安全资讯归档（2026-04-25）

2Libra
- 【BUG 反馈】签到页面连续翻页导致已签到记录异常
- 【投票】【💰】2 站有多少是大小周的，说出来让我心里平衡一下
- 【💰】受够了大小周，请各位帮忙出谋划策
- 【💰】有没有懂 Invalid tool parameters 解决方案的(金币已拉满)
- 人形机器人是真风口还是又一次出现昙花一现的科技泡沫？
- 你的微信推送“折叠发图”功能了吗？
- 刚刚在隔壁论坛看到 Jinx 限免，有用的可以领一下
- 去年开站不久时候说的这件事，是不是又该提起日程了
- 发现自己身上一个小 bug
- 如何终结，隐藏，或者删除已经发布的帖子?
- 我们是 AI 时代的纺织工人
- 按 Laravel 社区风格制作了一份 Springboot 文档
- 最近的科技新闻聚焦在 AI 上，而 AI 正将全球资本分割为三个阵营。
- 现在手机小功能挺有趣，灵动岛地图红绿灯
- 腾讯云 DeepSeek-V4-Pro 领 1M Token 的试用, 7.30 号到期.
- 连续几次跳票后，Xchat 终于准备推出了。
36氪
- 36氪首发 | 核心团队来自微软，获近亿投资，要打通AI进厂最后一公里
- 9点1氪丨Kimi被曝泄露用户真实简历；马斯克花4000多亿买下00后公司；世界杯决赛门票转手价近230万美元
- Momenta一年间量产搭载量逾80万台
- smart亮相2026北京车展
- “固收+”基金规模突破3万亿元
- “智用开物”完成近亿元天使+轮融资
- 下游需求激增，CPU重回AI核心，A股布局公司梳理
- 中国进出口银行一季度投放外贸领域贷款超3000亿元
- 五菱与华为乾崑签署深化战略合作协议，华境S 5月8日正式上市
- 亚洲首个盐穴储氢工程投产运行
- 佑驾创新发布国内首款“真无图”L4级无人物流车
- 保时捷清仓布加迪股份
- 元戎启行全面押注大模型自动驾驶
- 华泰证券：中国方便面企业出海有望迎来新机遇
- 卡尔动力发布KargoBot Inside
- 司美格鲁肽专利到期月余未见“国产首证”，多家申报企业称审批因数据保护期“暂缓”
- 天��618推家电"送装一体"，覆盖全国95%区域
- 巨星农牧：一季度公司的商品肥猪完全成本约为6.35元/斤
- 市场消息：日产汽车已完成旗下电动汽车全固态电池组原型机的性能指标考核
- 我国单机容量最大“超级充电宝”3号机组顺利投运
- 数据中心提供商Csquare秘密提交美国IPO申请
- 最前线｜2025年全年营收超64亿，海康机器人表示将继续推进AI融合与具身智能布局
- 本周多只市场热门股接受超百家机构调研
- 本田在华研发转向中方主导
- 江苏如东能源岛LNG输出量突破1000亿立方米
- 浩思动力发布行业首个面向纯电原生平台的X-Range增程系统解决方案
- 潘功胜：持续整治金融机构“内卷式”竞争，高质量统筹做好金融“五篇大文章”
- 甲骨文密歇根数据中心获160亿美元融资
- 百度智能云上线DeepSeek-V4
- 美图立方视觉艺术中心开工，预计2028年投入使用
- 美股三大指数收盘涨跌不一，英特尔涨超23%
- 谷歌计划向Anthropic投资至多400亿美元，支持后者大幅扩展算力
- 超聚变完成A股IPO辅导
- 阿塞拜疆主权财富基金第一季度抛售约22吨黄金，十多年来首次减持
- 首个全国产控制系统水光互补项目今天投运
- 黑芝麻智能发布FAD天衍L3级自动驾驶平台
404 Media
- A Mysterious Golden Orb Was Discovered Under the Sea. We Finally Know What It Is.
