安全资讯归档（2026-04-24）

2Libra
- Summa 作者又发新项目了，Hermes 可以快速搜索数百万文档
- xdm 教教我这个钢铁直男怎么找女朋友吧
- 【周末闲聊】浦江夜色 & 近期的一人食
- 【羊毛】移动 app 对灵犀 AI 助手发送【充上就出发】可领话费卷
- 【💰】deepwiki 能查看旧版本的文档吗
- 【💰】X 上值得关注的
- 你们的 Ai 编码都用官方订阅吗？
- 你使用 DeepSeek V4 觉得超出预期了吗？
- 你有哪些外语个人语言学习经验，给提点语言学习建议！
- 做一个开源小项目得到最大的感触：写代码只占 30%，剩下 70% 都在写文档、做演示、搞推广... 你们做开源项目也是这样吗？
- 准备自驾云南，请老哥们建议，主打听劝
- 又被套路云套路了
- 各位对于花钱是如何控制的
- 哈哈，这次轮到我中了
- 在物质越来越富足的时代，为什么人反而越来越难感到真正的快乐与安宁？？
- 地主家也没有余粮了……免费版的 Grok 基本不可用
- 大家五一什么打算？
- 怎么查看等级对应的权限
- 才知道小时候用的 999 皮炎平实际上就是地塞米松
- 找不到工作了，这周一个面试都没有
- 新发现了个摸鱼网站:煎蛋网;感觉运营的挺好的,现在就用 2 站 v2 和这个煎蛋了还有什么好玩的网站推荐吗
- 求推荐头戴耳机
- 温子仁的恐怖影片有点让人无语
- 现在的地图是不是都只能搜索地点，而不能搜索一条街道
- 隔壁 V 站说最近墙变高了，大家目前使用下来啥情况，注意保护隐私。
- 龙虾助手 QClaw 版本迭代后的现状
36氪
- 2026年大众汽车将在中国推出13款新能源车型
- 70股获10家及以上机构评级，部分机构关注股获社保基金青睐
- A股三大指数午间休盘集体下跌，贵金属板块领跌
- A股三大指数集体低开，新易盛跌超9%
- A股三大指数集体收跌，全市场超3300股飘绿
- DeepSeek V4发布，海光DCU完成Day0适配
- DeepSeek V4终于发布，但它留下的5道主观题还没有答案
- DeepSeek-V4上线国家超算互联网
- DeepSeek官网公布DeepSeek-v4接口文档
- Gartner：2025年阿里云中国市场份额32.8%，同比提升2.7个百分点
- Keep发布9.0版本
- Meta与亚马逊达成数十亿美元合作，采用其CPU芯片支撑人工智能业务
- NEC宣布与Anthropic达成网络安全合作
- OMV新西兰公司预计毛伊气田将于2026年停产
- OPPO云台相机项目启动，预计四季度上市
- PPIO首批上线DeepSeek-V4
- SpaceX上个月获得200亿美元的过渡贷款，以在美国IPO前重组其大部分债务
- ST开元：因涉嫌内幕交易、泄露内幕信息罪原控股股东、实控人江勇被批准逮捕
- ST新华锦：申请撤销部分其他风险警示
- “电商龙虾”Accio Work已接入DeepSeek V4、Qwen 3.6等模型
- 万兴科技旗下万兴脑图上线“万兴脑图AI”
- 三安光电：2025年净亏损3.53亿元，同比转亏
- 三菱电机考虑与鸿海建立联盟，联合运营汽车设备业务
- 上交所修订发布《上海证券交易所交易规则》，7月6日起正式实施
- 上交所：本周对*ST观典、*ST岩石、*ST正平、*ST熊猫等异常波动退市风险警示股票进行重点监控
- 上市券商一季度成绩单陆续出炉，头部机构配置价值更受青睐
- 东方财富：一季度净利润37.38亿元，同比增长37.67%
- 东材科技：实际控制人、副董事长熊海涛解除留置
- 东珠生态：预计2025年净亏损9.35亿元-11.35亿元，股票可能被��施退市风险警示
- 东阿阿胶：第一季度净利润4.55亿元，同比增长7.14%
- 两市融资余额增加38.0亿元
- 中信建投：一季度新签订单超预期，继续看好锂电设备板块
- 中信建投：消费税后移改革仍待时机，看好免税渠道、品牌零售长期投资价值
- 中信证券：北交所重启网下询价，迈向高质量发展新阶段
- 中信证券：双碳考核挂钩干部任免，压实绿色转型主体责任
- 中信证券：持续看好国产算力和存储，新增推荐被动元件
- 中信证券：煤炭板块有望进入新一轮反弹行情
- 中信证券：看好物理AI落地提速机遇
- 中信证券：第一季度净利润102.16亿元，同比增长54.60%
- 中兴通讯：一季度净利润13.10亿元，同比下降46.58%
- 中国巨石：第一季度净利润12.67亿元，同比增长73%
- 中国核建：一季度净利润4.03亿元，同比下降26.93%
- 中国神华：第一季度净利润106.67亿元，同比下降10.7%
- 中国证监会公告允许合格境外投资者参与国债期货交易
- 中国证监会相关派出机构拟对中能粮科境外上市备案违法违规行为作出行政处罚
- 中国首款原生开发Robotaxi亮相北京车展，曹操出行定制版计划2027年量产
- 中国高科：触及财务类强制退市情形，4月28日起被实施退市风险警示股票简称变更为“*ST高科”
- 中天科技：一季度净利润9.19亿元，同比增长46.42%
- 中材科技：第一季度净利润5.07亿元，同比增长40.15%
- 中油工程：子公司签署46.14亿美元气田地面工程承包合同
- 中科曙光：第一季度净利润2.28亿元，同比增加22.19%
- 亚马逊支持的X-Energy通过IPO募资10.2亿美元
- 京东和格力推出空调换新全包服务
- 人工智能初创公司Cognition AI进行融资谈判，估值达250亿美元
- 人民币兑美元中间价报6.8674
- 亿纬锂能：第一季度净利润14.46亿元，同比增长31.35%
- 今年1.3万亿元超长期特别国债发行开启
- 伊卡路斯递表港交所
- 分红回购增持并举，A股价值投资底气更足
- 创业板指跌逾2%，AI硬件、软件领跌
- 剑桥科技：董事及高管拟合计减持不超5.1万股
- 千问加速上车，10多家车企同日宣布接入
- 半日主力资金加仓基础化工板块，抛售通信板块
- 华尔街多家公司承诺提供60亿美元支持QXO收购TopBuild
- 华泰证券：双碳刚性考核释放电、证、碳新价值
- 华泰证券：淡季价格稳定，看好电商快递盈利持续修复
- 华西证券：出海持续提速，看好工程机械板块业绩长虹
