Aggregator

A vulnerability was found in Mozilla Firefox up to 115.37/140.12/152. It has been classified as critical. Impacted is an unknown function of the component JIT. Performing a manipulation results in Remote Code Execution. This vulnerability is reported as CVE-2026-16355. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 115.37/140.12. This issue affects some unknown processing. This manipulation causes memory corruption. This vulnerability is tracked as CVE-2026-16361. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Mozilla Firefox up to 140.12/152. Impacted is an unknown function of the component JIT. Such manipulation leads to Remote Code Execution. This vulnerability is listed as CVE-2026-16363. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability marked as critical has been reported in Mozilla Firefox up to 115.37/140.12/152. Affected by this vulnerability is an unknown functionality of the component Disability Access APIs. Performing a manipulation results in use after free. This vulnerability was named CVE-2026-16356. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in lostisland faraday up to 1.10.5/2.14.2. The impacted element is the function Faraday::NestedParamsEncoder of the component Common Interface. Such manipulation leads to uncontrolled recursion. This vulnerability is uniquely identified as CVE-2026-54297. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Red Hat Hardened Images and Satellite 6. The affected element is an unknown function. The manipulation leads to missing authorization. This vulnerability is traded as CVE-2026-12515. It is possible to initiate the attack remotely. There is no exploit available.

Organizations are building AI systems that combine models, agents and external tools instead of relying on standalone AI, according to Snyk’s latest State of Agentic AI Adoption report. The study analyzed 3,044 enterprise environments and 1.39 million code repositories to examine how enterprises are deploying AI. Adopting agentic architectures Of organizations using AI, 46.9% have adopted agentic architectures built on AI agents, model context protocol (MCP) servers, or both. More than half have deployed the … More →

The post Your enterprise AI footprint is about three times bigger than your model list appeared first on Help Net Security.

A vulnerability classified as critical was found in Python CPython up to 3.14.x on Windows. This affects the function sock_recvfrom_into. Executing a manipulation of the argument nbytes can lead to out-of-bounds write. This vulnerability appears as CVE-2026-3298. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

A vulnerability described as problematic has been identified in Python CPython. Impacted is the function unicodedata.normalize of the component Unicode Handler. The manipulation results in inefficient algorithmic complexity. This vulnerability is reported as CVE-2026-3276. The attack can be launched remotely. No exploit exists.

A vulnerability labeled as critical has been found in TECNO Mobile Hi Browser 2.23.1.1. This vulnerability affects unknown code of the component com.talpa.hibrowser. The manipulation results in path traversal. This vulnerability is cataloged as CVE-2026-18907. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in UTT HiPER 1250GW up to v3.2.7-210907-180535. It has been rated as critical. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The manipulation of the argument tempName leads to stack-based buffer overflow. This vulnerability is documented as CVE-2026-18897. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

The Trump administration executive order on artificial intelligence tried to strike the balance between responsible use, security and mutual benefit, all with an eye toward not making it regulatory in nature, National Cyber Director Sean Cairncross said Tuesday. “Everyone is working towards the same goal in terms of protecting the country and securing our systems, […]

The post National cyber director lays out White House plans to secure AI without writing new rules appeared first on CyberScoop.

欢迎订阅《中国信息安全》杂志！

当前，传统密码体系是维护网络空间主权、保障数据安全的核心基石。但随着量子计算技术的加速演进和产业化落地进程的持续提速，经典加密算法面临被快速破解的现实威胁，现有网络安全防护体系正遭遇前所未有的颠覆式挑战。

株式会社アイ・エス・ティが提供するNetKids iMarkには、複数の脆弱性が存在します。

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.1.78/6.6.17/6.7.5. Affected by this issue is the function tasklet_action_common of the component dm-crypt/dm-verity. This manipulation causes memory corruption. This vulnerability appears as CVE-2024-26718. The attacker needs to be present on the local network. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 5.10.209/5.15.148/6.1.78/6.6.17/6.7.5. It has been classified as critical. Impacted is the function memblock_alloc of the component powerpc. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2024-26712. The attack can only be initiated within the local network. No exploit exists. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.7.6. Affected is the function aux_mode of the component display. This manipulation causes null pointer dereference. This vulnerability is registered as CVE-2024-26728. The attack requires access to the local network. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.6.18/6.7.6 and classified as problematic. Affected by this issue is the function devlink_init. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2024-26734. The attacker must have access to the local network to execute the attack. No exploit exists. The affected component should be upgraded.