Ars Technica
- Europe—not US—first to authorize Moderna's combo mRNA flu-COVID vaccine
- FCC: Router ban includes portable hotspots, but not phones with hotspot features
Cheesy Rumbles
- Atomic BOFs
construction-physics.com
- Reading List 04/25/26
Daniel Miessler
- A Conversation With Claude on Deutsch, Knowledge, and the PAI Algorithm
daringfireball.net
- ★ Norwegian Boating Licenses and Generational Law
- ★ Time to Serve Some Delicious Claim Chowder Regarding the Cook-Ternus CEO Transition
defend.network
- Daily Threat Briefing – April 25, 2026
EFF
- Act Now to Stop California’s Paternalistic and Privacy-Destroying Social Media Ban
- California Coastal Community Must Reject CBP's AI-Powered Surveillance Tower
- EFF Challenges Secrecy In Eastern District of Texas Patent Case
filfre.net
- This Week on The Analog Antiquarian
Hacker News Frontpage
- FusionCore: ROS 2 sensor fusion (IMU and GPS and encoders)
- My audio interface has SSH enabled by default
- OpenAI releases GPT-5.5 and GPT-5.5 Pro in the API
- Oxford All Souls College General Examination [pdf]
- SFO Quiet Airport (2025)
- Show HN: A Karpathy-style LLM wiki your agents maintain (Markdown and Git)
- Show HN: I've built a nice home server OS
- Turbo Vision 2.0 – a modern port
IEEE Spectrum
- Yong Wang Turns Information Into Insights
johndcook.com
- How nonlinearity affects a pendulum
- nth derivative of a quotient
MIT Technology Review
- Three reasons why DeepSeek’s new model V4 matters
pluralistic.net
- Pluralistic: Ada Palmer's "Inventing the Renaissance" (25 Apr 2026)
Schneier on Security
- Friday Squid Blogging: How Squid Survived Extinction Events
Sec-News 安全文摘
- 我做了个工具让 8GB 显卡跑 30B 模型从 3 tok/s 提到 21 tok/s，记录一下技术发现
Security Affairs
- 12-year-old Pack2TheRoot bug lets Linux users gain root privileges
- Over 400,000 sites at risk as hackers exploit Breeze Cache plugin flaw (CVE-2026-3844)
shkspr.mobi
- You can parse an .env file as an .ini with PHP - but there's a catch
simonwillison.net
- GPT-5.5 prompting guide
- The people do not yearn for automation
Sploitus.com Exploits RSS Feed
- Exploit for CVE-2025-2304 exploit
- Exploit for CVE-2025-27407 exploit
- Exploit for CVE-2026-21847 exploit
- Exploit for Incorrect Authorization in Canonical Ubuntu_Linux exploit
- Exploit for Missing Authentication for Critical Function in Frangoteam Fuxa exploit
- Exploit for Path Traversal in Apache Http_Server exploit
- Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit exploit
- Kai-Tools exploit
- POC_base_25 exploit
- SafeVault exploit
- web-vuln-scanner exploit
- zero-click-exploit-analysis exploit
TechCrunch
- Apple under Ternus: what comes next for the tech giant’s hardware strategy
- Apps to distract you from the endless cycle of doomscrolling
- Cohere acquires, merges with German-based startup to create a ‘transatlantic AI powerhouse’
- ComfyUI hits $500M valuation as creators seek more control over AI-generated media
- Google to invest up to $40B in Anthropic in cash and compute
- India’s Snabbit seeks fresh funding at a $400M valuation, sources say
- Lachy Groom to back India startup Pronto at a $200M valuation, sources say
- Marked-up Mac minis flood eBay amid shortages driven by AI
- Meta’s loss is Thinking Machines’ gain
