Aggregator

看雪论坛作者ID：G0t1T

The European Commission is investigating a breach after finding evidence that its mobile device management platform was hacked. [...]

美国最新规定要求汽车厂商需要向美国政府证明，自 3 月 17 日起，其产品的核心部件不包含在中国、或由中国公司编写的代码。该规定还涵盖高级自动驾驶软件，并将从 2029 年扩大到硬件。此举旨在防止车载摄像头、麦克风和 GPS 追踪系统被外国对手利用，是美国试图与中国供应链脱钩的试金石。汽车创新联盟（Alliance for Automotive Innovation）政策主管 Hilary Cain 表示，这是数十年来最具影响力和复杂性的汽车监管政策之一，需要对供应链进行深入审查，严格遵守合规时间表。

雷神众测拥有该文章的修改和解释权。如欲转载或传播此文章，必须保证此文章的副本，包括版权声明等全部内容。声明雷神众测允许，不得任意修改或增减此文章内容，不得以任何方式将其用于商业目的。

A vulnerability was found in janet-lang janet up to 1.40.1. It has been declared as problematic. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-2242. The attack needs to be launched locally. Furthermore, an exploit is available. It is advisable to implement a patch to correct this issue.

A vulnerability was found in janet-lang janet up to 1.40.1. It has been classified as problematic. This affects the function os_strftime of the file src/core/os.c. Performing a manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-2241. The attack must be initiated from a local position. Furthermore, there is an exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in janet-lang janet up to 1.40.1 and classified as problematic. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-2240. The attack must be carried out locally. In addition, an exploit is available. A patch should be applied to remediate this issue.

Submit #754495 / VDB-344981

Submit #753156 / VDB-344980

Submit #753155 / VDB-344979

上周关注度较高的产品安全漏洞（20260202-20260208)

国家信息安全漏洞共享平台（以下简称CNVD）本周共收集、整理信息安全漏洞637个，其中高危漏洞357个、中危漏洞244个、低危漏洞36个。

В США раскрыли прокси-сеть, которую почти невозможно заблокировать.

A vulnerability has been found in pydantic pydantic-ai and classified as critical. The affected element is an unknown function of the component Localhost Interface. This manipulation causes server-side request forgery. This vulnerability is tracked as CVE-2026-25904. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, was found in mcp-run-python. Impacted is the function runPython/runPythonAsync of the component Pyodide API. The manipulation results in improper isolation or compartmentalization. This vulnerability is identified as CVE-2026-25905. The attack can be executed remotely. There is not any exploit available.

XSAST GO 发布

SecurityScorecard has identified over 40,000 OpenClaw deployments exposed to potential attack

全国商户的电子支付服务大面积中断，只能接受现金支付

Кто такие хакеры в 2026 году и почему одного слова недостаточно.