Aggregator

A vulnerability classified as critical has been found in OpenPrinting cups up to 2.4.16 on Linux. This issue affects the function _ppdCreateFromIPP of the file cups/ppd-cache.c of the component IPP Attribute Handler. The manipulation of the argument length leads to integer underflow. This vulnerability is referenced as CVE-2026-39314. The attack can only be performed from a local environment. No exploit is available.

A vulnerability described as problematic has been identified in OrangeHRM up to 5.8.0. This vulnerability affects unknown code of the component Attachment Handler. Executing a manipulation can lead to missing authorization. The identification of this vulnerability is CVE-2026-39348. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Online crime continues to generate rising financial losses, with totals reaching $20.877 billion in 2025. The FBI’s Internet Crime Complaint Center (IC3) report shows a 26% increase in total reported losses from the previous year. (Source: FBI) More than one million complaints were submitted during the year, with fraud accounting for the majority of losses. Cyber-enabled fraud totaled $17.7 billion, representing 85% of all reported financial damage. Complaint counts show a different pattern. Phishing or … More →

The post Cybercrime losses break the $20 billion mark appeared first on Help Net Security.

车联网安全基础：NFC中继攻击

A vulnerability labeled as critical has been found in Linux Kernel up to 6.6.129/6.12.77/6.18.19/6.19.9/7.0-rc4. This issue affects the function parse_durable_handle_context of the component ksmbd. Such manipulation leads to use after free. This vulnerability is documented as CVE-2026-23427. The attack requires being on the local network. There is not any exploit available. The affected component should be upgraded.

A vulnerability described as critical has been identified in Linux Kernel up to 7.0-rc2. This vulnerability affects unknown code of the component wifi. Such manipulation leads to denial of service. This vulnerability is traded as CVE-2026-23420. Access to the local network is required for this attack to succeed. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability categorized as critical has been discovered in Linux Kernel up to 7.0-rc4. Impacted is the function rose_connect. Such manipulation of the argument sk_state leads to null pointer dereference. This vulnerability is listed as CVE-2026-23460. The attack must be carried out from within the local network. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 7.0-rc4. This impacts the function DecodeQ931 of the component netfilter. The manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-23455. The attack must be carried out from within the local network. There is no available exploit. You should upgrade the affected component.

A vulnerability was found in Linux Kernel up to 7.0-rc4. It has been rated as critical. This issue affects the function mvpp2_bm_switch_buffers of the component mvpp2. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-23438. The attack is only possible within the local network. No exploit exists. Upgrading the affected component is advised.

A dangerous cyberattack campaign is actively hitting web applications across the internet at a frightening speed. Hackers are exploiting a critical security flaw called React2Shell, targeting websites built on the widely used Next.js framework. In just 24 hours, attackers broke into 766 servers and walked away with massive amounts of sensitive data, including passwords, cloud […]

The post Hackers Exploit Next.js React2Shell Flaw to Steal Credentials From 766 Hosts in 24 Hours appeared first on Cyber Security News.

基于ICSim模拟can总线来学习车辆网安全，学习伪造攻击和重放攻击基础

接上一篇的研究，我们这里学习protobuf的堆布局的利用以及总结的apple2的分地址写的模版

Как ученые приручили энтропию.

CVE-2026-31975：Cloud CLI WebSocket Shell OS命令注入漏洞分析

Privileged access abuse is behind most major cloud breaches. And it’s not always a sophisticated attacker – sometimes it’s a misconfigured service account that nobody reviewed in two years, or an IAM role inherited from an acquisition that was never cleaned up. The access was sitting there ungoverned and waiting. That’s exactly the problem cloud […]

The post Top Cloud Privileged Access Management Best Practices to Prevent Privilege Abuse appeared first on Security Boulevard.

Currently trending CVE - Hype Score: 1 - Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

A vulnerability classified as critical has been found in Novastar VNNOX iCare Novaicare 7.16.0. Impacted is an unknown function. The manipulation leads to improper access controls. This vulnerability is referenced as CVE-2021-38289. The attack needs to be initiated within the local network. No exploit is available.

A vulnerability was found in Apple iOS and iPadOS. It has been declared as critical. This vulnerability affects unknown code of the component Video File Handler. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-2024-44234. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple tvOS. It has been rated as critical. This issue affects some unknown processing of the component Video File Handler. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2024-44234. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.