- Palantir is reportedly helping the IRS investigate financial crimes
- Steve Ballmer blasts founder he backed who pleaded guilty to fraud: ‘I was duped and feel silly’
- Why Tokyo is the most important tech destination of 2026
- X launches standalone XChat app on iOS
- X-energy stock pops 27% on first day of trading following upsized IPO
text/plain
- Attack Techniques: RMM Abuse
The Decoder
- Anthropic says stronger AI models cut better deals, and the losers don't even notice
- Google pours up to $40 billion into ChatGPT rival Anthropic
- OpenAI unveils GPT-5.5, claims a "new class of intelligence" at double the API price
- OpenAI's chief scientist says AI progress has been "surprisingly slow" and promises big leaps ahead
- Qwen3.6-27B beats much larger predecessor on most coding benchmarks
- The UAE wants half its government run by autonomous AI agents within two years
- US programmer job growth nearly halved since ChatGPT launched, Fed study finds
The Verge
- Alex Jones has uncovered another massive conspiracy
- BMW is one step closer to selling you a color-changing car
- Google’s handsome Pixel Watch 4 is on sale for $40 off in both size configurations
- How Project Maven taught the military to love AI
- Microsoft will let you pause Windows Updates indefinitely, 35 days at a time
- The Govee smart lamp brightened up my room, and then my life
- The person who allegedly leaked Paramount’s new Avatar movie has been arrested
- The RAM shortage could get even worse if Samsung labor protests cut production
- The US gets the worst phones
- Xbox’s weirdest studio is on a roll
- Xreal’s best AR glasses are $599 for good now
Threatninja.net
- Hack The Box: Sorcery Machine Walkthrough – Insane Difficulty
VulDB Recent Entries
- CVE-2026-31610 | Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 BER Decoder ksmbd_decode_negTokenInit memory leak
- CVE-2026-31611 | Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 ksmbd parse_dacl comparison
- CVE-2026-31612 | Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 ksmbd smb2_get_ea uninitialized pointer
- CVE-2026-31613 | Linux Kernel up to 6.18.23/6.19.13/7.0.0 smb smb2_check_message memory corruption
- CVE-2026-31614 | Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 smb check_wsl_eas heap-based overflow
- CVE-2026-31619 | Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 ALSA efr_status_names privilege escalation
- CVE-2026-31620 | Linux Kernel up to 6.18.23/6.19.13/7.0.0 USB usb_ifnum_to_if null pointer dereference
- CVE-2026-31621 | Linux Kernel up to 6.19.13/7.0.0 auxiliary_device_uninit null pointer dereference
- CVE-2026-31626 | Linux Kernel up to 6.12.82/6.18.23/6.19.13/7.0.0 staging rtw_security.c rtw_BIP_verify uninitialized pointer
- CVE-2026-31631 | Linux Kernel up to 6.18.22/6.19.12 rxrpc rxgk_do_verify_authenticator buffer overflow
- CVE-2026-31632 | Linux Kernel up to 6.18.22/6.19.12 rxrpc rxgk_verify_response privilege escalation
- CVE-2026-31634 | Linux Kernel up to 6.19.12 rxrpc rxrpc_server_keyring reference count
- CVE-2026-31638 | Linux Kernel up to 6.6.134/6.12.81/6.18.22/6.19.12 rxrpc_input_packet_on_conn denial of service
- CVE-2026-31639 | Linux Kernel up to 6.6.134/6.12.81/6.18.22/6.19.12 /proc/keys rxrpc_alloc_client_call reference count
