安全资讯归档（2026-04-28）

2Libra
- github 上 README 和 Issue 用什么语言写？
- V 站发了个带 aff 的链接直接被拉黑了
- 【投票】看影视剧快进选择倍速 or 跳跃
- 【期待五一】宅家玩游戏！大菠萝 4 完结篇
- 【漏洞预警】Java "幽灵比特位"（Ghost Bits）引发的新型 WAF 绕过与注入攻击
- 【离个大谱】ACGTI 二次元人格测试
- 【💰】在央企当云平台运维外包 4 年，失业了，现在工作还好找么。
- 你会一个人出去旅游吗？比如五一十一和其他假期等。
- 做了一款在线 GPU 推理速度计算器，希望可以帮助到大家
- 出来看星星 ✨：今天大风北京空气质量极好，此时西部天空可以非常清晰地看到天狼星、木星、南河三、北河三、参宿四、金星等一系列亮星。
- 前端工种消亡还是蜕变？
- 在正式比赛中，人类第一次跑进两小时，马拉松比赛中马拉松选手。人类终于突破了两小时这个天堑。
- 大家多久清理一次电脑，用的是什么清理工具？
- 大家有没有什么写 excel/文档比较好用的 agent 推荐啊
- 安装了一个猫猫的 chrome 插件！哈哈有点意思
- 小 App 开发者如何高效解决变现痛点？
- 小米 MIMO 赠送的一个月 Standard 会员已到账
- 我们的 AI 进程，你们的尼？
- 推特账号
- 根据【I'm rich】徽章获得率和金币排行榜数据计算出 2libra 有 7500 名用户？
- 现在麦当劳越来越小了，曹，大汉堡两三口就没了，曹。记得以前不是这样的。
- 看到 V 站有人讨论“本升专” ，我觉得是好事。有不少本科都是内容太虚离就业太远，真不如学点真正有价值的能直接就业的大专
- 胡思乱想
- 腾讯这是搞啥？WorkBuddy 也要娱乐化吗？
- 谁那么大嘴巴告诉你我还差 1000 金币就拿到 Rich 徽章啦?
36氪
- *ST亿晶：股票被实施退市风险警示，股票复牌
- *ST波导：4月30日起撤销退市风险警示，股票简称变更为波导股份
- 36氪首发 | 韩国现代、微光创投押注焊接机器人，营收预计破数亿，拿下船厂数千万订单
- 4月28日人民币对美元中间价调贬10个基点
- 8点1氪：中方禁止外资收购Manus；上海迪士尼回应游客吸烟冲突事件；泡泡玛特LABUBU 冰箱未发售已溢价3000元
- ADP：截至4月11日四周美国私营部门就业人数平均每周增加3.925万
- A股三大指数午间收盘集体下跌，药明康德涨停
- A股三大指数集体低开，药明康德涨超9%
- A股三大指数集体收跌，航天军工板块领跌
- bp一季度调整后净利润32亿美元，高于预期
- DeepSeek V4引爆半导体行情，国产算力投资逻辑升级
- DeepSeek-V4-Pro优惠期延长至5月底
- Spotify携手Peloton推出全球健身内容中心
- UPS第一季度营收212亿美元
- VALA：与上汽大通房车科技有限公司订立vala house车型开发协议
- “五一”假期预计日均225万人次出入境
- “寻明生科”完成3500万美元A+轮融资
- “市退”首超“面退”，A股多元化出清格局加速成形
- “干法转移”实现晶圆级单晶二维半导体柔性集成
- “新劢德”完成近3亿元B轮融资
- “昇视唯盛”完成数千万元A+轮融资
- “星迹互动”完成数千万元天使轮融资
- “磐石100”模型体系发布，为科学研究提供智能支撑
- 「寻明生科」完成3500万美元A+轮融资，首个抗体药物即将进入临床｜36氪首发
- 一季度公募FOF规模超2800亿元，环比增逾三成
- 万辰集团：一季度归母净利润6.3亿元，同比增长193.12%
- 上市期货公司一季度业绩爆发，多家公司营收、净利润均实现大幅增长
- 东吴证券：第一季度净利润8.01亿元，同比下降18.22%
- 两市融资余额增加155.42亿元
- 两部门：引导算力企业、模型企业、数据企业和应用开发企业组建“模数共振”创新联合体
- 中信建投：二级债基份额再创历史新高，转债供需矛盾尖锐
- 中信建投：看好AI应用落地与AI算力需求增长
- 中共中央政治局：全面实施“人工智能+”行动，发展智能经济新形态
- 中共中央政治局：扩大优质商品和服务供给，推动消费升级
- 中共中央政治局：推动中小金融机构改革，稳定和增强资本市场信心
- 中共中央政治局：精准有效实施更加积极的财政政策和适度宽松的货币政策
- 中国太保：一季度归母净利润100.41亿元，同比增加4.30%
- 中国平安：第一季度净利润250.22亿元，同比下降7.4%
- 中国广核：一季度归母净利润27.41亿元，同比下滑9.33%
- 中国海油：第一季度净利润391.44亿元，同比增长7.1%
- 中国海洋石油：一季度归母净利润391.44亿元，同比增长7.10%
- 中国物流集团控股公司注册资本增至8亿元
- 中国石化：第一季度净利润170.06亿元，同比增长28.2%
- 中指研究院：3月房地产债券融资总额环比增长48.4%
- 中晶科技：第一季度净利润1384.92万元，同比增长95.93%
- 中金黄金：一季度归母净利润23.81亿元，同比增加129.23%
- 丰田合成将进行股票拆分，1股拆分为5股
- 久立特材：回购170万股，使用资金总额4934.31万元
- 二手时尚交易平台Vinted估值达80亿欧元
- 五一视界SimOne4.0先行版正式发布，已完成与英伟达产品深度融合
- 亚洲数据中心运营商Digital Edge据悉权衡包括出售在内的各种选项
- 亚马逊低地轨道卫星计划又一批卫星发射升空
- 京能热力：公司业务不涉及商业航天服务领域
- 利甘制药斥资约7.4亿美元收购佐马公司
- 前谷歌DeepMind研究员创办AI初创公司，斩获11亿美元创纪录种子轮融资
- 加拿大将设立首只主权财富基金，初始规模250亿加元
- 半日主力资金加仓非银金融股，抛售通信股
- 华勤技术：全资子公司拟26.51亿元受让晶合集成5%股份
- 华曙高科：拟募资不超39.1亿元，用于先进增材制造设备产能提升项目等
