Aggregator

A vulnerability categorized as critical has been discovered in hcengineering Huly Platform 0.7.382. This affects an unknown part of the file server/front/src/index.ts of the component Import Endpoint. Such manipulation leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2026-5623. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as problematic has been detected in ProjectSend r2002. This vulnerability affects unknown code of the file upload.php. Performing a manipulation results in cross-site request forgery. This vulnerability was named CVE-2026-5624. The attack may be initiated remotely. In addition, an exploit is available. You should upgrade the affected component.

A vulnerability labeled as problematic has been found in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt_researcher/skills/researcher.py of the component WebSocket Interface. Executing a manipulation of the argument task can lead to cross site scripting. The identification of this vulnerability is CVE-2026-5625. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability marked as critical has been reported in Belkin F9K1015 1.00.10. Impacted is the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. The manipulation of the argument webpage leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2026-5628. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as critical has been identified in Belkin F9K1015 1.00.10. The affected element is the function formSetFirewall of the file /goform/formSetFirewall. The manipulation of the argument webpage results in stack-based buffer overflow. This vulnerability is identified as CVE-2026-5629. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. This vulnerability is cataloged as CVE-2026-5632. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability identified as critical has been detected in Linux Kernel. This affects an unknown function of the component xattr. The manipulation leads to uncontrolled memory allocation. This vulnerability is documented as CVE-2024-14027. The attack needs to be performed locally. There is not any exploit available. It is suggested to install a patch to address this issue.

A vulnerability, which was classified as critical, was found in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument source_urls can lead to server-side request forgery. This vulnerability is registered as CVE-2026-5633. It is possible to launch the attack remotely. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Сбой 3 апреля затронул СБП и крупнейшие банки РФ на фоне заявлений о борьбе с VPN.

好的，我现在需要帮用户总结一篇文章，控制在100字以内，而且不需要用“文章内容总结”这样的开头。首先，我得仔细阅读文章，理解其主要内容。 文章主要讨论开放重定向（open redirect）被威胁行为者滥用的情况。虽然这种漏洞本身不算高风险，但作者指出它常被用于钓鱼攻击。链接指向合法域名，容易骗过受害者和简单的检测机制。作者还提到尽管OWASP不再列出它为顶级漏洞，但攻击者从未停止利用它。 接下来，作者分析了2026年第一季度的钓鱼邮件数据，发现有超过21%的邮件使用了重定向。这些重定向机制多种多样，包括半开放、完全开放以及广告或跟踪系统中的重定向。特别是像Google这样的半开放重定向机制，虽然需要特定令牌，但这些令牌通常可重复使用且有效期长，容易被滥用。 最后，作者建议开发者确保自己的应用不暴露易被滥用的重定向端点，并在必要时监控和限制使用。 现在我需要将这些要点浓缩到100字以内。重点包括：开放重定向被滥用、用于钓鱼、合法域名欺骗、检测困难、攻击者持续利用、数据统计结果、机制多样性以及防范建议。 可能的结构：开放重定向被威胁行为者滥用用于钓鱼攻击；链接指向合法域名欺骗受害者；攻击者持续利用；统计数据显示其常见性；机制多样；建议开发者防范。 现在试着组织语言： “文章探讨了开放重定向被威胁行为者滥用的情况。虽然这种漏洞本身不算高风险，但常用于钓鱼攻击。链接指向合法域名欺骗受害者和检测机制。尽管OWASP不再列为顶级漏洞，攻击者仍持续利用。数据显示2026年第一季度有超过21%的钓鱼邮件使用了此类机制。建议开发者确保应用不暴露易被滥用的端点。” 检查字数：大约100字左右。 文章探讨了开放重定向被威胁行为者滥用的情况。虽然这种漏洞本身不算高风险，但常用于钓鱼攻击。链接指向合法域名欺骗受害者和检测机制。尽管OWASP不再列为顶级漏洞，攻击者仍持续利用。数据显示2026年第一季度有超过21%的钓鱼邮件使用了此类机制。建议开发者确保应用不暴露易被滥用的端点。

A vulnerability identified as problematic has been detected in vim. Impacted is an unknown function. Performing a manipulation results in use of out-of-range pointer offset. This vulnerability is identified as CVE-2022-1420. The attack is only possible with local access. There is not any exploit available. You should upgrade the affected component.

A vulnerability labeled as critical has been found in vim up to 8.1. This issue affects the function skip_range. Such manipulation leads to heap-based buffer overflow. This vulnerability is traded as CVE-2022-1381. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability has been found in Libtiffs and classified as critical. Affected by this issue is the function main of the file tiffcp.c of the component TIFF File Handler. This manipulation causes stack-based buffer overflow. This vulnerability is tracked as CVE-2022-1355. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

A vulnerability has been found in Red Hat 3scale API Management 2 and classified as problematic. Affected is an unknown function. This manipulation causes improper use of validation framework. This vulnerability is tracked as CVE-2022-1414. The attack is only possible within the local network. No exploit exists.

A vulnerability, which was classified as problematic, was found in Libtiffs. Affected by this vulnerability is the function TIFFReadRawDataStriped of the file tiffinfo.c of the component TIFF File Handler. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2022-1354. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

嗯，用户让我总结这篇文章，控制在100字以内，而且不需要特定的开头。首先，我得通读整篇文章，抓住主要事件和关键点。 文章讲的是欧盟委员会的云安全事件，起因是Trivy工具被入侵。攻击者通过恶意版本的Trivy获取了AWS密钥，进而访问了云基础设施。数据泄露了大约91.7GB，影响了多个欧盟机构。整个事件展示了供应链攻击的风险，以及传统安全措施在面对内部威胁时的不足。 接下来，我需要把这些信息浓缩到100字以内。要突出事件原因、影响范围和揭示的问题。比如，“欧盟委员会云安全事件因Trivy工具供应链攻击引发”这样开头，然后提到数据泄露、受影响机构数量以及揭示的风险。 还要注意用词简洁，避免冗余。确保涵盖关键点：攻击方式、数据量、影响范围和供应链风险。最后检查字数是否符合要求。 欧盟委员会云安全事件因Trivy工具供应链攻击引发，导致91.7GB数据泄露并波及71个欧盟机构。攻击者通过恶意更新获取API密钥，利用可信工具隐藏行踪，凸显供应链攻击对云环境的风险。

В Общественной палате нашли новые нарушения у мессенджера.

A vulnerability marked as critical has been reported in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument cat_id leads to sql injection. This vulnerability is traded as CVE-2026-5672. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Submit #792389 / VDB-355500

A vulnerability labeled as critical has been found in Linux Kernel up to 6.19.9/7.0-rc4. Affected by this vulnerability is the function nlattr_to_sctp of the component netfilter. Executing a manipulation can lead to out-of-bounds read. This vulnerability appears as CVE-2026-31407. The attacker needs to be present on the local network. There is no available exploit. The affected component should be upgraded.