- CVE-2026-31640 | Linux Kernel up to 6.18.22/6.19.12 rxrpc rxrpc_post_response comparison
- CVE-2026-31643 | Linux Kernel up to 6.18.22/6.19.12 rxrpc rxrpc_preparse_xdr_yfs_rxgk memory leak
- CVE-2026-31644 | Linux Kernel up to 6.12.81/6.18.22/6.19.12 lan966x_fdma_reload use after free
- CVE-2026-31645 | Linux Kernel up to 6.12.81/6.18.22/6.19.12 net lan966x_fdma_rx_alloc denial of service
- CVE-2026-31658 | Linux Kernel up to 6.19.12 net tse_start_xmit stack-based overflow
- CVE-2026-31659 | Linux Kernel up to 6.19.12 Response Buffer batadv_tt_prepare_tvlv_global_data heap-based overflow
- CVE-2026-31673 | Linux Kernel up to 6.12.82/6.18.23/6.19.13 af_unix unix_release_sock information disclosure
- CVE-2026-31674 | Linux Kernel up to 6.19.10 netfilter rt_mt6_check memory corruption
- CVE-2026-31675 | Linux Kernel up to 6.6.133/6.12.80/6.18.21/6.19.11 netem_enqueue out-of-bounds
- CVE-2026-31676 | Linux Kernel up to 6.18.22/6.19.12 rxrpc initialization
- CVE-2026-31677 | Linux Kernel up to 6.12.82/6.18.23/6.19.13 crypto af_alg_get_rsgl buffer overflow
- CVE-2026-31678 | Linux Kernel up to 6.19.10 RCU Call ovs_netdev_tunnel_destroy information disclosure
- CVE-2026-31679 | Linux Kernel up to 6.19.10 openvswitch validate_set memory corruption
- CVE-2026-31680 | Linux Kernel up to 6.19.11 net /proc/net/ip6_flowlabel ip6fl_seq_show denial of service
- CVE-2026-31681 | Linux Kernel up to 6.12.82/6.18.23/6.19.13 netfilter ports_match_v1 ports[] encoding error
- CVE-2026-31682 | Linux Kernel up to 6.19.11 br_nd_send opt[] buffer overflow
- CVE-2026-31683 | Linux Kernel up to 6.19.9 batman-adv packet_len allocation of resources
- CVE-2026-31684 | Linux Kernel up to 6.12.82/6.18.23/6.19.13 net tcf_csum_act privilege escalation
- CVE-2026-31685 | Linux Kernel up to 6.12.82/6.18.23/6.19.13 netfilter eui64_mt6 comparison
- CVE-2026-33524 | ndsev zserio up to 2.18.0 memory allocation
- CVE-2026-33662 | OP-TEE optee_os up to 4.10 on ARM rsassa.c emsa_pkcs1_v1_5_encode integer overflow
- CVE-2026-33666 | ndsev zserio up to 2.18.0 BitStreamReader.h readBytes/readString/setBitPosition integer overflow
- CVE-2026-40897 | josdejong mathjs up to 15.1.x Expressions Math.js dynamically-determined object attributes (GHSA-29qv-4j9f-fjw5)
- CVE-2026-41066 | lxml up to 6.0.x xml external entity reference (GHSA-vfmq-68hx-4jfw)
- CVE-2026-41067 | withastro up to 6.1.5 HTML Parser defineScriptVars HTML injection (GHSA-j687-52p2-xcff)
- CVE-2026-41079 | OpenPrinting cups up to 2.4.16 on Linux Web Interface out-of-bounds (GHSA-6wpw-g8g6-wvrv)
- CVE-2026-41140 | python-poetry up to 2.3.3 helpers.py extractall path traversal (GHSA-73h3-mf4w-8647)
- CVE-2026-41244 | notamitgamer mojic up to 2.1.3 timing discrepancy
- CVE-2026-41263 | Traefik BasicAuth Middleware timing discrepancy
- CVE-2026-41321 | withastro up to 13.1.9 HTTP Redirect image-binding-transform.ts fetch server-side request forgery (GHSA-88gm-j2wx-58h6)
- CVE-2026-41322 | withastro up to 10.0.4 _astro web browser cache containing sensitive information (GHSA-c57f-mm3j-27q9)
- CVE-2026-41326 | kata-containers Kata Containers up to 3.28.x CopyFile symlink (GHSA-q49m-57vm-c8cc)