- 华电国际：第一季度净利润17.89亿元，同比下降9.93%
- 南向资金净买入额达100亿港元
- 古井贡酒：第一季度净利润16.07亿元，同比下降31.03%
- 可口可乐第一季度净营收124.72亿美元
- 台积电：正以“二倍速”推进扩产计划
- 名创优品旗下公司在上海成立画廊公司
- 唐山港：一季度归母净利润4.71亿元，同比增加23.46%
- 商汤科技正式发布并开源日日新SenseNova U1系列模型
- 四创电子：聘任余保华为公司副总经理
- 复星医药：一季度归母净利润8.71亿元，同比增长13.87%
- 多家上市钨企一季度大赚，分析人士称钨价有望长期维持高位运行
- 多家航司再度大幅上调5月航线燃油费
- 大庆油田川渝探区天然气累产��品气量破50亿立方米
- 天娱数科：一季度归母净利润3024.12万元，同比增加476.94%
- 太空金属3D打印技术在轨完成演示验证
- 央行今日开展435亿元7天期逆回购操作
- 宁德时代50亿美元股票配售据悉获得超过150名投资者认购
- 宁德时代香港股票配售价据悉为每股628.20港元
- 宁德时代：拟配售6238.5万股股份，配售价每股628.2港元
- 宁德核电项目二期工程5号机组核岛安装开工
- 宁水集团：一季度归母净利润1079.32万元，同比下降61.76%
- 安孚科技：第一季度净利润1.34亿元，同比增长87.78%
- 宏昌电子：一季度净利润为46.85万元，同比下降92.74%
- 寒武纪：2025年度权益分派拟每10股派15元转增4.9股，股权登记日为2026年5月7日
- 小米已注册多枚玄戒系列商标
- 小鹏汽车旗下公司成立鹏禹汽车贸易新公司
- 山东省财金创业投资公司注册资本增至50亿元
- 工业富联：第一季度净利润105.95亿元，同比增长102.55%
- 巨化股份：第一季度净利润11.73亿元，同比增长46%
- 巨星科技：第一季度净利润5.15亿元，，同比增长11.87%
- 巴克莱一季度利润总额81.6亿英镑，高于预期
- 市场消息：Meta准备撤销对Manus的收购
- 年内逾200家港股公司回购，科技、消费类公司最积极
- 广东“十五五”规划纲要：加强脑机接口系统攻关，推动非侵入式脑机接口集成产品开发研制
- 广东“十五五”规划纲要：加快布局光芯片等领域大力发展核心设备及零部件、关键材料
- 广东“十五五”规划纲要：推动星箭等重点产品低成本批量化生产，加速北斗系统创新应用场景开发
- 影石创新：第一季度净利润8462.02万元，同比下降52.02%
- 微软公司：将不再向OpenAI支付收入分成，微软的OpenAI许可现将转为非独家许可
- 恒指午间休盘跌0.66%，恒生科技指数跌1.23%
- 恒指开盘跌0.43%，宁德时代跌超6%
- 恒生科技指数跌超2%
- 我国最大规模AI4S集群接入全国一体化算力网
- 我国首款正向设计自转旋翼机完成首飞
- 折叠屏手机赛道再度火热，各大厂商竞相发布新技术
- 拆除多层分销、API导流“暗门”，中小助贷机构面临出局风险
- 拒买新闻就交税，澳洲拟向科技巨头征约2%营收税
- 招商银行：一季度归母净利润同比增长1.52%，资产负债规模增长
- 支付宝“AI收”上线
- 文峰股份：4月30日起实施其他风险警示，股票简称变更为ST文峰
- 日本央行大幅上调通胀预期
- 日本央行连续第三次会议将目标利率维持在0.75%不变，符合预期
- 日本电装放弃收购罗姆，将推进合作
- 日本航空将测试用人形机器人在机场搬货，以应对人手短缺
- 昆仑万维：第一季度营收同比增长45.69%，短剧业务单月流水超4800万美元
- 是否考虑布局上游电芯？阳光电源回应
- 最前线｜爱芯元智仇肖莘：大算力芯片将成为企业明年的主要增长引擎
- 最新人身险产品预定利率研究值首次回升
- 格力电器：已具备做“人形机器人”的能力
- 格林美：已向香港联交所更新递交H股发行上市申请
- 欧洲央行表示3月消费者通胀预期上升
- 比亚迪电子：一季度净利润2783万元，同比下降95.53%
- 比亚迪：一季度净利润40.8亿元，同比下降55.38%
- 比亚迪：部分车型选装天神之眼B辅助驾驶激光版的价格将从9900元上调为12000元
- 氪星晚报｜我国最大规模AI4S集群接入全国一体化算力网；亚马逊低地轨道卫星计划又一批卫星发射升空；我国首款正向设计自转旋翼机完成首飞
- 沃尔核材：公司单通道224G高速通信线已实现量产
- 沪深两市成交额突破2万亿
- 泡泡玛特LABUBU冰箱Home款将于京东发售
- 派拉蒙寻求FCC批准中东资本大幅持股
- 浙数文化：一季度归母净利润1.6亿元，同比增加11.32%
- 海油发展：第一季度净利润6.37亿元，同比增长7.31%
- 涛涛车业：第一季度净利润1.76亿元，同比增长104.50%
- 深交所：港股通标的证券名单调入迈威生物-B
- 深圳华强：第一季度净利润2.01亿元，同比增长90.28%
- 深圳市汇川技术股份有限公司向港交所提交上市申请书
- 清越科技：实施其他风险警示，股票停牌
- 澳大利亚拟对科技巨头征收约2%税费，除非达成本地新闻付费协议
- 热门中概股美股盘前多数下跌，理想汽车跌超4%
- 特斯拉注册与马斯克2018年薪酬方案相关的逾3亿股股票，价值近1150亿美元
- 独家对谈｜缘启智慧CEO邓江，一个80后银行码农出身的AI医疗创业者
- 环旭电子：一季度归母净利润4.17亿元，同比增加24.57%
- 现货白银日内跌幅达2%
- 现货黄金失守4600美元关口
- 现货黄金日内跌幅扩大至1%
- 生益电子：第一季度净利润4.45亿元，同比增长122%
- 生益科技：第一季度净利润11.58亿元，同比增长105.47%
- 用AI做IP，文娱科技公司星迹互动完成数千万元天使轮融资｜36氪融资首发
- 电装公司拟斥资至多3136亿日元回购自身股票
- 百度发全员信通知职级体系大调整
- 百达精工：2025年归母净利润亏损2.26亿元，同比由盈转亏
