jvpp)
- CVE-2026-40874 | mailcow mailcow-dockerized prior 2026-03b Mail Service access control (GHSA-jjxh-rm7p-hjc3)
- CVE-2026-40875 | mailcow mailcow-dockerized prior 2026-03b Login History cross site scripting (GHSA-jprq-w83q-q62h)
- CVE-2026-40876 | patrickhener goshs up to 2.0.0-beta.5 sftpserver/sftpserver.go DefaultHandler.GetHandler path traversal (GHSA-5h6h-7rc9-3824)
- CVE-2026-40878 | mailcow mailcow-dockerized prior 2026-03b Web Interface setLang REQUEST_URI cross site scripting (GHSA-xv9r-j862-5hqf)
- CVE-2026-40879 | nestjs nest up to 11.1.18 JSON Message handleData recursion (GHSA-hpwf-8g29-85qm)
- CVE-2026-4088 | wpshouter Switch CTA Box Plugin up to 1.1 on WordPress Shortcode wppw_cta_box cross site scripting
- CVE-2026-40883 | patrickhener goshs 2.0.0-beta.4/2.0.0-beta.5 cross-site request forgery (GHSA-jrq5-hg6x-j6g3)
- CVE-2026-40884 | patrickhener goshs up to 2.0.0-beta.5 SFTP Service missing authentication (GHSA-c29w-qq4m-2gcv)
- CVE-2026-40885 | patrickhener goshs 2.0.0-beta.4/2.0.0-beta.5 Request Header information disclosure (GHSA-7h3j-592v-jcrp)
- CVE-2026-40887 | vendurehq vendure up to 2.3.3/3.5.6/3.6.1 Vendure Shop API sql injection
- CVE-2026-40888 | Frappe hrms up to 15.58.0/16.4.0 API Endpoint access control (GHSA-4375-7rxj-9hfx)
- CVE-2026-40889 | frappe hrms up to 15.58.1/16.4.1 API Endpoint access control (GHSA-6cg5-4q6m-vrgm)
- CVE-2026-4089 | johnnie2u Twittee Text Tweet Plugin up to 1.0.8 on WordPress Shortcode ttt_twittee_tweeter ID cross site scripting
- CVE-2026-40890 | gomarkdown out-of-bounds (GHSA-77fj-vx54-gvh7)
- CVE-2026-40892 | pjsip pjproject up to 2.16 pjsip_auth_create_digest2 stack-based overflow
- CVE-2026-40895 | follow-redirects up to 1.15.x information disclosure
- CVE-2026-4090 | ravster Inquiry cart Plugin up to 3.4.2 on WordPress Setting rd_ic_settings_page cross-site request forgery
- CVE-2026-40903 | patrickhener goshs up to 2.0.0-beta.5 GITHUB_TOKEN inclusion of functionality from untrusted control sphere
- CVE-2026-40905 | Kovah LinkAce up to 2.5.3 redirect
- CVE-2026-40906 | electric-sql electric up to 1.4.x ORDER /v1/shape order_by sql injection
- CVE-2026-40907 | WWBN AVideo up to 29.0 list.json.php authorization (GHSA-gpgp-w4x2-h3h7)
- CVE-2026-40908 | WWBN AVideo up to 29.0 git.json.php information disclosure (GHSA-52hf-63q4-r926)
- CVE-2026-40909 | WWBN AVideo up to 29.0 Locale Save Endpoint locale/save.php fwrite flag path traversal (GHSA-6rc6-p838-686f)
- CVE-2026-40910 | fatedier frp up to 0.68.0 Authorization Header improper authentication
- CVE-2026-40911 | WWBN AVideo up to 29.0 JSON Message script.js eval msg/callback code injection
- CVE-2026-40923 | tektoncd pipeline up to 1.11.0 Restrictions path traversal (GHSA-rx35-6rhx-7858)
- CVE-2026-40924 | tektoncd pipeline up to 1.11.0 Function Call resource consumption (GHSA-m2cx-gpqf-qf74)
- CVE-2026-40925 | WWBN AVideo up to 29.0 configurationUpdate.json.php User::isAdmin cross-site request forgery
- CVE-2026-40926 | WWBN AVideo up to 29.0 JSON Endpoint categoryAddNew.json.php canCreateCategory cross-site request forgery (GHSA-ffw8-fwxp-h64w)
- CVE-2026-40927 | Docmost up to 0.79.x javascript URI cross site scripting (GHSA-4gv6-jw3v-wc34)