- 博硕科技：蓝海芯新材料已投入运营，当前营收规模较小
- 博裕、经纬、顺为等投资前新石器COO超亿元，押注AI超便携电子纸｜硬氪独家
- 可灵AI 3.0模型新增原生4K能力
- 商业航天企业资本化进程提速，供应链重构成商业航天降本关键
- 商汤绝影发布舱驾一体全场景智能体产品
- 喜临门：4月28日起被实施其他风险警示，股票简称变更为“ST喜临门”
- 国家能源局：1-3月全国电力市场交易电量同比增长25.6%
- 国家能源局：3月核发绿证3.03亿个
- 国泰海通：第一季度净利润63.88亿元，同比下降47.82%
- 外汇局：1-3月，中国外汇市场累计成交75.78万亿元人民币
- 大搜车美股IPO获中国证监会备案
- 天星医疗拟在��港IPO募资8.296亿港元
- 天猫与长安汽车达成合作，正式入局整车销售
- 天辰生物港股IPO获中国证监会备案
- 天问三号任务计划于2031年前后携带火星样品返回地球
- 天鹜科技发布对话式蛋白质研发智能体MatwingsVenus™
- 央行今日开展50亿元7天逆回购操作
- 央行等八部门发布金融产品网络营销管理办法
- 奈飞批准250亿美元股票回购计划
- 如祺出行与黑芝麻智能达成战略合作
- 存储“超级周期”进入业绩兑现阶段
- 安克创新发布首款存算一体AI芯片Thus™
- 宝洁第三季度销售净额212.4亿美元，高于市场预期
- 宝马携16款首发车型亮相北京车展
- 小米汽车：新一代SU7已交付26000台
- 小马智行联合宁德时代首发L4级无人驾驶轻卡
- 小鹏第二代VLA智驾报告首发，全系Ultra车型订单环比提升118%
- 市场热议一季度存款“搬家”，保险成重要吸金方向
- 年内上交所科创债发行规模已超1950亿元
- 当升科技：第一季度净利润2.77亿元，同比增长150%
- 怡达股份：电子级丙二醇甲醚和电子级丙二醇甲醚醋酸酯收入占比较小
- 恒指午间休盘跌0.2%，恒生科技指数涨0.34%
- 恒指开盘跌0.7%，恒生科技指数跌0.8%
- 恒指收涨0.24%，恒生科技指数涨0.75%
- 恒生指数跌幅扩大至1%
- 打造生物智能基础设施，AI4S企业「奥明星程」获超亿元A轮融资｜36氪首发
- 托伦斯创业板IPO过会
- 找钢网集团以4000万港币回购
- 抖音生活服务：2025年汽车核销订单量达67万台
- 挪威将禁止16岁以下儿童使用社交媒体
- 摩根士丹利：新兴市场股票远未进入新的长期牛市
- 新易盛：1.6T和800G是今年交付的主力产品，预计2027年行业仍将保持超高景气度和高增长趋势
- 新易盛：预计2026年Q2-Q4订单交付和产能扩产将保持持续增长趋势
- 日本3月份核心消费物价同比上涨1.8%
- 日本将从5月1日起释放第二批石油储备
- 日本将成立特别工作组应对金融体系网络安全风险
- 智微智能：控股股东、实际控制人郭旭辉4月24日减持451.12万股
- 智源：FlagOS完成DeepSeekV4八款芯片Day0适配
- 最前线｜AI+激光通信，中科天塔要用「太空智驾」体系实现卫星管理模式的三级跨越
- 最前线｜AI收入破亿后的路径选择：微盟推行AI First战略与B端交付的挑战
- 有研新材：一季度净利润8827.11万元，同比增长31.00%
- 有道龙虾已率先集成DeepSeek-V4和Kimi K2.6
- 机构今日买入恩捷股份等22股，抛售中宠股份5563万元
- 李斌：汽车行业决赛期还有五年结束
- 杭钢股份：第一季度净利润960.76万元，同比扭亏为盈
- 柳化股份：触及财务类强制退市情形 4月28日起被实施退市风险警示证券简称变更为“*ST柳化”
- 歌尔股份：公司MEMS传感器产品在消费电子和汽车电子领域内均有较多应用场景
- 毅昌科技：实际控制人熊海涛被解除留置
- 每日互动DeepSeek-V4私部方案已就绪
- 氪星晚报｜美团万亿级参数大模型开放测试，训练全程由国产算力集群完成；百度联盟正式发布海外App业务；央行等八部门发布金融产品网络营销管理办法
- 永辉超市CEO王守诚：调改已步入第二阶段
- 江苏省环保集团注册资本增至约63.6亿元
- 沪深两市成交额突破5000亿元
- 沪深两市成交额连续第13个交易日突破2万亿
- 沪深两市成交额连续第222个交易日突破1万亿元
- 法国国民健康数据将从微软迁移至本土平台
- 泡泡玛特城市乐园新区域将正式开放
- 洛阳钼业：第一季度净利润77.6亿元，同比增长96.65%
- 海光C86全栈产品与解决方案亮相第87届教育装备展
- 深交所修订主板、创业板《股票上市规则》和《规范运作指引》
- 深交所正式发布深化创业板改革首批配套业务规则
- 深交所：创业板股票及创业板存托凭证协议大宗交易成交确认时间调整
- 深交所：本周共对157起证券异常交易行为采取了自律监管措施
- 深圳一季度实际使用外资约170亿元，新设外商投资企业超2700家
- 深证成指跌逾1%
- 港股IPO高破发背后：高定价高包装如影随形
- 滨化股份港股上市获中国证监会备案
- 热门中概股美股盘前多数上涨，理想汽车跌近4%
- 特斯拉：赛博无人驾驶电动车Cybercab在北美投产
- 特朗普称正考虑由美国政府收购Spirit Airlines
- 特朗普警告英国：若不取消对美科技企业数字服务税，将征高额关税
- 现货白银向下跌破75美元/盎司
- 现货黄金向上触及4700美元
- 用“活人感”做科技社区，小红书能成吗？
- 电投贵安数据中心公司注册资本增至2.98亿元
- 百亿元级私募机构数量创新高
- 百度联盟正式发布海外App业务
- 百纳千成：终止发行股份及支付现金购买众联世纪100%股权事项
- 知情人士：新易盛选定投行，筹备30亿美元香港上市计划
- 神马股份：因涉嫌信息披露违法违规被证监会立案
- 科创板首单并购重组简易审核程序获受理
- 科氪|高配不溢价，20万内首选！国民好车2.0深蓝L06增程版折后价低至127155元起
- 经营23年，本田决定撤出韩国汽车市场
- 统筹推进商业航天标准化建设，商业航天标准体系（1.0版）发布
- 维塔流动近日完成数千万元Pre-Seed轮融资
- 美团万亿级参数大模型开放测试，训练全程由国产算力集群完成
- 美国航空CEO否认合并传闻
- 美联储4月维持利率不变的概率为99%
