A 39-year-old Australian national who was previously employed at U.S. defense contractor L3Harris has been sentenced to a little over seven years in prison for selling eight zero-day exploits to Russian exploit broker Operation Zero in exchange for millions of dollars.
Peter Williams pleaded guilty to two counts of theft of trade secrets in October 2025. In addition to the jail term, Williams
A vulnerability classified as critical was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This vulnerability affects unknown code of the file /api/admin/common/files/download. Executing a manipulation of the argument url can lead to server-side request forgery.
This vulnerability is handled as CVE-2026-3189. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
The project was informed beforehand and acted very professional: "We have added a URL protocol whitelist validation to the file download interface, allowing only http and https protocols."
A vulnerability classified as critical has been found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. This affects an unknown part of the file /api/admin/common/download/templates of the component API. Performing a manipulation of the argument templateName results in path traversal.
This vulnerability is known as CVE-2026-3188. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
It is recommended to upgrade the affected component.
The project was informed beforehand and acted very professional: "We have implemented path validity checks on parameters for the template download interface (...)"
A vulnerability described as critical has been identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown functionality of the file /api/admin/sys-file/upload of the component API Endpoint. Such manipulation leads to unrestricted upload.
This vulnerability is traded as CVE-2026-3187. The attack may be launched remotely. Furthermore, there is an exploit available.
Upgrading the affected component is recommended.
The project was informed beforehand and acted very professional: "We have introduced a whitelist restriction on the /api/admin/sys-file/upload endpoint via the oss.allowedExts and oss.allowedMimeTypes configuration options, allowing the specification of permitted file extensions and MIME types for uploads."
A vulnerability marked as critical has been reported in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argument userId causes use of default password.
This vulnerability appears as CVE-2026-3186. The attack may be initiated remotely. In addition, an exploit is available.
It is suggested to upgrade the affected component.
The project was informed beforehand and acted very professional: "We have added authorization validation to the password reset interface; now only users with the corresponding permissions are allowed to perform password resets."
A vulnerability labeled as critical has been found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component API Endpoint. The manipulation of the argument messageId results in authorization bypass.
This vulnerability is reported as CVE-2026-3185. The attack can be launched remotely. Moreover, an exploit is present.
The affected component should be upgraded.
The project was informed beforehand and acted very professional: "We have implemented message ownership verification, so that users can only query messages related to themselves."