- 盈富基金获南向资金净买入41.37亿港元
- 石化油服：一季度归母净利润2.05亿元，同比下滑6.20%
- 磷酸铁锂行业掀扩产潮，瞄准高端化布局一体化
- 神力股份：第一季度净利润689.04万元，同比增长1404%
- 红日药业：一季度归母净利润6571.48万元，同比增加8.93%
- 美国会预算办公室：未来十年美政府赤字增加超万亿美元
- 美的集团旗下公司等成立创投合伙企业
- 美股三大指数收盘涨跌不一，英伟达涨4%创新高
- 美股大型科技股盘前跌多涨少，Arm跌超7%
- 翔鹭钨业：第一季度净利润2.51亿元，同比增长2917%
- 联想上海科技公司注册资本增至6.22亿元
- 胜宏科技：惠州厂房四项目已分阶段逐步投产，目前处于爬坡与量产阶段
- 腾讯入股珠海横琴红杉见远创投基金
- 自组织光束让3D成像速度提升25倍
- 航空燃油成本上涨，泰国亚航宣布大幅削减航班
- 英国石油一季度调整后净利润32亿美元，高于预期
- 荣昌生物：第一季度净利润为3.28亿元，同比扭亏为盈
- 行业景气度持续上行，光纤光缆上市公司一季度“成绩单”亮眼
- 西王食品：公司及实控人遭证监会立案调查
- 诺华第一季度核心每股收益1.99美元，低于预估
- 谷歌DeepMind首席执行官访韩，会见现代汽车和LG集团负责人
- 起帆电缆：第一季度净利润9534.09万元，同比增长36.27%
- 超捷股份：商业火箭箭体结构件预计今年二季度起陆续交付
- 轮毂螺栓可能脱落，特斯拉在美召回173辆Cybertruck
- 软银携手科技巨头，打造5000亿美元AI数据中心
- 近期全国生猪价格企稳回升
- 追尾后油箱或泄漏，大众在美召回38710辆Taos
- 追觅硅谷发布会首日，火箭车Nebula NEXT 01 JET Edition亮相
- 通用汽车第一季度净利润26.27亿美元，同比减少5.7%
- 银行密集“上锁”基金代销，原油基金被推至最高风险档位
- 长周期考核“压力测试”，基金经理行为模式演绎“进化论”
- 长芯博创：拟1.96亿元收购高速有源光缆公司长芯盛2.20%股份
- 阳光电源：未来三年储能的整体装机规模会增加，预计增速在30%—50%之间
- 阿里发布第三个癌症AI模型DAMO COCA
- 险资一季度优化权益配置，泛科技与新能源成核心主线
- 零跑计划2027年推出第二品牌
- 青松股份：第一季度净利润2192.36万元，同比增长1048%
- 韩国散户“扫货”中国PCB龙头
- 韩国法院下令取消对奈飞征收的687亿韩元税款
- 韩股市值超越英国，成为全球第八大股市
- 顺丰控股：第一季度净利润25.26亿元，同比增长13.05%
- 飞猪在上海成立文化服务新公司
- 首旅酒店：一季度归母净利润1.69亿元，同比增长18.51%
- 骑士乳业：一季度归母净利润1245.95万元，同比增长16.97%
- 龙旗科技：一季度归母净利润1540.87万元，同比下降90%
404 Media
- Did a Time Traveling Superintelligent AI Try to Warn About White House Correspondents Dinner Shooting? An Investigation
- People Using AI to Represent Themselves in Court Are Clogging the System
- University Professors Disturbed to Find Their Lectures Chopped Up and Turned Into AI Slop
Ars Technica
- China kills Meta’s acquisition of Manus as US-China AI rivalry deepens
- Musk and Altman face off in trial that will determine OpenAI's future
- OpenAI ends its exclusive partnership with Microsoft
Ben's Bites
- Builders
Cerbero Blog
- ROMFS Format Package
daringfireball.net
- Rec League
- Sponsor The Talk Show
- Yours Truly on The Vergecast
darkreading
- UNC6692 Combines Social Engineering, Malware, Cloud Abuse
Data Breach
- Medtronic discloses security incident after ShinyHunters claimed theft of 9M+ records
defend.network
- Daily Threat Briefing – April 28, 2026
Der Flounder
- Managing Apple Intelligence settings for macOS using Blueprints in Jamf Pro
EFF
- The Internet Still Works: SmugMug Powers Online Photography
ElcomSoft blog
- Digital Triage Masterclass
Emergent Minds | paddo.dev
- The 43% Denominator: AI Productivity Net of Rework
Hacker News Frontpage
- Claire's closes all 154 stores in UK and Ireland with loss of 1,300 jobs
- Generative AI Vegetarianism
- GTFOBins
- I quit drinking for a year