- 美股三大指数集体收跌，小鹏集团跌超6%
- 美股大型科技股盘前普涨，英特尔涨超25%
- 美股新高之际，高盛警告：美股近期可能下跌，切莫贸然加仓
- 腾景科技：第一季度净利润1443.38万元，同比增长10.74%
- 航油价格飙升令多家美国航空运营商业绩承压
- 芒果超媒：2025年度净利润12.27亿元，同比下降10.06%
- 英特尔CEO：半导体行业整体潜在市场规模已逼近1万亿美元
- 英特尔CEO：所有业务板块需求仍高于供给，预计至强服务器CPU今明两年保持强劲增长势头
- 英特尔美股盘前大涨26%
- 茅台向经销商「要利润」
- 菲律宾央行暗示将小幅加息以抑制通胀
- 蔚来在武汉成立新能源科技公司
- 融了2000万美金，这家2000万美金ARR的AI公司，推出“视频版Photoshop”「Buzzy」
- 证监会部署打击和防范上市公司财务造假专项行动
- 证监会：要求上市公司建立董事会秘书履职定期评价及责任追究机制，严格采取监管措施或者实施处罚
- 豆神教育：澄清一季度财报不实信息，报告尚在编制中
- 财政部：一季度全国一般公共预算收入6.16万亿元，同比增长2.4%
- 财政部：一季度全国税收收入4.85万亿元，同比增长2.2%
- 财政部：一季度国债发行规模超3.62万亿元，投资者认购积极踊跃
- 财政部：截至上周，消费品以旧换新带动销售额超5400亿元，惠及近7500万人次
- 财政部：股票市场交易活跃，一季度证券交易印花税增长78.1%
- 贵州茅台：第一季度净利润272亿元，同比增长1.47%
- 赛微电子回应股价大跌：业绩为影响因素之一
- 赤峰黄金：第一季度净利润9.88亿元，同比增长104%
- 起亚公司第一季度销售额29.5万亿韩元，高于市场预期
- 超捷股份：第一季度净利润1422.89万元，同比下降1%
- 软银拟改造工厂为数据中心生产电池
- 重庆千里科技股份有限公司递表港交所
- 金浦钛业：实际控制人郭金东被列入失信被执行人名单
- 锋龙股份：优必选要约收购结果出炉，4月27日复牌
- 长城汽车：第一季度净利润9.45亿元，同比下降46.01%
- 阳光电源股份有限公司向港交所提交上市申请书
- 阶跃发布新一代自动语音识别模型StepAudio 2.5 ASR
- 阿里云百炼上线DeepSeek-V4
- 阿里云：4月30日10:00起，Qoder Teams版新购价格调整为300RMB/席位月
- 需求回暖，特斯拉格林海德工厂将扩招1000人并提升产量
- 飞南资源：一季度净利润4.05亿元，同比增长7919.37%
- 首批银行一季报出炉，营收、净利润全部实现正增长
- 首晒行使表决权情况，公募担当“积极股东”角色
- 香港机场3月客运量同比增长19.6%
- 高德地图发布“AI 伴行”
- 高盛警告：标普500指数已经约等于半个“AI指数”
- 黄仁勋要求英伟达所有员工使用OpeiAI的Codex编程工具
- 黑芝麻：公司及董事长韦清文因涉嫌信披违规被证监会立案
404 Media
- Community Votes to Deny Water to Nuclear Weapons Data Center
- The AI Compute Crunch Is Here (and It's Affecting the Entire Economy)
Ars Technica
- Well, this is embarrassing: The Lunar Gateway's primary modules are corroded
BorderGate
- Cloudfront C2 Redirectors
daringfireball.net
- Eight for Eight
- Microsoft Offers Voluntary Retirement to Long-Serving Employees
- New Zealand Passed a Generational Smoking Ban in 2022, But Repealed It Before It Went Into Effect
- Nilay Patel: ‘Beware Software Brain’
- Trump’s Blog Has Somehow Lost $1.1 Billion
- Unauthorized Users in Discord Group Had Weekslong Access to Anthropic’s Supposedly-Super-Dangerous Claude Mythos Model
- United Kingdom to Pass Smoking Ban Only for Those Who Are Not Yet Legal Adults
- XOXO Explore
- ★ ‘We Don’t Serve Their Kind Here’
darkreading
- AI Phishing Is No. 1 With a Bullet for Cyberattackers
- Chinese APT Abuses Multiple Cloud Tools to Spy on Mongolia
- North Korea's Lazarus Targets macOS Users via ClickFix
- Tropic Trooper APT Takes Aim at Home Routers, Japanese Targets
defend.network
- Daily Threat Briefing – April 24, 2026
EFF
- EFF to 9th Circuit (Again): App Stores Shouldn’t Be Liable for Processing Payments for User Content
- Speaking Freely: Lizzie O'Shea
Emergent Minds | paddo.dev
- The Idiot Savant Needs Guardrails
- Vibing the Tool with the Tool
Hacker News Frontpage