- CVE-2026-41327 | dgraph-io dgraph up to 25.3.2 DQL Parser /mutate?commitNow=true cond data query logic injection
- CVE-2026-41328 | dgraph-io dgraph up to 25.3.2 JSON /alter x.PredicateLang pred.Lang data query logic injection
- CVE-2026-41411 | vim up to 9.2.0356 Command Line os command injection (GHSA-cwgx-gcj7-6qh8)
- CVE-2026-41414 | skim-rs skim github/workflows/pr.yml code injection (GHSA-9g93-rxr5-xhqw)
- CVE-2026-41415 | pjsip pjproject up to 2.16 Multipart Message out-of-bounds (GHSA-935m-fmf5-j4pm)
- CVE-2026-41416 | pjsip pjproject up to 2.16 integer overflow (GHSA-f33g-8hjq-62xr)
- CVE-2026-41418 | RARgames 4gaBoards up to 3.3.4 Login Endpoint /api/access-tokens bcrypt.compareSync timing discrepancy (GHSA-8mj9-p99h-jhxp)
- CVE-2026-41419 | RARgames 4gaBoards up to 3.3.4 Application Interface path traversal (GHSA-rrjq-7x8g-cmgm)
- CVE-2026-41421 | SiYuan up to 3.6.4 Notification Message pushMsg msg os command injection (GHSA-grjj-6f6g-cq8q)
- CVE-2026-41425 | Authlib up to 1.6.10 authlib.integrations.starlette_client.OAuth cross-site request forgery
- CVE-2026-41426 | pretalx 2.3.1/2.3.2 cross site scripting
- CVE-2026-41427 | better-auth oauth-provider up to 1.6.4/1.7.0-beta.1 OAuth Client Creation Endpoint authorization
- CVE-2026-41428 | budibase up to 3.35.3 Query Parameter status improper authentication
- CVE-2026-41429 | Espressif arduino-esp32 up to 3.3.7 name_len stack-based overflow
- CVE-2026-41433 | open-telemetry opentelemetry-ebpf-instrumentation up to 0.7.x File Creation path traversal
- CVE-2026-41475 | bacnet-stack BACnet Stack up to 1.4.2 WritePropertyMultiple Service wpm_decode_object_property out-of-bounds (GHSA-cvv4-v3g6-4jmv)
- CVE-2026-41476 | Deskflow up to 1.26.0.138 IClipboard.cpp ClipboardChunk::assemble buffer overflow (GHSA-3jp5-g964-cgmh)
- CVE-2026-41477 | deskflow up to 1.20.0/1.26.0.134 missing authentication (GHSA-6rx5-g478-775c)
- CVE-2026-41502 | bacnet-stack BACnet Stack up to 1.4.2 ReadPropertyMultiple Service src/bacnet/rpm.c rpm_decode_object_id out-of-bounds (GHSA-7545-3fpx-4xw3)
- CVE-2026-41503 | bacnet-stack BACnet Stack up to 1.4.2 ReadPropertyMultiple Service src/bacnet/rpm.c rpm_decode_object_property out-of-bounds (GHSA-5w2v-mwqj-pr2c)
- CVE-2026-41676 | rust-openssl up to 0.10.77 derive out-of-bounds write (GHSA-pqf5-4pqq-29f5)
- CVE-2026-41677 | rust-openssl up to 0.10.77 API _from_pem_callback out-of-bounds (GHSA-xmgf-hq76-4vx2)
- CVE-2026-41678 | rust-openssl up to 0.10.77 aes::unwrap_key out-of-bounds write (GHSA-8c75-8mhr-p7r9)
- CVE-2026-41680 | markedjs marked up to 18.0.1 resource consumption (GHSA-6v9c-7cg6-27q7)
- CVE-2026-41681 | rust-openssl up to 0.10.77 EVP_DigestFinal stack-based overflow (GHSA-ghm9-cr32-g9qj)
- CVE-2026-41894 | SiYuan up to 3.6.4 url.PathUnescape path traversal
- CVE-2026-41898 | rust-openssl up to 0.10.77 buffer over-read (GHSA-hppc-g8h3-xhp3)
- CVE-2026-41907 | uuidjs uuid up to 13.x out-of-range pointer offset
- CVE-2026-42033 | Axios up to 0.31.0/1.15.0 prototype pollution (GHSA-pf86-5x62-jrwf)
- CVE-2026-42034 | Axios up to 0.31.0/1.15.0 allocation of resources (GHSA-5c9x-8gcm-mpgx)
- CVE-2026-42035 | Axios up to 0.31.0/1.15.0 lib/adapters/http.js getHeaders response splitting (GHSA-6chq-wfr3-2hj9)
