Aggregator

A vulnerability described as critical has been identified in renren-secuity up to 5.4.x. Affected is an unknown function of the file BaseServiceImpl.java. Executing a manipulation can lead to sql injection. This vulnerability is handled as CVE-2025-70821. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in Step-Video-T2V. This impacts the function get_data of the file /vae-api. Performing a manipulation results in deserialization. This vulnerability is known as CVE-2025-57622. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability labeled as critical has been found in iBoysoft NTFS 8.0.0 on macOS. This affects an unknown function of the component NSConnection Service. Such manipulation leads to incorrect permission assignment. This vulnerability is traded as CVE-2026-2637. An attack has to be approached locally. There is no exploit available.

A vulnerability identified as problematic has been detected in Biosig libbiosig 3.9.2. The impacted element is an unknown function of the component ABF Parser. This manipulation causes out-of-bounds read. This vulnerability appears as CVE-2025-64736. The attack may be initiated remotely. There is no available exploit.

A vulnerability categorized as critical has been discovered in Volcengine OpenViking up to 0.2.1. The affected element is an unknown function. The manipulation results in path traversal. This vulnerability is reported as CVE-2026-28518. The attack can be launched remotely. No exploit exists. Applying a patch is advised to resolve this issue.

A vulnerability was found in djangoproject Django up to 4.2.28/5.2.11/6.0.2. It has been rated as problematic. Impacted is an unknown function of the component File-System Backend. The manipulation leads to race condition. This vulnerability is documented as CVE-2026-25674. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

These are the top threats you should know about this week.

A vulnerability was found in Biosig libbiosig 3.9.2. It has been declared as critical. This issue affects some unknown processing of the component Intan CLP Parser. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is registered as CVE-2026-22891. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in Biosig libbiosig 3.9.2. It has been classified as critical. This vulnerability affects unknown code of the component Nicolet WFT Parser. Performing a manipulation results in heap-based buffer overflow. This vulnerability is cataloged as CVE-2026-20777. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in ccurtsinger stabilizer and classified as critical. This affects the function os.system of the component Command-Line Argument Handler. Such manipulation leads to command injection. This vulnerability is listed as CVE-2025-52365. The attack may be performed from remote. There is no available exploit.

A vulnerability has been found in Django up to 4.2.28/5.2.11/6.0.2 on Windows and classified as problematic. Affected by this issue is the function urllib.parse.urlsplit of the component NFKC Normalization. This manipulation causes resource consumption. This vulnerability is tracked as CVE-2026-25673. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

美国最高法院拒绝受理计算机科学家 Stephen Thaler 提起的 AI 生成作品是否拥有版权的案件。此前美国地方法院、上诉法院以及美国版权局都声明 AI 生成的艺术作品不受版权保护。美国专利局也表示，AI 系统不能被列为专利发明人，但人仍然可使用 AI 工具去开发专利。英国最高法院在 2023 年裁决 AI 不能成为专利的发明人——这起案件也是 Stephen Thaler 提起的。

Defensie wil de Franse F21 MK2-torpedo al tijdens de productiefase integreren in de 4 nieuwe onderzeeboten van de Orka-klasse. Eigenlijk was het plan ze in het begin uit te rusten met de MK48-torpedo’s van de huidige Walrus-vloot. Defensie ziet hier nu vanaf omdat versnelde vervanging van de MK48 mogelijk blijkt.    

Compromised cPanel credentials are being sold in bulk across underground channels as plug-and-play phishing and scam infrastructure. Flare explains how analyzing 200,000 underground posts reveals a commoditized market for hacked site management panels. [...]

Если на спутнике и так полно O₂, зачем везти его с Земли по молекулам?

Josys has transitioned into an autonomous identity governance platform, expanding beyond traditional SaaS management. The enhanced platform empowers IT leaders and managed service providers (MSPs) to scale governance and compliance efforts by centralizing identity data within a single, AI-driven system. With Verizon reporting that 80% of hacking breaches stem from compromised credentials, identity is the ultimate attack surface. As threats and costly non-compliance penalties surge, organizations can no longer rely on manual IT oversight. Autonomous … More →

The post Josys centralizes identity data to replace manual IT oversight with automated governance appeared first on Help Net Security.

When people consider what might track their movements, they think of smartphone apps, GPS services, or roadside cameras. The tires of a new car rarely enter that equation. Researchers at IMDEA Networks Institute, together with European partners, found that Tire Pressure Monitoring System (TPMS) sensors inside each wheel broadcast unencrypted wireless signals containing persistent identifiers. Each sensor sends out a unique ID that does not change, allowing the same car to be recognized again and … More →

The post $100 radio equipment can track cars through their tire sensors appeared first on Help Net Security.

According to court documents, the defendant purchased millions of dollars of labels but did not sell them with the corresponding software.

根据 Sensor Tower 的数据，在 OpenAI 与五角大楼达成交易之后，用户对此做出了反应，2 月 28 日当天 OpenAI AI 聊天机器人 ChatGPT 应用的卸载量在美国比前一天飙升 295%，而过去 30 天它的平均日卸载率是 9%。与此同时，拒绝五角大楼要求的 OpenAI 竞争对手 Anthropic 的 Claude 应用的下载量在 2 月 27 日和 2 月 28 日分别增长了 37% 和 51%。ChatGPT 的下载量也受到了交易的影响，在宣布与五角大楼合作前的 2 月 27 日 ChatGPT 下载量环比增长 14%，但宣布交易后的 28 日其下载量环比下降 13%，3 月 1 日下载量继续环比下降 5%。Claude 在美国免费应用排行榜也已经连续三天登上榜首，这一波热潮也导致 Claude 多次发生短暂的宕机。