- CVE-2026-40928 | WWBN AVideo up to 29.0 JSON Endpoint comments_like.json.php cross-site request forgery (GHSA-x2pw-9c38-cp2j)
- CVE-2026-40929 | WWBN AVideo up to 29.0 JSON Endpoint commentDelete.json.php forbidIfIsUntrustedRequest cross-site request forgery (GHSA-8qm8-g55h-xmqr)
- CVE-2026-40931 | node-modules compressing up to 1.10.4/2.1.0 Symbolic Links link following (GHSA-4c3q-x735-j3r5)
- CVE-2026-40933 | FlowiseAI Flowise up to 3.0.x /tmp/pwn os command injection
- CVE-2026-40935 | WWBN AVideo up to 29.0 objects/getCaptcha.php Captcha::validation (GHSA-hg7g-56h5-5pqr)
- CVE-2026-40938 | tektoncd pipeline up to 1.11.0 validateRepoURL argument injection (GHSA-94jr-7pqp-xhcq)
- CVE-2026-40939 | datasharingframework dsf up to 2.0.x Access Token session expiration (GHSA-gj7p-595x-qwf5)
- CVE-2026-40942 | datasharingframework dsf/dsf-bpe-process-api-v2/dsf-bpe-server up to 2.0.x OIDC Provider control flow (GHSA-xmj9-7625-f634)
- CVE-2026-40943 | oxia-db oxia up to 0.16.1 heartbeat race condition (GHSA-5gqc-qhrj-9xw8)
- CVE-2026-40944 | oxia-db oxia up to 0.16.1 Certificate Chain trustedCertPool certificate validation (GHSA-7jrq-q4pq-rhm6)
- CVE-2026-40945 | oxia-db oxia up to 0.16.1 log file (GHSA-pm7q-rjjx-979p)
- CVE-2026-40946 | oxia-db oxia up to 0.16.1 improper authentication
- CVE-2026-41055 | WWBN AVideo up to 25.x HTTP Request isSSRFSafeURL server-side request forgery (GHSA-793q-xgj6-7frp)
- CVE-2026-41056 | WWBN AVideo up to 29.0 API Endpoint objects/functions.php allowAll cross-domain policy (GHSA-ccq9-r5cw-5hwq)
- CVE-2026-41057 | WWBN AVideo up to 29.0 API Endpoint plugin/API/router.php origin validation (GHSA-ff5q-cc22-fgp4)
- CVE-2026-41058 | WWBN AVideo up to 29.0 CloneSite unlink deleteDump path traversal (GHSA-5879-4fmr-xwf2)
- CVE-2026-41059 | oauth2-proxy OAuth2 Proxy up to 7.15.1 Request skip_auth_routes authentication bypass (GHSA-pxq7-h93f-9jrg)
- CVE-2026-41060 | WWBN AVideo up to 29.0 Response Body objects/functions.php isSSRFSafeURL server-side request forgery (GHSA-j432-4w3j-3w8j)
- CVE-2026-41061 | WWBN AVideo up to 29.0 objects/video.php isValidDuration cross site scripting (GHSA-8pv3-29pp-pf8f)
- CVE-2026-41062 | WWBN AVideo up to 29.0 Query String aVideoEncoderReceiveImage.json.php try_get_contents_from_local url path traversal (GHSA-f4f9-627c-jh33)
- CVE-2026-41063 | WWBN AVideo up to 29.0 Markdown Link ParsedownSafeWithLinks cross site scripting (GHSA-72h5-39r7-r26j)
- CVE-2026-41064 | WWBN AVideo up to 29.0 URL Validation test.php file_get_contents os command injection (GHSA-3fpm-8rjr-v5mc)
- CVE-2026-41126 | BigBlueButton up to 3.0.23 Requests logoutURL redirect (GHSA-cvwj-4pcp-f3g8)
- CVE-2026-41127 | BigBlueButton up to 3.0.23 authorization (GHSA-q387-2q28-mg33)
- CVE-2026-41128 | Craft CMS up to 5.9.14 Group Membership actionSavePermissions authorization (GHSA-jq2f-59pj-p3m3)
- CVE-2026-41129 | Craft CMS up to 4.17.8/5.9.14 GraphQL Schema server-side request forgery (GHSA-3m9m-24vh-39wx)
- CVE-2026-41130 | Craft CMS up to 4.17.8/5.9.14 Host actionResourceJs server-side request forgery (GHSA-95wr-3f2v-v2wh)
- CVE-2026-41131 | OpenFGA up to 1.14.0 authorization (GHSA-57j5-qwp2-vqp6)
- CVE-2026-41133 | pyLoad up to 0.5.0b3.dev97 session expiration (GHSA-66hx-chf7-3332)
- CVE-2026-41135 | Free5GC up to 1.4.2 PCF SBI Interface router.Use resource consumption (GHSA-98cp-84m9-q3qp)