- Composition Shouldn't be this Hard
- DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence
- Different Language Models Learn Similar Number Representations
- Girl, 10, finds rare Mexican axolotl under Welsh bridge
- Incident with Multple GitHub Services
- Middle Eastern News Sites Are U.S. Government Propaganda Ops
- Palantir Employees Are Starting to Wonder If They're the Bad Guys
- S. Korea police arrest man over AI image of runaway wolf that misled authorities
- Sabotaging projects by overthinking, scope creep, and structural diffing
- Spinel: Ruby AOT Native Compiler
- The operating cost of adult and gambling startups
- Ubuntu 26.04 LTS Released
- UK Biobank leak: Health details of 500 000 people are offered for sale
- Using the internet like it's 1999
- Why I Write (1946)
HackerNews
- Checkmarx äž›ĺş”é“žć–°ćźć´žĺ˝ąĺ“ KICS ĺˆ†ćžĺˇĽĺ…ˇ
- UNC6692 é€ščż‡ĺžŽč˝Ż Teams ĺ†’ĺ…… IT ćœĺŠĄĺ°éƒ¨ç˝˛ SNOW ćść„č˝Żäťś
- â€œä¸‰č§’éž™â€ ĺ‹’ç´˘č˝Żäťść”ťĺ‡ťĺˆŠç”¨ĺŽšĺˆść•°ćŽć¸—ĺ‡şĺˇĽĺ…ˇçŞƒĺ–ć•°ćŽ
- éť‘ĺŽ˘ĺˆŠç”¨ Breeze Cache WordPress ć’äťść–‡äťśä¸Šäź ćźć´žĺ‘ĺŠ¨ć”ťĺ‡ť
- ĺŒ–ĺŚ†ĺ“ĺˇ¨ĺ¤´ Rituals ćŠŤéœ˛ć•°ćŽćł„éœ˛äş‹äťśďźŒĺŽ˘ćˆˇĺ—ĺ˝ąĺ“
ICT Security Magazine
- Sotto la superficie: la sfida della cybersecurity negli habitat sottomarini
- The Compliance Triple Threat: navigare la regulatory collision tra DORA, NIS2 e AI Act
Include Security Research Blog
- CTFs in the AI Era
infosecurity-magazine.com
- Google Favors General‑Purpose Gemini Models Over Cybersecurity‑Specific AI
- Npm Supply Chain Malware Attack Targets Developers With Worm-Like Propagation
- UK Biobank Data Breach: Health Data of 500,000 Listed for Sale in China
Malware-Traffic-Analysis.net - Blog Entries
- 2026-04-23: SmartApeSG activity
NVIDIA AI Blog
- OpenAI’s New GPT-5.5 Powers Codex on NVIDIA Infrastructure — and NVIDIA Is Already Putting It to Work
Payatu
- How a Double-Encoded Null Byte Turns a ZIP File into an XSS Vector – CVE-2026-2790
pluralistic.net
- Pluralistic: A free, open visual identity for enshittification (24 Apr 2026)
Recent Commits to cve:main
- Update Fri Apr 24 11:17:21 UTC 2026
SANS Internet Storm Center, InfoCON: green
- ISC Stormcast For Friday, April 24th, 2026 https://isc.sans.edu/podcastdetail/9906, (Fri, Apr 24th)
Schneier on Security
- Hiding Bluetooth Trackers in Mail
Securelist
- PhantomRPC: A new privilege escalation technique in Windows RPC
Security Affairs
- Checkmarx supply chain attack impacts Bitwarden npm distribution path
- Luxury cosmetics giant Rituals discloses data breach impacting member personal details
Seebug Paper
- Google DeepMind：AI 智能体陷阱
shkspr.mobi
- Does Mythos mean you need to shut down your Open Source repositories?