- CVE-2026-42036 | Axios up to 0.31.0/1.15.0 allocation of resources (GHSA-vf2m-468p-8v99)
- CVE-2026-42037 | Axios up to 1.15.0 Content-Type Header formDataToStream.js crlf injection (GHSA-445q-vr5w-6q77)
- CVE-2026-42038 | Axios up to 0.31.0/1.15.0 Normalization shouldBypassProxy server-side request forgery (GHSA-m7pr-hjqh-92cm)
- CVE-2026-42039 | Axios up to 0.31.0/1.15.0 recursion (GHSA-62hf-57xw-28j9)
- CVE-2026-42040 | Axios up to 0.31.0/1.15.0 AxiosURLSearchParams.js encode escape output (GHSA-xhjh-pmcv-23jw)
- CVE-2026-42041 | Axios up to 0.31.0/1.15.0 improper authentication (GHSA-w9j2-pvgh-6h63)
- CVE-2026-42042 | Axios up to 0.31.0/1.15.0 permissive list of allowed inputs (GHSA-xx6v-rp6x-q39c)
- CVE-2026-42043 | Axios up to 0.31.0/1.15.0 permissive list of allowed inputs (GHSA-pmwg-cvhr-8vh7)
- CVE-2026-42044 | Axios up to 1.15.1 lib/defaults/index.js dynamically-determined object attributes (GHSA-3w6x-2g7m-8v23)
- CVE-2026-6951 | steveukx simple-git up to 3.35.x code injection (SNYK-JS-SIMPLEGIT-15456078 / EUVD-2026-25639)
- CVE-2026-6966 | AWS tough/tuftool prior tough-v0.22.0 signature verification
- CVE-2026-6967 | AWS tough/tuftool up to 0.21.x load_delegations data authenticity
- CVE-2026-6968 | AWS tough/tuftool prior 0.22.0 copy_target/link_target path traversal
- CVE-2026-6977 | vanna-ai vanna up to 2.0.2 Legacy Flask API improper authorization
- CVE-2026-6978 | JiZhiCMS up to 2.5.6 addcache.html htmlspecialchars_decode sqls sql injection
- CVE-2026-6982 | star7th ShowDoc up to 2.10.10/3.6.2/3.8.0 API Page Sort Endpoint PageController.class.PHP pages sql injection
- CVE-2026-6983 | pagekit up to 1.0.18 download url server-side request forgery
- CVE-2026-6984 | AstrBotDevs AstrBot up to 4.22.1 Dashboard API t2i.py create_template special elements used in a template engine (Issue 7330)
- CVE-2026-6985 | Cesanta Mongoose up to 7.20 TCP Option /src/net_builtin.c handle_opt optlen infinite loop
- CVE-2026-6986 | Cesanta Mongoose up to 7.20 GCM Authentication Tag /src/tls_aes128.c mg_aes_gcm_decrypt signature verification
- CVE-2026-6987 | PicoClaw up to 0.2.4 Web Launcher Management Plane /api/gateway/restart command injection (Issue 2307)
- CVE-2026-6988 | Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon Boa Service /boaform/formRouting formRoute nextHop buffer overflow
- CVE-2026-6989 | Tenda F453 up to 1.0.0.3 Telnet Service /goform/telnet TendaTelnet command injection
- CVE-2026-6990 | projeto-siga 11.0.3.18 novo Nome/Descrição cross site scripting (Issue 2491)
- CVE-2026-6991 | colinhacks Zod up to 4.3.6 CUID Data Type regexes.ts sql injection
- CVE-2026-6992 | Linksys MR9600 2.0.6.206937 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus pin os command injection
- CVE-2026-6993 | go-kratos up to 2.9.2 http.DefaultServeMux Fallback transport/http/server.go NewServer confused deputy (Issue 3810)
- CVE-2026-6994 | Envoy up to 1.33.0 Query Parameter header_mutation.cc params.add injection (ID 43502)
- CVE-2026-6999 | BIVOCOM TR321 21.1.1.50 Wireless Setting Network Name SSID cross site scripting
- CVE-2026-7000 | Datacom DM4100 1.3.6.1.4.1.3709 VLAN Page VLAN Name cross site scripting