- CVE-2026-41136 | free5gc up to 1.4.2 AMF api_communication.go HTTPUEContextTransfer expected behavior violation (GHSA-r99v-75p9-xqm5)
- CVE-2026-41144 | NASA Fprime up to 4.1.x DataPacket Svc/FileUplink/File.cpp integer overflow (GHSA-qmvv-rxh4-ccqh)
- CVE-2026-41145 | MinIO up to 2026-04-11 improper authentication (GHSA-hv4r-mvr4-25vw)
- CVE-2026-41146 | boazsegev facil.io/iodine JSON fio_json_parse resource consumption (GHSA-2x79-gwq3-vxxm)
- CVE-2026-4118 | tmarek Call To Action Plugin up to 3.1.3 on WordPress cbox_options_page cross-site request forgery
- CVE-2026-4125 | wpmkorg WPMK Block Plugin up to 1.0.1 on WordPress Shortcode wpmk_block_shortcode cross site scripting
- CVE-2026-4126 | primisdigital Table Manager Plugin up to 1.0.0 on WordPress Shortcode tablemanager_render_table_shortcode information disclosure
- CVE-2026-4128 | tplugins TP Restore Categories and Taxonomies Plugin up to 1.0.1 on WordPress AJAX profile.php delete_term authorization
- CVE-2026-41304 | WWBN AVideo up to 29.0 cloneServer.json.php exec url command injection (GHSA-xr6f-h4x7-r6qp)
- CVE-2026-4131 | sphex1987 WP Responsive Popup and Optin Plugin up to 1.4 on WordPress Setting wpo_admin_page.php wpo_image_url cross-site request forgery
- CVE-2026-41320 | Frappe hrms up to 14.38.0/15.53.x Request sql injection (GHSA-745c-5q8r-vgj2)
- CVE-2026-4133 | textp2p TextP2P Texting Widget Plugin up to 1.7 on WordPress imTextP2POptionPage cross-site request forgery
- CVE-2026-4138 | nofearinc DX Unanswered Comments Plugin up to 1.7 on WordPress Setting dxuc-unanswered-comments-admin-page.php dxuc_authors_list cross-site request forgery
- CVE-2026-4139 | chsxf mCatFilter Plugin up to 0.5.2 on WordPress compute_post cross-site request forgery
- CVE-2026-4140 | anzia Ni WooCommerce Order Export Plugin up to 3.1.6 on WordPress AJAX ni_order_export_action cross-site request forgery
- CVE-2026-4142 | eazyserver Sentence To SEO Plugin up to 1.0 on WordPress Setting update_option cross site scripting
- CVE-2026-41457 | owntone owntone-server up to 29.0.x Expressions sql injection
- CVE-2026-41458 | owntone owntone-server up to 29.0.x /login race condition
- CVE-2026-41527 | KDE Kleopatra up to 26.7.x on Windows control flow
- CVE-2026-41651 | PackageKit up to 1.3.4 src/pk-transaction.c InstallFiles toctou
- CVE-2026-41664 | Samsung Open Source ONE 1.30.0 Tensor Shape integer overflow
- CVE-2026-41665 | Samsung Open Source ONE up to 1.29.x integer overflow
- CVE-2026-41666 | Samsung Open Source ONE up to 1.29.x integer overflow
- CVE-2026-41667 | Samsung Open Source ONE up to 1.29.x integer overflow
- CVE-2026-4279 | breadbutter Bread & Butter: AI-Powered Lead Intelligence Plugin Shortcode customEventShortCodeButton cross site scripting
- CVE-2026-4280 | doctorwp Breaking News WP Plugin up to 1.3 on WordPress AJAX Endpoint include brnwp_theme path traversal
- CVE-2026-4296 | GitHub Enterprise Server up to 3.20.0 incorrect regex
- CVE-2026-4353 | cihubconnector CI HUB Connector Plugin up to 1.2.106 on WordPress Shortcode cihub_metadata cross site scripting
- CVE-2026-4821 | GitHub Enterprise Server up to 3.20.0 Proxy Configuration os command injection
- CVE-2026-5398 | FreeBSD Terminal use after free