simonwillison.net
- A pelican for GPT-5.5 via the semi-official Codex backdoor API
- An update on recent Claude Code quality reports
- DeepSeek V4 - almost on the frontier, a fraction of the price
- Extract PDF text in your browser with LiteParse for the web
- It's a big one
- russellromney/honker
- Serving the For You feed
Sploitus.com Exploits RSS Feed
- Black-Oracle exploit
- Exploit for CVE-2017-0144 exploit
- Exploit for CVE-2025-5880 exploit
- Exploit for CVE-2026-3844 exploit
- Exploit for CVE-2026-3844 exploit
- Exploit for CVE-2026-41651 exploit
- Exploit for Improper Authentication in Apache Tomcat exploit
- Exploit for OS Command Injection in Gnu Bash exploit
- Exploit for OS Command Injection in Zyxel Vmg8623-T50B_Firmware exploit
- Exploit for Use of Less Trusted Source in Meshtastic Meshtastic_Firmware exploit
- HTB-Pterodactyl-Writeup exploit
- Nex.AI exploit
- Nexusuite exploit
- SecScan exploit
- UAC-Bypass-ComputerDefaults exploit
TechCrunch
- Another spyware maker caught distributing fake Android snooping apps
- Authorities arrest special forces soldier who allegedly made $400K on Polymarket bet involving Maduro operation
- Bluesky now supports better quality photos
- Bob Iger rejoins Thrive Capital as advisor after Disney exit
- Bret Taylor’s Sierra buys YC-backed AI startup Fragment
- DeepSeek previews new AI model that ‘closes the gap’ with frontier models
- Don’t stop hiring humans — stop hiring the wrong humans, Artisan’s founder says
- Era computer raises $11M to build a software platform for AI gadgets
- In another wild turn for AI chips, Meta signs deal for millions of Amazon AI CPUs
- Instagram tests a new ‘Instants’ app for sharing disappearing photos
- Meet Noscroll, an AI bot that does your doomscrolling for you
- Meta is revamping its cross-app management system
- Meta to cut 10% of jobs, or 8,000 employees, report says
- Microsoft offers buyout for up to 7% of U.S. employees
- Nothing introduces an AI-powered dictation tool
- OpenAI releases GPT-5.5, bringing company one step closer to an AI ‘superapp’
- Porsche is adding an all-electric Cayenne coupe to its lineup
- Redwood Materials loses COO amid layoffs, restructuring
- These are the countries moving to ban social media for children
- Trump’s pick to run US cyber agency CISA asks to drop out
- Uber CTO Praveen Neppalli Naga joins stacked StrictlyVC SF lineup for April 30 event
The Decoder
- Anthropic confirms Claude Code problems and promises stricter quality controls
- As agentic AI pushes rivals to raise prices and cap usage, Deepseek ships a good-enough model for almost nothing
- China moves to block tech firms from taking US money without government approval
- Google's open-source DESIGN.md gives AI agents a prompt-ready blueprint for brand-consistent design
- Meta buys tens of millions of AWS Graviton 5 processor cores from Amazon
- OpenAI unveils GPT-5.5, claims a "new class of intelligence" at double the API price
- OpenAI's new Trusted Access program gives Microsoft its most capable models for cyber defense
The Verge
- A new Republican privacy bill could be ‘worse than no standard at all’
- Anthropic’s Mythos breach was humiliating
- China’s DeepSeek previews new AI model a year after jolting US rivals
- Claude is connecting directly to your personal apps like Spotify, Uber Eats, and TurboTax
- Democrats want to ban ICE from turning warehouses into detention centers
- Elon Musk and Sam Altman’s court showdown will dish the dirt
- Great news, the Moto G Stylus is no longer teeming with bloatware
- I don’t think Gwyneth Paltrow knows what a peptide is
- Ikea’s new inflatable chair doesn’t look like an inflatable chair
- Inside Microsoft’s wave of executive departures
- Instagram has launched another Snapchat clone
- Leak reveals new Xbox Game Pass ‘Starter Edition’ that’s part of Discord Nitro
- Meta is laying off 10 percent of its staff
- Microsoft brings Xbox back, scraps Microsoft Gaming
- Microsoft’s new Xbox chief is ‘reevaluating’ exclusive games
- Prestigious photo contest answers ‘what is a photo?’
- Saros is pure action nirvana
- Sonos’ big sale on refurbished speakers is about to end
- Spirit is broken
- The Trump phone still isn’t real
- US arrests soldier who allegedly made $400k on Maduro Polymarket bets
- ‘We Are Xbox’: read the memo defining Microsoft’s gaming future
VulDB Recent Entries
- CVE-2025-11762 | hubspotdev HubSpot All-In-One Marketing Plugin up to 11.3.32 on WordPress class-adminconstants.php authorization
- CVE-2025-50229 | Jizhicms 2.5.4 Product Editing sql injection
