Aggregator

A vulnerability marked as critical has been reported in OpenClaw up to 2026.2.14. Affected by this vulnerability is an unknown functionality of the component web_fetch. The manipulation leads to allocation of resources. This vulnerability is listed as CVE-2026-28394. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability classified as problematic was found in OpenClaw up to 2026.2.13. The affected element is an unknown function of the component Direct Message Handler. Executing a manipulation can lead to incorrect authorization. This vulnerability is registered as CVE-2026-28392. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability described as critical has been identified in OpenClaw up to 2026.2.11. This affects an unknown function of the file /api/channels/nostr/ of the component Nostr Plugin. The manipulation results in missing authentication. This vulnerability was named CVE-2026-28450. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in OpenClaw up to 2026.2.13. It has been classified as problematic. This issue affects the function extractArchive of the file src/infra/archive.ts. This manipulation causes allocation of resources. This vulnerability is registered as CVE-2026-28452. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is recommended.

A vulnerability categorized as critical has been discovered in OpenClaw up to 2026.2.13. The impacted element is an unknown function of the component Configuration Handler. Executing a manipulation can lead to path traversal. This vulnerability appears as CVE-2026-28453. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

Почему программисты назвали хайповый проект с GitHub пустышкой.

Researchers at AllSecure have revealed how North Korean hackers from the Lazarus Group used a fake LinkedIn job interview and deepfake technology to target their CEO.

A vulnerability, which was classified as critical, has been found in hexpm hex.pm. Affected by this issue is some unknown functionality in the library lib/hexpm/accounts/password_reset.ex of the component Reset Your Password Page. This manipulation causes session expiration. This vulnerability appears as CVE-2026-21622. The attack may be initiated remotely. There is no available exploit. It is suggested to install a patch to address this issue.

A vulnerability was found in filebrowser up to 2.60.x. It has been rated as problematic. The impacted element is an unknown function of the file http/public.go of the component withHashFile Middleware. This manipulation causes information disclosure. The identification of this vulnerability is CVE-2026-28492. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability categorized as critical has been discovered in IceWhaleTech ZimaOS 1.5.2-beta3. This affects an unknown function of the component Application Interface. Such manipulation of the argument path leads to file inclusion. This vulnerability is referenced as CVE-2026-28442. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in Frappe up to 14.99.x/15.97.x. It has been classified as critical. This affects an unknown function. This manipulation causes improper access controls. This vulnerability is handled as CVE-2026-29077. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability was found in Frappe up to 14.100.0/15.99.x. It has been declared as critical. This impacts an unknown function. Such manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2026-29081. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability categorized as critical has been discovered in graphprotocol contracts up to 2.x. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to improper access controls. The identification of this vulnerability is CVE-2026-28410. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability identified as problematic has been detected in plone Products.isurlinportal 2.0.x/3.0.x/3.x. Affected by this issue is some unknown functionality of the file /login. The manipulation of the argument came_from leads to open redirect. This vulnerability is referenced as CVE-2026-28413. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability classified as critical has been found in OpenReplay up to 1.19.x. Impacted is an unknown function of the file /{projectId}/cards/search. Performing a manipulation of the argument sort.field results in sql injection. This vulnerability is cataloged as CVE-2026-28443. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability identified as problematic has been detected in Frappe up to 15.101.x/16.10.x. The impacted element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-28436. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Attackers are mass-scanning Salesforce Experience Cloud sites using a modified AuraInspector tool to exploit misconfigurations and access sensitive data. Salesforce CSOC warns that threat actors are mass-scanning publicly accessible Experience Cloud sites using a modified version of the AuraInspector tool. AuraInspector is an open‑source command‑line tool released by Google/Mandiant to audit Salesforce Aura and Experience […]

好的，我现在需要帮用户总结一篇文章的内容，控制在100个字以内，并且不需要特定的开头。首先，我得仔细阅读文章，抓住主要信息。 文章讲的是黑客利用修改过的AuraInspector工具，大规模扫描Salesforce的Experience Cloud站点。他们利用配置错误，获取敏感数据。Salesforce的安全团队警告说，攻击者用的是修改后的工具，能提取数据。问题出在过于宽松的访客用户设置上，可能导致CRM数据泄露，用于钓鱼等攻击。Salesforce强调这不是平台漏洞，而是客户配置问题，并建议加强安全措施。 接下来，我需要把这些要点浓缩成一句话。要包含威胁行为者、 AuraInspector、 Salesforce系统、数据窃取、配置错误等因素。 可能的结构是：威胁行为者利用修改后的工具扫描Salesforce站点，窃取敏感数据，源于配置错误。 现在检查字数是否在100字以内，并确保信息准确全面。 威胁行为者利用修改后的AuraInspector工具大规模扫描Salesforce Experience Cloud站点，窃取敏感数据。攻击者通过过度宽松的访客用户设置访问CRM数据，用于社会工程或钓鱼攻击。Salesforce建议加强配置和安全措施以减少风险。

嗯，用户让我总结一下这篇文章的内容，控制在100字以内。首先，我需要理解文章的主题。看起来文章是关于网络安全的，可能是在讨论威胁检测、漏洞管理以及安全策略优化这些方面。用户还特别指出不需要以“文章内容总结”这样的开头，直接写描述即可。 那我应该怎样简洁地表达这些内容呢？可能需要提到威胁检测、漏洞管理，以及安全策略优化这三个主要点。同时，要确保语言流畅，不超过100字。比如，“探讨网络安全的重要性，包括威胁检测、漏洞管理和安全策略优化。”这样既涵盖了主要内容，又符合字数要求。 另外，用户提供的链接和一些代码块可能不是主要内容，所以可以忽略。重点放在网络安全的核心方面上。这样总结出来的内容应该能够准确传达文章的核心信息。 探讨网络安全的重要性，包括威胁检测、漏洞管理和安全策略优化。

嗯，用户让我总结一下这篇文章的内容，控制在一百个字以内，而且不需要特定的开头。首先，我需要仔细阅读文章，抓住主要信息。 文章讲的是小红书宣布打击使用AI自动发帖和运营账号的行为。他们禁止任何技术手段模拟真人创作或互动，对AI托管的账号封禁，偶尔使用AI的账号则会受到警告或限流。小红书强调真实内容的重要性，并提供了举报途径。 接下来，我需要把这些要点浓缩到100字以内。确保涵盖小红书的措施、对AI托管和普通账号的不同处理方式，以及他们呼吁的真实内容创作。 最后，检查一下语言是否简洁明了，没有多余的信息。确保总结准确传达文章的核心内容。 小红书宣布打击AI自动化发帖及运营账号，禁止技术模拟真人创作或虚假互动。AI托管账号将被封禁，普通账号若偶尔使用AI代发也将受限。平台呼吁用户合理使用AI工具，坚持真实分享。