Aggregator

Submit #783324 / VDB-355341

Submit #783323 / VDB-355340

Submit #783322 / VDB-355339

axios 维护者 Jason 被攻击者伪装成公司创始人，通过假 Slack 工作区和 Teams 会议实施社工，以"系统更新"为由诱导安装 RAT，随后用盗取的凭证向 npm 推送恶意版本，注入远控木马。毒版本存活约三小时。幕后疑为朝鲜黑客组织 BlueNoroff。

A vulnerability has been found in Akaunting up to 3.1.21 and classified as problematic. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the argument notes leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-5568. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in Tenda M3 1.0.0.10. This vulnerability affects the function setAdvPolicyData of the file /goform/setAdvPolicyData of the component Destination Handler. Executing a manipulation of the argument policyType can lead to buffer overflow. This vulnerability is handled as CVE-2026-5567. The attack can be executed remotely. Additionally, an exploit exists.

Submit #783139 / VDB-355338

Submit #782999 / VDB-355337

由于重要电力设施零部件如变压器、开关和电池短缺，美国近半数计划中的数据中心项目推迟或取消。美国计划在 2026 年新增 12 GW 的数据中心容量，但由于各种问题，只有三分之一的数据中心容量在积极建造中。电力基础设施占数据中心总成本的不到 10%，但它与计算硬件同样重要。由于需求旺盛，美国大功率变压器的交货周期从 2020 年前的 24-30 个月大幅延长到五年甚至更长。对 AI 数据中心而言，这无疑是灾难，因为它们的部署周期通常不到 18 个月。为解决短缺美国公司转向了全球市场，加拿大、墨西哥和韩国成为美国 AI 数据中心大功率变压器的主要供应国。数据显示，截至 2025 年 10 月，美国从中国进口的大功率变压器数量从 2022 年的不到 1500 台增至逾 8000 台。除此之外，中国占美国电池进口的 40% 以上，部分变压器和开关设备的份额接近 30%。

A vulnerability, which was classified as critical, has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBind results in buffer overflow. This vulnerability is known as CVE-2026-5566. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

What happened A new federal budget proposal would cut hundreds of millions of dollars more from CISA, sharply reducing funding for the agency’s cybersecurity and critical infrastructure work. The fiscal 2027 proposal would reduce CISA’s total by $707 million, according to the budget summary, though another budget document points to a smaller but still significant […]

The post Trump Budget Proposal Would Cut Hundreds of Millions More From CISA appeared first on CISO Whisperer.

The post Trump Budget Proposal Would Cut Hundreds of Millions More From CISA appeared first on Security Boulevard.

A vulnerability classified as critical was found in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmemberinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. This vulnerability is traded as CVE-2026-5565. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical has been found in code-projects Simple Laundry System 1.0. Affected by this vulnerability is an unknown functionality of the file /searchguest.php of the component Parameter Handler. This manipulation of the argument searchServiceId causes sql injection. This vulnerability appears as CVE-2026-5564. The attack may be initiated remotely. In addition, an exploit is available.

Submit #782993 / VDB-355336

Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year. [...]

Bing 搜索触发 Bumblebee 木马，44 小时完成 Akira 勒索部署，完整攻击链+IoC+检测规则

Lunar Spider 通过恶意 JS 文件部署 Brute Ratel + Latrodectus + Cobalt Strike，驻留近两个月外泄数据

A vulnerability described as critical has been identified in AutohomeCorp frostmourne up to 1.0. Affected is the function httpTest of the file /api/monitor-api/alarm/previewData of the component Alarm Preview. The manipulation results in sql injection. This vulnerability is reported as CVE-2026-5563. The attack can be launched remotely. Moreover, an exploit is present.

Submit #782977 / VDB-355335

Submit #782976 / VDB-355334