Aggregator

Researcher Hacked Google Using AI and Earned $500,000 Bug Bounty

Cyber Security News
4 days 16 hours ago

A security researcher known as brutecat has disclosed how an AI-driven fuzzing pipeline uncovered more than $500,000 in vulnerabilities across Google’s infrastructure in under three months, exposing systemic access-control failures hidden inside roughly 1,500 APIs. The researcher began by targeting Google’s discovery documents machine-readable API specifications, similar to Swagger docs, that list all available endpoints, parameters, and […]

The post Researcher Hacked Google Using AI and Earned $500,000 Bug Bounty appeared first on Cyber Security News.

Guru Baran

东亚最高的树

Solidot
4 days 16 hours ago
研究人员在台大安溪附近发现了东亚已知最高的树，他们根据金庸小说将其命名为大安溪倚天劍。倚天劍高 84.1 米，树龄约一千年。世界上已知最高的树是加州红杉国家公园的 Hyperion，其高度约 116 米。台湾约 60% 的面积被森林覆盖，岛上估计有 9.5 亿棵树，其中有很多参天巨树。研究团队使用传统方法测量了倚天劍的高度：爬上树，从树顶垂下卷尺。

CVE-2026-50568 | Fission up to 1.24.x pkg/utils/utils.go resolution of path (GHSA-r5jh-q2mw-gcx4 / EUVD-2026-36072)

Vuldb Updates
4 days 16 hours ago
A vulnerability described as problematic has been identified in Fission up to 1.24.x. This issue affects some unknown processing of the file pkg/utils/utils.go. The manipulation results in improper resolution of path equivalence. This vulnerability is reported as CVE-2026-50568. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.
vuldb.com

CVE-2026-45062 | dunglas frankenphp prior 1.12.3 CGI Path Splitting unicode encoding (EUVD-2026-36075)

Vuldb Updates
4 days 16 hours ago
A vulnerability has been found in dunglas frankenphp and classified as problematic. This affects an unknown part of the component CGI Path Splitting. Performing a manipulation results in improper handling of unicode encoding. This vulnerability is identified as CVE-2026-45062. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.
vuldb.com

CVE-2026-46654 | Plonky3 up to 0.4.2/0.5.2 cryptographic primitive risky implementation (GHSA-vj64-rjf3-w3v7 / EUVD-2026-36119)

Vuldb Updates
4 days 16 hours ago
A vulnerability marked as problematic has been reported in Plonky3 up to 0.4.2/0.5.2. Affected is an unknown function. The manipulation leads to use of a cryptographic primitive with a risky implementation. This vulnerability is referenced as CVE-2026-46654. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-5497 | vLLM up to 0.18.x OpenAI-compatible Chat Completions API VideoMediaIO.load_base64 resource consumption (EUVD-2026-36217)

Vuldb Updates
4 days 16 hours ago
A vulnerability, which was classified as problematic, was found in vLLM up to 0.18.x. Affected is the function VideoMediaIO.load_base64 of the component OpenAI-compatible Chat Completions API. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-5497. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.
vuldb.com

CVE-2026-53901 | cerebrate up to 1.36 add params dynamically-determined object attributes (EUVD-2026-36216)

Vuldb Updates
4 days 16 hours ago
A vulnerability was found in cerebrate up to 1.36. It has been declared as critical. This vulnerability affects the function Add. The manipulation of the argument params results in dynamically-determined object attributes. This vulnerability is reported as CVE-2026-53901. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-53465 | ImageMagick up to 7.1.2-24 SF3 Encoder heap-based overflow (GHSA-44cp-c3ww-9rv5 / EUVD-2026-36192)

Vuldb Updates
4 days 16 hours ago
A vulnerability was found in ImageMagick up to 7.1.2-24. It has been declared as critical. This affects an unknown part of the component SF3 Encoder. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is handled as CVE-2026-53465. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-41696 | Vmware Spring Data MongoDB up to 5.0.5 String data query logic injection (CNNVD-202606-2872)

Vuldb Updates
4 days 16 hours ago
A vulnerability was found in Vmware Spring Data MongoDB up to 5.0.5. It has been rated as problematic. The affected element is an unknown function of the component String Handler. The manipulation leads to improper neutralization of special elements in data query logic. This vulnerability is listed as CVE-2026-41696. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.
vuldb.com

Managed ad