Aggregator

A vulnerability categorized as critical has been discovered in OpenClaw up to 2026.2.13. The impacted element is an unknown function of the component Configuration Handler. Executing a manipulation can lead to path traversal. This vulnerability appears as CVE-2026-28453. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

Почему программисты назвали хайповый проект с GitHub пустышкой.

Researchers at AllSecure have revealed how North Korean hackers from the Lazarus Group used a fake LinkedIn job interview and deepfake technology to target their CEO.

A vulnerability, which was classified as critical, has been found in hexpm hex.pm. Affected by this issue is some unknown functionality in the library lib/hexpm/accounts/password_reset.ex of the component Reset Your Password Page. This manipulation causes session expiration. This vulnerability appears as CVE-2026-21622. The attack may be initiated remotely. There is no available exploit. It is suggested to install a patch to address this issue.

A vulnerability was found in filebrowser up to 2.60.x. It has been rated as problematic. The impacted element is an unknown function of the file http/public.go of the component withHashFile Middleware. This manipulation causes information disclosure. The identification of this vulnerability is CVE-2026-28492. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability categorized as critical has been discovered in IceWhaleTech ZimaOS 1.5.2-beta3. This affects an unknown function of the component Application Interface. Such manipulation of the argument path leads to file inclusion. This vulnerability is referenced as CVE-2026-28442. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in Frappe up to 14.99.x/15.97.x. It has been classified as critical. This affects an unknown function. This manipulation causes improper access controls. This vulnerability is handled as CVE-2026-29077. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability was found in Frappe up to 14.100.0/15.99.x. It has been declared as critical. This impacts an unknown function. Such manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2026-29081. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability categorized as critical has been discovered in graphprotocol contracts up to 2.x. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to improper access controls. The identification of this vulnerability is CVE-2026-28410. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability identified as problematic has been detected in plone Products.isurlinportal 2.0.x/3.0.x/3.x. Affected by this issue is some unknown functionality of the file /login. The manipulation of the argument came_from leads to open redirect. This vulnerability is referenced as CVE-2026-28413. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability classified as critical has been found in OpenReplay up to 1.19.x. Impacted is an unknown function of the file /{projectId}/cards/search. Performing a manipulation of the argument sort.field results in sql injection. This vulnerability is cataloged as CVE-2026-28443. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability identified as problematic has been detected in Frappe up to 15.101.x/16.10.x. The impacted element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-28436. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Attackers are mass-scanning Salesforce Experience Cloud sites using a modified AuraInspector tool to exploit misconfigurations and access sensitive data. Salesforce CSOC warns that threat actors are mass-scanning publicly accessible Experience Cloud sites using a modified version of the AuraInspector tool. AuraInspector is an open‑source command‑line tool released by Google/Mandiant to audit Salesforce Aura and Experience […]

好的，我现在需要帮用户总结一篇文章的内容，控制在100个字以内，并且不需要特定的开头。首先，我得仔细阅读文章，抓住主要信息。 文章讲的是黑客利用修改过的AuraInspector工具，大规模扫描Salesforce的Experience Cloud站点。他们利用配置错误，获取敏感数据。Salesforce的安全团队警告说，攻击者用的是修改后的工具，能提取数据。问题出在过于宽松的访客用户设置上，可能导致CRM数据泄露，用于钓鱼等攻击。Salesforce强调这不是平台漏洞，而是客户配置问题，并建议加强安全措施。 接下来，我需要把这些要点浓缩成一句话。要包含威胁行为者、 AuraInspector、 Salesforce系统、数据窃取、配置错误等因素。 可能的结构是：威胁行为者利用修改后的工具扫描Salesforce站点，窃取敏感数据，源于配置错误。 现在检查字数是否在100字以内，并确保信息准确全面。 威胁行为者利用修改后的AuraInspector工具大规模扫描Salesforce Experience Cloud站点，窃取敏感数据。攻击者通过过度宽松的访客用户设置访问CRM数据，用于社会工程或钓鱼攻击。Salesforce建议加强配置和安全措施以减少风险。

嗯，用户让我总结一下这篇文章的内容，控制在100字以内。首先，我需要理解文章的主题。看起来文章是关于网络安全的，可能是在讨论威胁检测、漏洞管理以及安全策略优化这些方面。用户还特别指出不需要以“文章内容总结”这样的开头，直接写描述即可。 那我应该怎样简洁地表达这些内容呢？可能需要提到威胁检测、漏洞管理，以及安全策略优化这三个主要点。同时，要确保语言流畅，不超过100字。比如，“探讨网络安全的重要性，包括威胁检测、漏洞管理和安全策略优化。”这样既涵盖了主要内容，又符合字数要求。 另外，用户提供的链接和一些代码块可能不是主要内容，所以可以忽略。重点放在网络安全的核心方面上。这样总结出来的内容应该能够准确传达文章的核心信息。 探讨网络安全的重要性，包括威胁检测、漏洞管理和安全策略优化。

嗯，用户让我总结一下这篇文章的内容，控制在一百个字以内，而且不需要特定的开头。首先，我需要仔细阅读文章，抓住主要信息。 文章讲的是小红书宣布打击使用AI自动发帖和运营账号的行为。他们禁止任何技术手段模拟真人创作或互动，对AI托管的账号封禁，偶尔使用AI的账号则会受到警告或限流。小红书强调真实内容的重要性，并提供了举报途径。 接下来，我需要把这些要点浓缩到100字以内。确保涵盖小红书的措施、对AI托管和普通账号的不同处理方式，以及他们呼吁的真实内容创作。 最后，检查一下语言是否简洁明了，没有多余的信息。确保总结准确传达文章的核心内容。 小红书宣布打击AI自动化发帖及运营账号，禁止技术模拟真人创作或虚假互动。AI托管账号将被封禁，普通账号若偶尔使用AI代发也将受限。平台呼吁用户合理使用AI工具，坚持真实分享。

好的，用户让我总结一篇文章的内容，控制在100字以内，并且不需要特定的开头。首先，我需要仔细阅读文章，了解主要内容。 文章主要讲的是如何学习道德黑客，提到了一些资源和建议。包括网络基础知识、认证如CompTIA的三重认证、Cisco的免费课程，还有实践平台如TryHackMe、Hack The Box和OverTheWire。工具方面提到了Nmap、Metasploit和Burp Suite，还有学习Linux的重要性。此外，还有YouTube频道和PortSwigger学院等资源。 接下来，我需要将这些信息浓缩到100字以内。要抓住关键点：学习网络基础、使用推荐资源（如认证、平台）、掌握工具和Linux，并参与社区。 最后，确保语言简洁明了，直接描述内容，不使用“总结”之类的开头词。 文章介绍了学习道德黑客的有效方法和资源，包括掌握网络基础知识、利用CompTIA认证和Cisco免费课程打下基础，通过TryHackMe、Hack The Box等平台实践技能，熟悉Nmap、Metasploit等工具，并建议学习Linux系统以提升能力。

偷拍、窃密... 你的龙虾(OpenClaw)是我的了！

谁在查看你的加密数据流量？

A vulnerability was found in Zoom Workplace, Workplace VDI Client and Meeting SDK 6.6.x on Windows. It has been rated as problematic. This affects an unknown function. This manipulation causes Local Privilege Escalation. This vulnerability is handled as CVE-2026-30900. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.