- CVE-2026-5512 | GitHub Enterprise Server up to 3.20.0 API Endpoint insertion of sensitive information into sent data
- CVE-2026-5652 | Arcadia Crafty Controller up to 4.10.2 Users API authorization
- CVE-2026-5748 | snedled Text Snippets Plugin up to 0.0.1 on WordPress Shortcode cross site scripting
- CVE-2026-5749 | Fullstep up to 5.30.06 API missing authentication
- CVE-2026-5750 | Fullstep up to 5.30.06 Endpoint false authorization
- CVE-2026-5767 | luetkemj SlideShowPro SC Plugin up to 1.0.2 on WordPress Shortcode slideShowProSC cross site scripting
- CVE-2026-5789 | CivetWeb 1.16 CivetWeb.exe unquoted search path
- CVE-2026-5820 | sproutient Zypento Blocks Plugin up to 1.06 on WordPress cross site scripting
- CVE-2026-5845 | GitHub Enterprise Server up to 3.20.0 ghu_ authorization
- CVE-2026-5921 | GitHub Enterprise Server up to 3.20.0 Notebook Rendering Service server-side request forgery
- CVE-2026-6041 | mixer2 Buzz Comments Plugin up to 0.9.4 on WordPress Setting buzz_comments_avatar_image cross site scripting
- CVE-2026-6235 | Sendmachine for WordPress Plugin up to 1.0.20 on WordPress Password Reset manage_admin_requests authorization
- CVE-2026-6236 | lucdecri Posts map Plugin up to 0.1.3 on WordPress Shortcode cross site scripting
- CVE-2026-6246 | mkerstner Simple Random Posts Shortcode Plugin up to 0.3 on WordPress simple_random_posts container_right_width cross site scripting
- CVE-2026-6294 | byybora Google PageRank Display Plugin up to 1.4 on WordPress Google Page gpdisplay_option cross-site request forgery
- CVE-2026-6355 | Augmentt Web Application 1.0 access control
- CVE-2026-6356 | Augmentt Web Application 1.0 insufficient granularity of access control
- CVE-2026-6386 | FreeBSD Kernel pmap_pkru_update_range privileges management
- CVE-2026-6392 | Tanium Threat Response up to 4.6.576/4.9.378 information disclosure (TAN-2026-011)
- CVE-2026-6396 | webarea Fast & Fancy Filter Plugin up to 1.2.2 on WordPress Setting saveFields cross-site request forgery
- CVE-2026-6408 | Tanium Server prior 7.6.4.2185/7.7.3.8266/7.8.2.1168 insufficiently protected credentials (TAN-2026-012)
- CVE-2026-6416 | Tanium Interact up to 3.2.201/3.5.107/3.8.46 resource consumption (TAN-2026-010)
- CVE-2026-6819 | HKUDS OpenHarness up to 155 Plugin Installation /plugin default permission
- CVE-2026-6823 | HKUDS OpenHarness up to 146 Configuration default permission
- CVE-2026-6829 | nesquena hermes-webui up to PR #415 /api/ path traversal
- CVE-2026-6830 | nesquena hermes-webui up to 350 Environment Variable exposure of resource
- CVE-2026-6832 | nesquena hermes-webui up to 408 JSON File /api/session/delete session_id path traversal
- CVE-2026-6833 | aEnrich a+HRD up to 7.1 sql injection
- CVE-2026-6834 | aEnrich a+HRD up to 7.1 authorization
- CVE-2026-6835 | aEnrich a+HCM up to 8.1 unrestricted upload
- CVE-2026-6839 | Samsung Open Source ONE up to 1.29.x improper validation of specified quantity in input
- CVE-2026-6840 | Samsung Open Source ONE up to 1.29.x Model Loading array index
- CVE-2026-6843 | nano statusline format string
- CVE-2026-6844 | GNU Binutils readelf resource consumption
- CVE-2026-6845 | GNU Binutils readelf null pointer dereference
- CVE-2026-6846 | GNU Binutils XCOFF heap-based overflow
- CVE-2026-6855 | Red Hat Enterprise Linux AI 3 logs_dir path traversal
