Aggregator

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.18.38/7.1.3. The affected element is the function fuse_uring_commit_fetch/fuse_uring_send_in_task of the component fuse-uring. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-64259. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in RRWO Catalyst View Wkhtmltopdf up to 0.6.0. Impacted is an unknown function. Such manipulation of the argument page_size/orientation/margins leads to os command injection. This vulnerability is documented as CVE-2026-16766. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Vulnerability / Application SecuritySecurity researchers depthfirst published working exploit code

Security researcher Yuhang Wu at depthfirst has published a working proof-of-concept (PoC) exploit that executes commands as git on an unpatched self-managed GitLab 18.11.3 server. An ordinary authenticated user triggers it by committing two crafted Jupyter notebooks and requesting their diff. The chain needs no administrator rights, continuous integration (CI) runner access, victim interaction

A vulnerability identified as problematic has been detected in Yoast SEO Plugin up to 28.0 on WordPress. This issue affects the function get_permalink. This manipulation of the argument post_name causes cross site scripting. This vulnerability is registered as CVE-2026-15425. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability categorized as critical has been discovered in WPForms Pro Plugin up to 1.10.1.1 on WordPress. This vulnerability affects the function ajax_chunk_upload_finalize. The manipulation results in unrestricted upload. This vulnerability is cataloged as CVE-2026-10818. The attack may be launched remotely. There is no exploit available.

印度政府显然试图移除杰克·多西旗下离线蓝牙通讯应用 Bitchat 的 GitHub 存储库，引发了关于因开源软件的工作方式而针对其的法律依据的质疑。杰克·多尔西周五在X上发布了来自印度内政部的通知，

Кто такие TAG-195 и почему их инструменты так сложно поймать.

美国总统特朗普威胁对欧盟产品征收新的关税，以报复欧盟对谷歌公司处以10亿美元的罚款。据欧盟委员会周三表示，对谷歌的罚款是由于其涉嫌违反欧盟数字市场法。特朗普在社交媒体上发帖表示，美国将对掠夺美国公司并

Новые протоколы скрывают всё больше деталей соединения, заставляя системы контроля судить о трафике по косвенным признакам и чаще ошибаться.

微软正在用自研图像生成模型替代OpenAI的图像模型，应用于PowerPoint和Bing等热门产品。微软的模型主管穆斯塔法·苏莱曼在接受采访时表示：“自研模型更快、更便宜、质量更高，还能带来更好的用

A vulnerability was found in mehigh Checkout Field Editor Plugin up to 3.7.7 on WordPress. It has been rated as problematic. This affects an unknown part. The manipulation of the argument thwcfe_legacy_file leads to path traversal. This vulnerability is listed as CVE-2026-14955. The attack may be initiated remotely. There is no available exploit.

Генетики нашли в биобанке следы естественного отбора, который постепенно удаляет опасные мутации из популяции.

Fastjson 1.2.83最新RCE

任务失效化蜜罐的价值不是追求一次性欺骗，而是让 Agent 的任务闭环在受控环境中持续偏航、消耗并最终失去有效方向。

SSRF 这个"老漏洞"非但没有消失，反而在大模型时代迎来了它的"第二春"。区别在于：过去是攻击者直接构造请求参数，现在是攻击者用自然语言"PUA"AI 替自己发请求。攻击的发起者，从一行 HTTP 参数，变成了一段藏在网页里的提示词。 文章主要描述：传统 SSRF 的底层机理、为什么大模型把它的攻击面放大了一个数量级、真实的利用链长什么样、如何亲手搭一套可复现的漏洞环境、如何防御等进行阐述