- CVE-2026-7001 | Datacom DM4100 1.3.6.1.4.1.3709 Ethernet Configuration Page Name cross site scripting
- CVE-2026-7002 | KLiK SocialMediaWebsite up to 1.0.1 Private Message get_message_ajax.php c_id sql injection
- CVE-2026-7019 | Tenda F456 1.0.0.5 /goform/P2pListFilter fromP2pListFilter menufacturer/Go buffer overflow
- CVE-2026-7020 | Ollama up to 0.20.2 Tensor Model Transfer transfer.go digestToPath digest path traversal
- CVE-2026-7021 | SmythOS sre up to 0.0.15 Connector Service utils.ts baseURL information disclosure
- CVE-2026-7022 | SmythOS sre up to 0.0.15 HTTP Header AgentRuntime.class.ts AgentRuntime X-DEBUG-RUN/X-DEBUG-INJ improper authentication
- CVE-2026-7023 | ByteDance coze-studio up to 0.5.1 databaseTool database_impl.go ExecuteSQL sql injection
- CVE-2026-7024 | rawchen sims up to 004f783b1db5ecdfad81c8fdc3b34171211112de deleteFileServlet Endpoint DeleteFileServlet.java filename path traversal
- CVE-2026-7025 | Typecho up to 1.3.0 Ping Back Service Endpoint var/Widget/Service.php Service::sendPingHandle X-Pingback/link server-side request forgery
- CVE-2026-7026 | D-Link DGS-3420 1.50.018 System Information Settings Page System Name cross site scripting
- CVE-2026-7027 | D-Link DSL-2740R EU_01.15 Wireless Setup Section Wireless Network Name cross site scripting
- CVE-2026-7028 | CodeAstro Online Job Portal 1.0 All Jobs Page delete-jobs.php ID sql injection
- CVE-2026-7029 | Tenda F456 1.0.0.5 /goform/addressNat fromaddressNat menufacturer/Go buffer overflow
- CVE-2026-7030 | Tenda F456 1.0.0.5 /goform/RouteStatic fromRouteStatic page buffer overflow
- CVE-2026-7031 | Tenda F456 1.0.0.5 /goform/SafeMacFilter fromSafeMacFilter page buffer overflow
- CVE-2026-7032 | Tenda F456 1.0.0.5 /goform/SafeEmailFilter page buffer overflow
- CVE-2026-7033 | Tenda F456 1.0.0.5 /goform/SafeClientFilter fromSafeClientFilter menufacturer/Go buffer overflow
- CVE-2026-7034 | Tenda FH1202 1.2.0.14(408) httpd /goform/WrlExtraSet Go stack-based overflow
- CVE-2026-7035 | Tenda 1.2.0.14 httpd /goform/WrlclientSet fromWrlclientSet Go stack-based overflow
wheresyoured.at
- Premium: How OpenAI Kills Oracle
Wired
- Ace the Ping-Pong Robot Can Whup Your Ass
- AI-Designed Drugs by a DeepMind Spinoff Are Headed to Human Trials
- Altra Promo Codes: Get 20% Off Plus Free Shipping
- Beatbot Pool-Cleaning Robots Are on Sale for a Limited Time
- Best Apps for Focus (2026): Focus Friend, Forest, Focus Traveller
- Discord Sleuths Gained Unauthorized Access to Anthropic’s Mythos
- Give Mom Warm Coffee Year-Long With This Ember Smart Mug Deal
- ‘Saros’ Shows Off the PS5’s DualSense Tricks
不安全
- A Conversation With Claude on Deutsch, Knowledge, and the PAI Algorithm
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
博客
- Sectors and Clusters
奇客Solidot–传递最新科技情报
- 挪威计划禁止 16 岁以下儿童使用社交媒体
- 韩国逮捕一名发布逃跑公狼 AI 照片的男子
爱范儿
- 早报｜小米YU7 GT定档五月底/罗福莉：中美顶尖模型代差仅两三个月/餐馆「反向抹零」被立案调查
- 纵横在北京车展上发了 6 款新车，想要打造一个 700 系宇宙
- 领克 GT 概念跑车全球首秀，领克 10+ 与 10 开启预售，20.99 万起
量子位 QbitAI
- 0博士组合拿下ICLR时间检验奖！两个GPT天才本科生+二本逆袭LeCun弟子，十年论文终封神
- DeepSeek V4报告太详尽了！484天换代之路全公开
- 华人再破硅谷天花板！AI黑马新任CTO，中科大80后
- 硬刚GPT-Image-2！国产AI生图“天花板”又被捅破了？
- 自动驾驶赛道DeepSeek，轻舟智航率先进军物理AI
黑海洋
- DeepSeek-V4 正式发布：开源模型首次具备百万上下文与工程级Agent能力
- YouTube移动端直播引入画中画广告
- 美国政府通过英特尔赚取了大笔收益
- 马斯克旗下即时聊天应用 XChat 现已上线