- New Gas-Powered Data Centers Could Emit More Greenhouse Gases Than Whole Nations
- New Integrated by Design FreeBSD Book
- NPM Website Is Down
- OpenAI CEO's Identity Verification Company Announced Fake Bruno Mars Partnership
- Period tracking app has been yapping about your flow to Meta
- Scraping 241 UK council planning portals – 2.6M decisions so far
- Show HN: AgentSwift – Open-source iOS builder agent
- Show HN: Live Sun and Moon Dashboard with NASA Footage
- The Social Edge of Intellgience: Individual Gain, Collective Loss
- UAE Leaves OPEC and OPEC+
- United Arab Emirates to quit oil cartel OPEC
- Who owns the code Claude Code wrote?
HackerNews
- OpenSSH ćźć´žćš—č— 15 ĺš´ďźŒĺŻč‡´ĺŽŒĺ…¨ root ćƒé™čŽżé—Ž
- Robinhood č´Śćˆˇĺˆ›ĺťşćźć´žéĺˆŠç”¨ďźŒč˘Ťç”¨äşŽĺ‘é€ç˝‘çťœé’“éąźé‚Žäťś
- ShinyHunters ĺŽŁç§°ç›—čľ°čś… 900 ä¸‡ćĄčŽ°ĺ˝•ďźŒMedtronic éšĺŽčŻĺŽžĺŽ‰ĺ…¨äş‹äťś
- â€œPack2TheRootâ€ďźšć˜“č˘ŤĺˆŠç”¨çš„ Linux ćźć´žĺŻč‡´čŽˇĺž— root ćƒé™
- çŤç‹ćźć´žĺŻč‡´ Tor ç”¨ćˆˇč˘ŤćŒ‡çşščŻ†ĺˆŤ
HackerNoon
- Challenges Facing the MCP in 2026: Critical Security, Architectual, and More
- Israel Just Tokenized the World's Best Performing Currency. Why Wall Street Is Paying Attention
Horizon3.ai
- The State of Assumed Security
ICT Security Magazine
- Automotive Cybersecurity: dal Regolamento UN R155 alla realtà delle officine italiane
- Dalla teoria alla realtà: cosa manca davvero nella gestione delle crisi cyber
- Stato e mercato nella dimensione underwater
idiallo.com
- Don't use localhost:3000, use your own custom domain
IEEE Spectrum
- “Entanglement: A Brief History of Human Connection”
infosecurity-magazine.com
- Chinese National Extradited Over Silk Typhoon Cyber Campaign
- No Metrics Are Better Than Bad Metrics in the SOC, Says NCSC
- North Korean Hackers Target Crypto Firms with ClickFix and AI-Made Zoom Lures
- Ransomware Turf War as 0APT and KryBit Groups Trade Blows
IT Service Management News
- IT-Grundschutz 2022
joanwestenberg.com
- The Loop: everything has happened before, and everything will happen again
MIT Technology Review
- Elon Musk and Sam Altman are going to court over OpenAI’s future
- The Download: Musk and Altman’s legal showdown, and AI’s profit problem
- The missing step between hype and profit
NowSecure
- The Third-Party Mobile App Risk Hidden Inside Your Approved Apps
NVIDIA AI Blog
- Into the Omniverse: Manufacturing’s Simulation-First Era Has Arrived
pluralistic.net
- Pluralistic: Vicky Osterweil's "The Extended Universe" (28 Apr 2026)
PortSwigger Blog
- PortSwigger recognized at the Northern Tech Awards 2026.