- CVE-2026-6857 | Apache camel-infinispan deserialization
- CVE-2026-6859 | Red Hat Enterprise Linux AI 3 linux_train.py inclusion of functionality from untrusted control sphere
Vulnerabilities and Threat Research – Qualys Security Blog
- Oracle Critical Patch Update, April 2026 Security Update Review
Wallarm
- Attacking the MCP Trust Boundary
wheresyoured.at
- Four Horsemen of the AIpocalypse
- News: Anthropic Removes Claude Code From $20-A-Month "Pro" Subscription Plan For New Users (Developing)
Wired
- 10% Dell Coupon Codes | April 2026
- 30% Off Tempur-Pedic Promo Codes | April 2026
- Barkbox Promo Codes and Discounts: Up to 50% Off
- Beatbot Sora 30 Review: Midrange Price, High-End Results
- Best Chromebooks (2026): Most Are Bad, but These Aren't
- Framework Has a Better, More Take-Apart-Able Laptop
- HBO Max Promo Code: 50% Off | April
- iRobot Promo Code: 15% Off
- L.L.Bean Promo Codes and Deals: Up to 75% Off Outdoor Gear
- Lenovo Coupon Codes: 50% Off
- Loop Earplugs Discount Codes: 40% Off
- Lowe’s Promo Codes and Deals: Up to $300 Off Appliances
- Mattress Firm Coupons and Discounts: Save Up to $600
- Meta Is Sued Over Scam Ads on Facebook and Instagram
- Mozilla Used Anthropic’s Mythos to Find and Fix 151 Bugs in Firefox
- New Gas-Powered Data Centers Could Emit More Greenhouse Gases Than Entire Nations
- Newegg Promo Code: 10% Off in April 2026
- Norton Coupon Codes: Up to 58% Off
- Ranking the Best Red Light Therapy Mask and LED Devices of 2026
- Starz Promo Codes & Deals: Get a Discount This April 2026
- TAG Heuer Has Dropped New Polylight-Powered F1s
- Tempo Promo Code: 60% Off Ready-to-Heat Meals in April 2026
- The Best Casio Watches You Can Wear Anywhere
- The Pope’s Warnings About AI Were AI-Generated, a Detection Tool Claims
- Tim Cook’s Legacy Is Turning Apple Into a Subscription
- Tuft & Needle Promo Codes: 20% Off | April 2026
- Ulta Promo Codes: Up to 50% Off in April
- USAID Whistleblower Says It Was Even Worse Than People Knew
- Valvoline Coupons & Promo Codes for April 2026
- Vitamix Promo Codes and Deals: $25 Off + Free Shipping
- Walmart Promo Codes: 65% Off
不安全
- Build a Cubesat Reviews a Discovery Drive Prototype and Sets up SatNOGS
- Responsible disclosure report: 180 vulnerabilities in Samsung preinstalled apps
- “四道防线”理念守护AI Agentic应用安全
- 安装4月更新后Windows 11会显示设备是否已经应用2023安全启动证书
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
奇客Solidot–传递最新科技情报
- Firefox 150 释出
- Meta 开始记录员工鼠标移动和按键用于 AI 训练
- SpaceX 达成协议可选以 600 亿美元收购 Cursor
- 中国选拔出两名巴基斯坦预备宇航员
- 微软降低 Game Pass 订阅费
- 英国 17 岁以下儿童终身禁止购烟
爱范儿
- 6 分钟充满！宁德时代发布四款全新电池，续航突破 1500 公里
- 三车齐发！荣威联手字节跳动，推出全新「家越」序列
- 早报｜GPT Image 2全量上线，中文渲染大突破/OPPO发布多款新机，刘作虎：无法承诺全年不涨价/长安汽车宣布整合阿维塔与深蓝
绿盟科技技术博客
- “四道防线”理念守护AI Agentic应用安全
量子位 QbitAI
- 2026萤石品牌新品发布会：驭智向前锚定长期主义，AI驱动多点开花
- 6分钟满电续航1500公里！宁王一夜终结加油时代
- 从GPU到Token：AI基础设施竞争逻辑重构
- 全球首个世界统一模型发布，机器人家庭成员来了！
- 单Agent时代结束，AI们开始组团上班
- 国产多模态Agent拿下医学分割SOTA！不用改模型、不加token
- 大厂AI抢人大战，从实习生开始
- 神秘模型「大象」：仅100B拿下SOTA，Token效率超高！
- 这些人读个博一年能挣几十万？2026苹果学者名单公布了
- 香港科创标杆奖项！商汤首席科学家林达华荣获中银香港科创奖
黑海洋
- Meta将记录员工的按键数据用于训练AI模型
- Mozilla 使用 Claude Mythos 找到并修复了 Firefox 中的 271 个漏洞
- OpenAI在佛罗里达州遭刑事调查涉及枪击案
- X向Premium用户推出由AI自定义时间线
- 勒索软件谈判专家承认帮助勒索软件团伙
- 日产三月份在华新车销量逆势增长23%
- 美国军方在沙特部署乌克兰反无人机系统
- 谷歌内部政治导致其在AI编程领域落后