- CVE-2025-62373 | pipecat-ai pipecat up to 0.0.93 Pickle livekit.py deserialize deserialization
- CVE-2026-2028 | ckp267 MaxiBlocks Builder Plugin up to 2.1.8 on WordPress /wp-content/uploads maxi_remove_custom_image_size authorization
- CVE-2026-21728 | Grafana Tempo up to 2.10.x allocation of resources
- CVE-2026-22020 | libpng privilege escalation
- CVE-2026-23751 | Tungsten Automation Kofax Capture 6.0.0.0 Ascent Capture Service missing authentication
- CVE-2026-24303 | Microsoft Partner Center access control
- CVE-2026-25660 | Ericsson CodeChecker up to 6.27.3 authentication spoofing
- CVE-2026-25775 | SenseLive X3050 1.523 Remote Management Service missing authentication
- CVE-2026-25874 | Hugging Face LeRobot up to 0.5.1 Pickle pickle.loads deserialization (ID 3047)
- CVE-2026-26150 | Microsoft Purview eDiscovery server-side request forgery
- CVE-2026-26210 | kvcache-ai ktransformers up to 0.5.3 Pickle pickle.loads deserialization
- CVE-2026-27841 | SenseLive X3050 1.523 cross-site request forgery
- CVE-2026-27843 | SenseLive X3050 1.523 Web Management Interface missing authentication
- CVE-2026-28525 | sbabic swupdate up to 2025.12 mongoose_multipart.c mg_http_multipart_continue_wait_for_chunk integer underflow
- CVE-2026-29050 | chainguard-dev melange up to 0.43.3 Configuration File filepath.Join pipeline[] path traversal (GHSA-98f2-w9h9-7fp9)
- CVE-2026-29051 | chainguard-dev melange up to 0.43.3 filepath.Separator pkgname path traversal (GHSA-q2pw-xx38-p64j)
- CVE-2026-31159 | Totolink A3300R 17.0.0cu.557_B20221024 Parameter /cgi-bin/cstecgi.cgi Password command injection
- CVE-2026-31160 | Totolink A3300R 17.0.0cu.557 /cgi-bin/cstecgi.cgi provider command injection
- CVE-2026-31162 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi ttlWay command injection
- CVE-2026-31163 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi dhcpMtu command injection
- CVE-2026-31164 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi pppoeMtu command injection
- CVE-2026-31165 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi pppoeServiceName command injection
- CVE-2026-31166 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi hour command injection
- CVE-2026-31167 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi mode command injection
- CVE-2026-31168 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi recHour command injection
- CVE-2026-31169 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi week command injection
- CVE-2026-31173 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi interval command injection
- CVE-2026-31176 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi stun-user command injection
- CVE-2026-31177 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi stunMinAlive privilege escalation
- CVE-2026-31178 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi stunMaxAlive command injection
- CVE-2026-31179 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi stun-port os command injection
- CVE-2026-31181 | Totolink A3300R 17.0.0cu.557_B20221024 /cgi-bin/cstecgi.cgi stunServerAddr command injection
- CVE-2026-31533 | Linux Kernel up to 6.19.12 tls tls_do_encryption use after free
- CVE-2026-31952 | xibosignage xibo-cms up to 4.4.0 API Filter sql injection (GHSA-rq92-f6fv-3629)
- CVE-2026-32172 | Microsoft Power Apps uncontrolled search path
- CVE-2026-32210 | Microsoft Dynamics 365 server-side request forgery
- CVE-2026-32952 | Azure go-ntlmssp up to 0.1.0 Challenge Message ntlmssp.Negotiator integer overflow (GHSA-pjcq-xvwq-hhpj)
- CVE-2026-33076 | Roxy-WI up to 8.2.6.3 Scheduled Task haproxy_section_save path traversal (GHSA-mmgm-p9x9-h33j)
- CVE-2026-33077 | Roxy-WI up to 8.2.6.3 haproxy_section_save oldconfig path traversal (GHSA-c799-4ww6-q93w)
- CVE-2026-33078 | Roxy-WI up to 8.2.6.4 routes.py haproxy_section_save server_ip sql injection (GHSA-jmj9-2c4q-849j)
- CVE-2026-33102 | Microsoft M365 Copilot redirect
- CVE-2026-33208 | Roxy-WI up to 8.2.6.3 /config/ words os command injection (GHSA-7m2h-gmvj-cjx2)
- CVE-2026-33317 | OP-TEE optee_os up to 4.10.0 Trusted Execution Environment ta/pkcs11/src/object.c entry_get_attribute_value out-of-bounds (GHSA-8cqw-mg7v-c9p9)
- CVE-2026-33318 | actualbudget actual up to 26.3.x Login Endpoint /account/change-password access control (GHSA-prp4-2f49-fcgp)
- CVE-2026-33819 | Microsoft Bing deserialization
- CVE-2026-33999 | X.org X Server XKB Compatibility Map integer underflow
- CVE-2026-34001 | X.org X Server miSyncTriggerFence expired pointer dereference
- CVE-2026-34003 | X.org X Server XKB Key Types Request out-of-bounds