Product Hunt
- Kinhub
Recent Commits to cve:main
- Update Tue Apr 28 11:33:50 UTC 2026
rtl-sdr.com
- Bending the Flipper Zero’s CC1101 Into an APRS Transmitter
- Detecting Hidden GPS Trackers via Electromagnetic Unintentional Emissions with a HackRF
- Fixing a Locked-Up RTL-SDR 700 km Away Using uhubctl USB Power Cycling
SANS Internet Storm Center, InfoCON: green
- HTTP Requests with X-Vercel-Set-Bypass-Cookie Header, (Tue, Apr 28th)
- ISC Stormcast For Tuesday, April 28th, 2026 https://isc.sans.edu/podcastdetail/9908, (Tue, Apr 28th)
Security Affairs
- Microsoft fixes Entra ID flaw enabling privilege escalation
- NCSC launches SilentGlass, a plug-in device to secure HDMI and DisplayPort links
- New Android spyware Morpheus linked to Italian surveillance firm
- Signal Phishing Campaign Targets German Officials in Suspected Russian Operation
simonwillison.net
- Introducing talkie: a 13B vintage language model from 1930
- microsoft/VibeVoice
- Quoting Matthew Yglesias
- Speech translation in Google Meet is now rolling out to mobile devices
- Tracking the history of the now-deceased OpenAI Microsoft AGI clause
- What's new in pip 26.1 - lockfiles and dependency cooldowns!
Sploitus.com Exploits RSS Feed
- Exploit for Code Injection in Vmware Spring_Cloud_Function exploit
- Exploit for CVE-2026-42167 exploit
- Exploit for Deserialization of Untrusted Data in Openidentityplatform Openam exploit
- Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware exploit
- Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware exploit
- Exploit for Out-of-bounds Read in Polkit_Project Polkit exploit
- Exploit-Hub exploit
- IPDevicePenTest exploit
steveblank.com
- Anthropic Mythos – We’ve Opened Pandora’s Box
Swing'Blog 有恨无人省
- CVE-2026-41651 PackageKit TOCTOU 本地提权漏洞分析
TechCrunch
- Apple introduces a cheaper option for App Store subscriptions
- BCI startup Neurable looks to license its ‘mind-reading’ tech for consumer wearables
- Consumers lost $2.1 billion to social media scams in 2025, FTC reports
- DeepMind’s David Silver just raised $1.1B to build an AI that learns without human data
- Drizzle on top: a new high-end dog food brand is coming for the 1%
- Hacker who allegedly carried out cyberattacks for China is extradited to U.S.
- India’s Snabbit closes $56M round as investor interest in on-demand home services heats up
- Investors back Skye’s AI home screen app for iPhone ahead of launch
- Letterboxd, the social platform for film buffs, reportedly looking for new owner
- OpenAI ends Microsoft legal peril over its $50B Amazon deal
- Otter’s new feature lets users search across their enterprise tools
- Red Hat’s OpenClaw maintainer just made enterprise Claw deployments a lot safer
- Snapchat brings AI-powered conversational advertising to its app
- YouTube is testing an AI-powered search feature that shows guided answers
The Decoder
- Google signs AI deal with the Pentagon, ignoring protest from over 600 employees
- Google's "Ask YouTube" turns video search into a conversation
- Meta scrambles to unwind Manus deal as Beijing's deadline looms
- Mistral AI takes on enterprise AI orchestration with Workflows
- Researchers find AI text is making the internet more uniform and weirdly cheerful
The Verge
- Canonical lays out a plan for AI in Ubuntu Linux
- Conspiracy theories are swirling about the White House Correspondents’ Dinner shooting
- Google and Pentagon reportedly agree on deal for ‘any lawful’ use of AI
- Google employees ask Sundar Pichai to say no to classified military AI use
- It’s a busy time for sci-fi, but don’t miss Aphelion
- Jury selection in Musk v. Altman: ‘People don’t like him’
- Microsoft and OpenAI’s famed AGI agreement is dead
- Musk and Altman go to court
- Samsung’s first smart glasses have leaked
- Trump demands ABC fire Jimmy Kimmel
troyhunt.com
- Weekly Update 501
VulDB Recent Entries
- CVE-2024-54011 | Hanwha Vision QND-8080R up to 2.23.x denial of service
- CVE-2024-54012 | Hanwha Vision QND-8080R up to 2.23.x Request os command injection
- CVE-2024-54013 | Hanwha Vision QND-8080R up to 2.23.x missing authentication
- CVE-2025-69689 | Fan Control Application prior 251 permission
- CVE-2026-0711 | Zyxel DX3300-T0 up to 5.50(ABVY.7.1)C0 EasyMesh-related API os command injection
- CVE-2026-1460 | Zyxel DX3301-T0/EX3301-T0 up to 5.50(ABVY.7.1)C0 Configuration File DomainName os command injection
