Posts of last few hours
CVE-2026-73488 | FlowiseAI Flowise up to 3.1.2 customer-default-source customerId resource injection
A vulnerability labeled as problematic has been found in FlowiseAI Flowise up to 3.1.2. Affected by this vulnerability is an unknown functionality of the file /api/v1/organization/customer-default-source. Such manipulation of the argument customerId leads to improper control of resource identifiers.
This vulnerability is listed as CVE-2026-73488. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
https://vuldb.com/vuln/389379
A vulnerability marked as critical has been reported in FlowiseAI Flowise up to 3.1.3. Affected by this issue is some unknown functionality of the component Text-To-Speech. Performing a manipulation results in improper access controls.
This vulnerability is cataloged as CVE-2026-73603. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to upgrade the affected component.
https://vuldb.com/vuln/389380
A vulnerability was found in FlowiseAI Flowise up to 3.1.2 and classified as problematic. This affects an unknown function of the file /api/v1/credentials of the component Credential Redaction. Executing a manipulation of the argument ID can lead to missing encryption of sensitive data.
This vulnerability is handled as CVE-2026-73604. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
https://vuldb.com/vuln/389387
A vulnerability identified as critical has been detected in FlowiseAI Flowise up to 3.1.2. This affects an unknown part of the component vm2 JavaScript sandbox. Performing a manipulation results in sandbox issue.
This vulnerability is identified as CVE-2026-73602. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
https://vuldb.com/vuln/389392
A vulnerability classified as problematic has been found in gitpython-developers GitPython up to 3.1.56. The affected element is the function Repo.archive of the component unsafe_git_archive_options guard. This manipulation causes information disclosure.
This vulnerability is registered as CVE-2026-73619. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
https://vuldb.com/vuln/389396
A vulnerability marked as critical has been reported in FlowiseAI Flowise up to 3.1.2. The impacted element is the function pd.read_json of the component Agent Node. This manipulation causes code injection.
This vulnerability is tracked as CVE-2026-73487. The attack is possible to be carried out remotely. No exploit exists.
It is suggested to upgrade the affected component.
https://vuldb.com/vuln/389408
Currently trending CVE - Hype Score: 8 - Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.
These vulnerabilities are due to ...
https://cvemon.intruder.io/cves/CVE-2026-20355
Currently trending CVE - Hype Score: 35 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered ...
https://cvemon.intruder.io/cves/CVE-2026-20279
Currently trending CVE - Hype Score: 35 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered ...
https://cvemon.intruder.io/cves/CVE-2026-20274
Currently trending CVE - Hype Score: 9 - Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
https://cvemon.intruder.io/cves/CVE-2026-12555
Currently trending CVE - Hype Score: 9 - Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
https://cvemon.intruder.io/cves/CVE-2026-12556
Currently trending CVE - Hype Score: 9 - Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.
https://cvemon.intruder.io/cves/CVE-2026-12554
Currently trending CVE - Hype Score: 5 - Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated ...
https://cvemon.intruder.io/cves/CVE-2026-83549
Currently trending CVE - Hype Score: 5 - A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and ...
https://cvemon.intruder.io/cves/CVE-2026-83548
Currently trending CVE - Hype Score: 19 - This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of ...
https://cvemon.intruder.io/cves/CVE-2025-31201
Currently trending CVE - Hype Score: 19 - A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code ...
https://cvemon.intruder.io/cves/CVE-2025-31200
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Google Chromium V8 flaw, tracked as CVE-2026-85046 (CVSS score of 8,8), to its Known Exploited Vulnerabilities (KEV) catalog. This week, Google released a Chrome security update fixing 12 […]
https://securityaffairs.com/198455/security/u-s-cisa-adds-google-chromium-v8-flaw-to-its-known-exploited-vulnerabilities-catalog-2.html
本文是对 XSS（Cross-Site Scripting，跨站脚本攻击）的二次回顾与学习总结，主要围绕 XSS 的基本原理、反射型/存储型/DOM 型分类、常见危害以及漏洞探测展开。在此基础上，重点整理了 XSS 中常见的过滤绕过思路，包括双写、大小写、空格、闭合、注释、HTML 实体、事件处理器、伪协议、SVG 等技巧，并结合具体代码分析其产生原因与适用场景。文章最后以 XSS-labs 为主
https://xz.aliyun.com/news/92742
通过 Git 源码泄露获取 Gitea 管理员凭证，利用 CVE-2026-60004 漏洞获得初始 Shell。随后通过劫持全局可写的 PHP-FPM Socket 向 Root 定时脚本注入命令，最终成功提权至 Root。
https://xz.aliyun.com/news/92744
Zygote 是 Android 系统中所有应用进程的"祖先"，通过 fork() 机制派生新进程。向 Zygote 注入模块
后，后续所有由 Zygote 生成（fork）出的应用进程都会继承该模块，实现向派生模块注入的效果。
https://xz.aliyun.com/news/92747
Latest Blog Posts
- 1 week 6 days ago
- 2 months 2 weeks ago
- 2 months 2 weeks ago
- 2 months 2 weeks ago
- 2 months 2 weeks ago
- 7 months 1 week ago
- 1 year ago
- 1 year ago
- 1 year 1 month ago
- 1 year 5 months ago