- CVE-2026-35064 | SenseLive X3050 1.523 missing authentication
- CVE-2026-35431 | Microsoft Entra server-side request forgery
- CVE-2026-35503 | SenseLive X3050 1.523 Web Management Interface hard-coded credentials
- CVE-2026-3565 | Taqnix Plugin up to 1.0.3 on WordPress taqnix_delete_my_account cross-site request forgery
- CVE-2026-3569 | Liaison Site Prober Plugin up to 1.2.1 on WordPress REST API Endpoint logs permissions_read authorization
- CVE-2026-38743 | Apache Airflow up to 3.2.0 Request Parameter /ui/dags insufficient granularity of access control
- CVE-2026-39087 | Via Code up to 2.20 ntfy.sh parseActions privilege escalation
- CVE-2026-39462 | SenseLive X3050 1.523 insufficiently protected credentials (icsa-26-111-12)
- CVE-2026-40254 | FreeRDP up to 3.24.x Remote Desktop Protocol drive_file.c contains_dotdot off-by-one (GHSA-3xpj-m4hx-8vmx)
- CVE-2026-40431 | SenseLive X3050 1.523 Configuration Data cleartext transmission
- CVE-2026-40470 | hackage-server/hackage.haskell.org up to 0.5 cross site scripting (HSEC-2024-0004)
- CVE-2026-40471 | hackage-server cross-site request forgery (HSEC-2026-0002)
- CVE-2026-40472 | hackage-server cabal File cross site scripting (HSEC-2026-0004)
- CVE-2026-40690 | Apache Airflow up to 3.2.0 Asset Dependency Graph insufficient granularity of access control
- CVE-2026-4078 | ITERAS Plugin up to 1.8.2 on WordPress Shortcode combine_attributes cross site scripting
- CVE-2026-40894 | open-telemetry opentelemetry-dotnet up to 1.15.2 OpenTelemetry.Api memory allocation (GHSA-g94r-2vxg-569j)
- CVE-2026-41068 | Kyverno up to 1.17.1 Kubernetes Cluster URLPath authorization (GHSA-cvq5-hhx3-f99p)
- CVE-2026-41078 | open-telemetry opentelemetry-dotnet/OpenTelemetry.Exporter.Jaeger allocation of resources (GHSA-38h3-2333-qx47)
- CVE-2026-41137 | FlowiseAI Flowise/flowise-components up to 3.0.x CSVAgent code injection (GHSA-9wc7-mj3f-74xv)
- CVE-2026-41138 | FlowiseAI Flowise up to 3.0.x question code injection (GHSA-f228-chmx-v6j6)
- CVE-2026-41173 | open-telemetry opentelemetry-dotnet-contrib up to 0.1.0-alpha.7 Sampling Endpoint ReadAsStringAsync allocation of resources (GHSA-28xm-prxc-5866)
- CVE-2026-41205 | sqlalchemy mako up to 1.3.10 TemplateLookup.get_template path traversal (GHSA-v92g-xgxw-vvmm)
- CVE-2026-41213 | node-oauth oauth2-server up to 5.2.x code_verifier excessive authentication (GHSA-jhm7-29pj-4xvf)
- CVE-2026-41239 | cure53 DOMPurify up to 3.3.x cross site scripting
- CVE-2026-41240 | cure53 DOMPurify up to 3.3.x permissive list of allowed inputs
- CVE-2026-41241 | pretalx 2.3.1/2.3.2 cross site scripting (GHSA-cjcx-jfp2-f7m2)
- CVE-2026-41246 | projectcontour up to 1.31.5/1.32.4/1.33.3 Cookie Rewriting Feature code injection (GHSA-x4mj-7f9g-29h4)
- CVE-2026-41247 | Studio-42 elFinder up to 2.1.66 bg os command injection (GHSA-8q4h-8crm-5cvc)
- CVE-2026-41259 | Mastodon up to 4.3.21/4.4.15/4.5.8 Mail Address behavioral workflow (GHSA-5r37-qpwq-2jhh)
- CVE-2026-41264 | FlowiseAI Flowise up to 3.0.x CSV_Agents incomplete blacklist (GHSA-3hjv-c53m-58jj)
- CVE-2026-41265 | FlowiseAI Flowise up to 3.0.x Airtable_Agents command injection (GHSA-v38x-c887-992f)
- CVE-2026-41266 | FlowiseAI Flowise up to 3.0.x :id information disclosure (GHSA-4jpm-cgx2-8h37)
- CVE-2026-41267 | FlowiseAI Flowise up to 3.0.x Account Registration Endpoint authorization (GHSA-48m6-ch88-55mj)
- CVE-2026-41268 | FlowiseAI Flowise up to 3.0.x Environment Variable NODE_OPTIONS input validation (GHSA-cvrr-qhgw-2mm6)
- CVE-2026-41269 | FlowiseAI Flowise up to 3.0.x Setting unrestricted upload (GHSA-rh7v-6w34-w2rr)
- CVE-2026-41270 | FlowiseAI Flowise/flowise-components up to 3.0.x Custom Function Feature access control (GHSA-xhmj-rg95-44hv)
- CVE-2026-41271 | FlowiseAI Flowise/flowise-components up to 3.0.x API Chain server-side request forgery (GHSA-6r77-hqx7-7vw8)
- CVE-2026-41272 | FlowiseAI Flowise/flowise-components up to 3.0.x secureAxiosRequest/secureFetch server-side request forgery (GHSA-2x8m-83vc-6wv4)
- CVE-2026-41273 | FlowiseAI Flowise up to 3.0.x missing authentication (GHSA-6f7g-v4pp-r667)
- CVE-2026-41274 | FlowiseAI Flowise/flowise-components up to 3.0.x GraphCypherQAChain data query logic injection (GHSA-28g4-38q8-3cwc)
- CVE-2026-41275 | FlowiseAI Flowise up to 3.0.x cleartext transmission (GHSA-x5w6-38gp-mrqh)
- CVE-2026-41276 | FlowiseAI Flowise up to 3.0.x Password Reset Token reset-password resetPassword improper authentication (GHSA-f6hc-c5jr-878p)
- CVE-2026-41277 | FlowiseAI Flowise up to 3.0.x DocumentStore Creation Endpoint repository.save access control (GHSA-3prp-9gf7-4rxx)