- CVE-2026-20766 | Milesight MS-Cxx72-FIPKG1 heap-based overflow (icsa-26-113-03)
- CVE-2026-25908 | Dell Alienware Command Center up to 6.13.8.0 unnecessary privileges (dsa-2026-192)
- CVE-2026-27785 | Milesight MS-Cxx72-FIPKG1 hard-coded credentials (icsa-26-113-03)
- CVE-2026-28747 | Milesight MS-Cxx72-FIPKG1 authorization (icsa-26-113-03)
- CVE-2026-30462 | Daylight Studio FuelCMS 1.5.2 Blocks path traversal
- CVE-2026-31686 | Linux Kernel up to 7.0.0 kasan kasan_free_pxd double free
- CVE-2026-31687 | Linux Kernel up to 6.19.1 gpio probe deadlock
- CVE-2026-31688 | Linux Kernel driver_match_device use after free
- CVE-2026-31689 | Linux Kernel up to 6.19.12 lib/kobject.c edac_mc_alloc allocation of resources
- CVE-2026-31690 | Linux Kernel up to 6.18.22/6.19.12 cpu_to_be16 buffer overflow
- CVE-2026-31691 | Linux Kernel up to 6.18.22/6.19.12 igb napi_synchronize infinite loop
- CVE-2026-32644 | Milesight MS-Cxx72-FIPKG1 SSL Certificate hard-coded key (icsa-26-113-03)
- CVE-2026-32649 | Milesight MS-Cxx72-FIPKG1 Web Server os command injection (icsa-26-113-03)
- CVE-2026-3323 | VEGA Grieshaber VEGAPULS 6X Two-wire PROFINET/Modbus TCP/OPC UA Configuration Interface missing authentication (VDE-2026-016)
- CVE-2026-38934 | diskover-community up to 2.3.5 settings_process.php cross-site request forgery
- CVE-2026-38935 | diskover-community up to 2.3.5 public/view.php doctype cross site scripting
- CVE-2026-38936 | diskover-community up to 2.3.5 public/selectindices.php namecontains cross site scripting
- CVE-2026-40355 | MIT Kerberos 5 up to 1.22.2 NegoEx Mechanism /etc/gss/mech gss_accept_sec_context null pointer dereference
- CVE-2026-40356 | MIT Kerberos 5 up to 1.22.2 /etc/gss/mech gss_accept_sec_context integer underflow
- CVE-2026-40967 | Vmware Spring AI up to 1.0.5/1.1.4 Expressions FilterExpressionConverter code injection
- CVE-2026-40971 | Vmware Spring Boot up to 3.5.13/4.0.5 RabbitMQ Auto-configuration certificate validation
- CVE-2026-40972 | Vmware Spring Boot up to 4.0.5 DevTools timing discrepancy
- CVE-2026-40973 | Vmware Spring Boot up to 4.0.5 temp file
- CVE-2026-40974 | Vmware Spring Boot up to 4.0.5 Cassandra Auto-Configuration certificate validation
- CVE-2026-40975 | Vmware Spring Boot up to 4.0.5 ${random.value} random values
- CVE-2026-40976 | Vmware Spring Boot up to 4.0.5 Health authorization
- CVE-2026-40977 | Vmware Spring Boot up to 4.0.5 PID File ApplicationPidFileWriter link following
- CVE-2026-40978 | Vmware Spring AI up to 1.0.5/1.1.4 Document ID CosmosDBVectorStore sql injection
- CVE-2026-41362 | OpenClaw up to 2026.3.30 Zalo Webhook Replay-Dedupe event_name/message_id exposure of resource (GHSA-fqrj-m88p-qf3v)
- CVE-2026-41363 | OpenClaw up to 2026.3.24 Feishu Extension upload_image path traversal (GHSA-qf48-qfv4-jjm9)
- CVE-2026-41364 | OpenClaw up to 2026.3.30 SSH Sandbox tar Upload link following (GHSA-fv94-qvg8-xqpw)
- CVE-2026-41365 | OpenClaw up to 2026.3.30 Graph API confused deputy (GHSA-chfm-xgc4-47rj)
- CVE-2026-41366 | OpenClaw up to 2026.3.30 appendLocalMediaParentRoots permission assignment (GHSA-57gh-m6rq-54cf)
- CVE-2026-41367 | OpenClaw up to 2026.3.24 Discord authorization (GHSA-jp4j-q5fc-58gv)
- CVE-2026-41368 | OpenClaw up to 2026.3.27 Environment Variable ENV exposure of resource (GHSA-jccr-rrw2-vc8h)
- CVE-2026-41369 | OpenClaw up to 2026.3.30 Environment Variable exposure of resource (GHSA-cg7q-fg22-4g98)
- CVE-2026-41370 | OpenClaw up to 2026.3.30 ACP Dispatch path traversal (GHSA-58q2-7r52-jq62)
- CVE-2026-41371 | OpenClaw up to 2026.3.27 Gateway Caller chat.send authorization (GHSA-5r8f-96gm-5j6g)
- CVE-2026-41372 | OpenClaw up to 2026.4.1 Remote CDP Discovery Response authorization (GHSA-fh32-73r9-rgh5)
- CVE-2026-41526 | KDE KCoreAddons up to 6.24 sendInput control sequence
- CVE-2026-42510 | OpenStack Ironic up to 25.0.0 ipmitool inclusion of functionality from untrusted control sphere
- CVE-2026-4911 | masaakitanaka Booking Package Plugin up to 1.7.06 on WordPress Stripe PaymentIntent API CreditCard.php intentForStripe Amount external control of assumed-immutable web parameter
- CVE-2026-5306 | Check & Log Email Plugin up to 2.0.12 on WordPress Setting cross site scripting
- CVE-2026-5435 | GNU C Library up to 2.2 ns_printrrf/ns_printrr/fp_nquery out-of-bounds write
- CVE-2026-5779 | MphRx Minerva 3.6.0 updateUserProfile access control
- CVE-2026-5780 | MphRx Minerva 3.6.0 Endpoint /minerva/moUser/show/ access control
- CVE-2026-5781 | MphRx Minerva 3.6.0 Graphical User Interface /minerva/moUser/update Identifier improper authorization
- CVE-2026-6551 | techeshta Timeline Blocks for Gutenberg Plugin up to 1.1.10 on WordPress cross site scripting
- CVE-2026-6725 | wpclever WPC Smart Messages for WooCommerce Plugin up to 4.2.8 on WordPress wpcsm_text_rotator text cross site scripting
- CVE-2026-6809 | dartiss Social Post Embed Plugin up to 2.0.1 on WordPress cross site scripting
- CVE-2026-7234 | BrowserOperator browser-operator-core up to 0.6.0 server.js startsWith request.url path traversal (Issue 96)
- CVE-2026-7235 | ErlichLiu claude-agent-sdk-master up to b185aa7ff0d864581257008077b4010fca1747bf route.ts outputFile path traversal
- CVE-2026-7237 | AgiFlow scaffold-mcp up to 1.0.27 write-to-file Tool index.ts file_path path traversal (Issue 88)
- CVE-2026-7238 | code-projects Online Music Site 1.0 AdminUpdateAlbum.php txtimage unrestricted upload
- CVE-2026-7240 | Totolink A8000RU 7.1cu.643_b20200521 CGI /cgi-bin/cstecgi.cgi setVpnAccountCfg User os command injection
- CVE-2026-7241 | Totolink A8000RU 7.1cu.643_b20200521 CGI /cgi-bin/cstecgi.cgi setWiFiBasicCfg wifiOff os command injection
- CVE-2026-7242 | Totolink A8000RU 7.1cu.643_b20200521 CGI /cgi-bin/cstecgi.cgi setOpenVpnClientCfg enabled os command injection
- CVE-2026-7243 | Totolink A8000RU 7.1cu.643_b20200521 CGI /cgi-bin/cstecgi.cgi setRadvdCfg maxRtrAdvInterval os command injection
- CVE-2026-7244 | Totolink A8000RU 7.1cu.643_b20200521 CGI /cgi-bin/cstecgi.cgi setWiFiEasyGuestCfg merge os command injection
- CVE-2026-7247 | D-Link DI-8100 16.07.26A1 File Extension file_exten.asp file_exten_asp Name buffer overflow
- CVE-2026-7248 | D-Link DI-8100 16.07.26A1 CGI Endpoint tgfile.htm tgfile_htm fn buffer overflow
- CVE-2026-7264 | SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=get_cart_items ID sql injection
- CVE-2026-7265 | SourceCodester Pizzafy Ecommerce System 1.0 index.php?page=category ID sql injection
- CVE-2026-7266 | SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=save_order ID sql injection
- CVE-2026-7267 | SourceCodester Pizzafy Ecommerce System 1.0 /view_prod.php ID sql injection
- CVE-2026-7268 | SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=save_category Name sql injection
- CVE-2026-7269 | SourceCodester Pharmacy Sales and Inventory System 1.0 /index.php?page=product ID cross site scripting
- CVE-2026-7279 | eMPIA AVACAST up to 5.10.10.43 DLL uncontrolled search path
- CVE-2026-7280 | eMPIA AVACAST up to 5.10.10.43 unquoted search path
- CVE-2026-7283 | SourceCodester Pharmacy Sales and Inventory System 1.0 ajax.php?action=save_expired ID sql injection
- CVE-2026-7291 | o2oa up to 10.0 URL Fetching FileAction.java FileAction fileUrl server-side request forgery (Issue 195)
- CVE-2026-7292 | o2oa up to 10.0 NodeAgent NodeAgent.java syncFile improper authorization (Issue 194)
- CVE-2026-7293 | SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=delete_category ID sql injection
- CVE-2026-7294 | SourceCodester Pizzafy Ecommerce System 1.0 index.php?page=save_settings Name cross site scripting
- CVE-2026-7295 | SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=save_menu Name cross site scripting
- CVE-2026-7296 | SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=save_order first_name cross site scripting
- CVE-2026-7297 | SourceCodester Pizzafy Ecommerce System 1.0 ajax.php?action=save_user Name cross site scripting
- CVE-2026-7309 | Red Hat OpenShift Container Platform 4 Environment Variable LD_PRELOAD/http_proxy information disclosure
- CVE-2026-7316 | eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af code_with_ai aider_mcp.py working_dir/editable_files command injection
- CVE-2026-7317 | Grav CMS up to 1.7.49.5/2.0.0-beta.1 Cache Value FileCache.php FileCache::doGet deserialization (GHSA-gwfr-jfjf-92vv / c66dfeb5f)
- CVE-2026-7318 | elie mcp-project 0.1.0 research_server.py search_papers topic path traversal
- CVE-2026-7319 | elinsky execution-system-mcp 0.1.0 add_action Tool server.py _get_context_file_path context path traversal
Wallarm
- 6 Lessons Security Leaders Must Learn About AI and APIs
Wired
- A DOGE Affiliate Is Now in Charge of the US Government's ID Platform
- Acer Swift 16 AI (2026) Review: Where Do Your Hands Go?