- CVE-2026-41278 | FlowiseAI Flowise up to 3.0.x :id sanitizeFlowDataForPublicEndpoint information disclosure (GHSA-w47f-j8rh-wx87)
- CVE-2026-41279 | FlowiseAI Flowise up to 3.0.x generate authorization (GHSA-5fw2-mwhh-9947)
- CVE-2026-41305 | postcss up to 8.5.9 CSS File cross site scripting (GHSA-qx2v-qp2m-jg93)
- CVE-2026-41309 | opensource-socialnetwork up to 8.x allocation of resources (ID 2535)
- CVE-2026-41318 | Mintplex-Labs anything-llm up to 1.12.0 /api/workspace/ cross site scripting (GHSA-4q6m-qh3w-9gf5)
- CVE-2026-41319 | jstedfast MailKit up to 4.15.x injection (GHSA-9j88-vvj5-vhgr)
- CVE-2026-41323 | Kyverno up to 1.16.3 information disclosure (GHSA-f9g8-6ppc-pqq4)
- CVE-2026-41324 | patrickjuchli basic-ftp up to 5.2.x Client.list resource consumption (GHSA-rp42-5vxx-qpwr)
- CVE-2026-41430 | frappe press Subscription cross site scripting (GHSA-mpww-rq79-8r2c)
- CVE-2026-41485 | Kyverno up to 1.16.3/1.17.1 assertion (GHSA-fpjq-c37h-cqcv)
- CVE-2026-5039 | TP-Link TL-WL841N v13 TDDPv2 Debug default key
- CVE-2026-5488 | smub ExactMetrics Plugin up to 9.1.2 on WordPress profile.php get_ads_access_token authorization
- CVE-2026-6074 | Intrado 911 Emergency Gateway 5.x/6.x/7.x EGW Management Interface path traversal (icsa-26-113-06)
- CVE-2026-6375 | SpiceJet Online Booking System authorization (icsa-26-113-04)
- CVE-2026-6376 | SpiceJet Online Booking System missing authentication (icsa-26-113-04)
- CVE-2026-6393 | wpdevteam BetterDocs Plugin up to 4.3.11 on WordPress API Call generate_openai_content_callback authorization
- CVE-2026-6919 | Google Chrome up to 147.0.7727.101 DevTools use after free
- CVE-2026-6920 | Google Chrome up to 147.0.7727.101 on Android GPU out-of-bounds
- CVE-2026-6921 | Google Chrome up to 147.0.7727.101 on Windows GPU race condition
- CVE-2026-6940 | radareorg radare2 up to 6.1.3 path traversal
- CVE-2026-6941 | radareorg radare2 up to 6.1.3 zrp Archive link following
- CVE-2026-6942 | radareorg radare2 up to 1.5.x Jsonrpc Interface r2_cmd_str os command injection (Issue 45)
Wallarm
- The Governance Gap: How the EU AI Act Makes API Security a Compliance Imperative
Wired
- 5 Reasons to Think Twice Before Using ChatGPT—or Any Chatbot—for Financial Advice
- Airfare Keeps Going Up. Here Are Some Tricks to Finding Cheap(er) Tickets
- Apple's Next CEO Needs to Launch a Killer AI Product
- Apple’s Next Chapter, SpaceX and Cursor Strike a Deal, and Palantir’s Controversial Manifesto
- At 'AI Coachella,' Stanford Students Line Up to Learn From Silicon Valley Royalty
- Best Merino Wool T-Shirts (2026): Ibex, Icebreaker, Unbound Merino
- Design Within Reach Promo Codes: 30% Off | April 2026
- KitchenAid Promo Codes: Save Up to 20%
- Rednote Draws a Line Between China and the World
- Sam's Club Promo Codes: 60% Off for April 2026
- Target Promo Code: $50 Off | April 2026
- The Best Cordless Vacuums for Your Whole House (2026)
- The Men Behind Your Favorite AI Gay Thirst Traps
- The WIRED Gear Team’s Tips on Ways to Save Money
- They Wanted to Join Raya. They’ve Been on the Waiting List for Years
- US Special Forces Soldier Arrested for Polymarket Bets on Maduro Raid
- VMax New V4 Electric Scooter Review: Unleash the Beast
不安全
- How a Double-Encoded Null Byte Turns a ZIP File into an XSS Vector – CVE-2026-2790
- OpenAI开源发布1.5B的隐私过滤模型可以精确识别文本中包含的个人隐私信息
- The Governance Gap: How the EU AI Act Makes API Security a Compliance Imperative
- 绿盟科技26周年庆 | 廿六载深耕不辍，不负来路；守初心专攻术业，厚积致远
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
博客
- ciphered and encrypted
奇客Solidot–传递最新科技情报
- 心脏跳动能抑制心脏癌生长
- 英国生物银行 50 万参与者健康数据泄漏
安全牛
- GPT-5.5 发布：强化数字防御，网安能力再升级；灵境 AIDR 技术首发 | 以 AI 治理 AI，悬镜智能体安全卫士新品发布| 牛览
- 警惕！Google Play 与 App Store “假应用” 陷阱：5 分钟识破恶意伪装，守护手机安全
爱范儿
- 刚刚，GPT-5.5 发布！Claude Code 连夜治好降智，「奥特曼瘫倒」喜提续集
- 定了，DeepSeek V4首发华为芯片！国产AI开始打破英伟达「垄断」
- 小米 YU7 GT 定档 5 月底，更长更宽更低趴，马力超千匹｜北京车展
- 扒完 DeepSeek V4 报告，我翻出了这个隐藏彩蛋
- 早报｜特斯拉第三代人形机器人预计年中亮相/更省token，GPT-5.5正式发布/西山居游戏辟谣「解散」传言：将依法追究恶意造谣
- 猛士 M817 Ultimate 亮相：硬派越野既要强健肌肉，还要聪明大脑丨北京车展
- 腾讯发布了 7 个座舱智能体，汽车的意义从「空间位移」走向了「时间价值」
- 面壁智能 SuperMate 升级：智能座舱正在从语音助手走向端侧 Agent
绿盟科技技术博客
- 【公益译文】2026年国际AI安全报告（五）
- 绿盟科技26周年庆 | 廿六载深耕不辍，不负来路；守初心专攻术业，厚积致远
量子位 QbitAI
- DeepSeek-V4发布，华为云首发适配
- PPIO首批上线DeepSeek-V4预览版，1M超长上下文能力开箱即用
黑海洋
- Bitwarden CLI在持续的Checkmarx供应链攻击中被入侵
- DeepSeek-V4预览版本正式上线并开源
- Instagram测试新图片分享应用“Instants”
- OpenAI公司正式发布了GPT-5.5模型
- WhatsApp在印度新增预付电话卡充值功能
- 富士通将与美国大学联合开发物理AI操作系统
- 新任Xbox负责人正在“重新评估”独占游戏
- 比亚迪、北汽等车企宣布接入阿里千问
- 美团用AI识别虚假评价异常评价24小时内处理
- 马斯克旗下AI公司xAI在编程方面落后
- 马斯克称特斯拉开始生产Cybercab