- Amazon's Kindle Colorsoft Gets a Dark Mode (2026)
- Best Buy Discount Codes: Up to 60% Off
- Cole Allen Charged With Attempting to Assassinate Trump
- Elon Musk Boosts New Yorker’s Sam Altman Exposé on X as Trial Begins
- Get Ready for More Brain-Scanning Consumer Gadgets
- Hulu Promo Codes & Discounts: 20% Off in April
- InkPoster Tela 28.5 Review: A Luxe Home Digital Frame
- OnePlus Promo Code: $70 Off | April 2026
- Some Musk v. Altman Jurors Don't Like Elon Musk
- Squarespace Promo Codes: 20% Off in May 2026
- Stop Trying to Unmask Satoshi Nakamoto
- The 4 Best Laptop Power Banks We've Tested (2026)
- The Bloomberg Terminal Is Getting an AI Makeover, Like It or Not
- The Hottest Anti-AI Gadget Is a Cyberdeck
- The M5 MacBook Air Has Never Been Cheaper
- The Race Is on to Keep AI Agents From Running Wild With Your Credit Cards
- WIRED’s Smart Home Ecosystem Guide (2026)
不安全
- Bending the Flipper Zero’s CC1101 Into an APRS Transmitter
- HTTP Requests with X-Vercel-Set-Bypass-Cookie Header, (Tue, Apr 28th)
- Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover
- pgBackRest 作者宣布停止维护该项目
- 北京市海淀区工商联领导一行莅临绿盟科技调研指导
- 国安部称境外组织资助煽动“躺平”思想
- 德国稀土磁铁回收厂启用降低对中国依赖
- 欧盟要求谷歌向AI竞争对手开放安卓系统
代码审计星球
- 原域名已变更且将在2024年彻底废弃，请访问 https://govuln.com/news/ 查看新的RSS订阅
先知技术社区
- 2026DCIC数字中国创新大赛网安赛道初赛部分题解
博客
- networkd-dispatcher
奇客Solidot–传递最新科技情报
- GitHub Copilot 切换到基于使用量的计费方式
- pgBackRest 作者宣布停止维护该项目
- 尼安德特人和现代人类大脑之间主要是外观上的差异
爱范儿
- 9秒删光公司数据库，我花最贵的钱，买了一个「删库跑路」的AI
- OpenAI 和微软官宣「分手」，七年 CP 终成塑料
- 中国汽车的问题，除了新车太像，还有新车太多
- 交付六万台之后，更宽敞的领克 900 大五座版也来了，25.48 万元起
- 早报｜小米玄戒O1出货破百万，未来还将「上车」/OpenAI与微软「分手」/小红书发布首份AI治理主张
绿盟科技技术博客
- 北京市海淀区工商联领导一行莅临绿盟科技调研指导
- 第68期《绿盟+》《安全+》上线啦~
量子位 QbitAI
- 我嘞个豆！中国企业牵头，ICLR这场Workshop被挤爆了
阿小信的博客
- 前端表格操作库 Tabulator 常用功能整理：排序、过滤、编辑
黑海洋
- DeepSeek注册资本增加梁文锋总持股超84%
- Meta 已着手准备撤销其对 Manus 的收购
- Ubuntu将在接下来的一年中开始引入AI功能
- 三星将撤出中国家电销售最快本月低决定
- 国安部称境外组织资助煽动“躺平”思想
- 德国稀土磁铁回收厂启用降低对中国依赖
- 数据中心需求驱动天然气发电厂成本飙升66%
- 欧盟要求谷歌向AI竞争对手开放安卓系统
- 泰勒·斯威夫特申请声音和肖像注册商标
- 美国苹果公司面临不公平劳动行为指控
- 谷歌员工要求CEO对机密军事AI用途说不
- 谷歌的新渐变图标设计将应用于更多App