Aggregator

CVE-2026-7023 | ByteDance coze-studio up to 0.5.1 databaseTool database_impl.go ExecuteSQL sql injection (EUVD-2026-25698)

VulDB Recent Entries
3 weeks 1 day ago
A vulnerability marked as critical has been reported in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2026-7023. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-7022 | SmythOS sre up to 0.0.15 HTTP Header AgentRuntime.class.ts AgentRuntime X-DEBUG-RUN/X-DEBUG-INJ improper authentication (EUVD-2026-25697)

VulDB Recent Entries
3 weeks 1 day ago
A vulnerability labeled as critical has been found in SmythOS sre up to 0.0.15. Affected is the function AgentRuntime of the file packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts of the component HTTP Header Handler. Such manipulation of the argument X-DEBUG-RUN/X-DEBUG-INJ leads to improper authentication. This vulnerability is referenced as CVE-2026-7022. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-7021 | SmythOS sre up to 0.0.15 Connector Service utils.ts baseURL information disclosure (EUVD-2026-25696)

VulDB Recent Entries
3 weeks 1 day ago
A vulnerability identified as problematic has been detected in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connector Service. This manipulation of the argument baseURL causes information disclosure. The identification of this vulnerability is CVE-2026-7021. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

Supplier assurance for UK SMEs: a practical guide to checking third parties without overcomplicating it

Security Boulevard
3 weeks 1 day ago

Supplier assurance for UK SMEs: a practical guide to checking third parties without overcomplicating it Most UK SMEs rely on suppliers in some way. That might be payroll software, a managed IT provider, a marketing agency, a logistics partner, or a cloud service that holds customer data. The more your business depends on third parties, […]

The post Supplier assurance for UK SMEs: a practical guide to checking third parties without overcomplicating it appeared first on Clear Path Security Ltd.

The post Supplier assurance for UK SMEs: a practical guide to checking third parties without overcomplicating it appeared first on Security Boulevard.

Clear Path Security Ltd

座头鲸数量恢复，形成大规模超群

Solidot
3 weeks 1 day ago
20 世纪的大规模工业捕鲸几乎导致座头鲸灭绝，海洋中剩下的鲸鱼不足工业捕鲸前数量的 5%。40 年前一项全球捕鲸禁令生效，座头鲸种群开始恢复。尽管部分座头鲸种群仍然濒临灭绝，但总体数量正在上升。越来越多地方报告目击到座头鲸的“超群（super-groups）”——指的是 20 头或以上的鲸鱼紧密聚集在一起。座头鲸生活在世界各大洋中，每年都会进行地球哺乳动物中最壮观的迁徙，行程可达 8000 公里，从温暖的繁殖地迁徙到寒冷的觅食地。在此过程中它们将大量的营养物质输送到世界各地，对海洋生态系统的健康至关重要。从2015 年到 2020 年，南非西海岸座头鲸超群目击次数从每年 10 次飙升至 65 次。2025 年 12 月 29 日，两位摄影师在南非西海岸一天内拍摄到了 208 头座头鲸，第二天更是达到了 304 头，这是历史上单日观测到的大型鲸鱼数量最多的一次。

CVE-2024-32114

CVE Trends
3 weeks 1 day ago
Currently trending CVE - Hype Score: 1 - In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the ...

CVE-2026-34197

CVE Trends
3 weeks 1 day ago
Currently trending CVE - Hype Score: 10 - Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy ...

三星移动业务可能首次出现亏损

Solidot
3 weeks 1 day ago
由于内存成本上涨、竞争加剧以及折叠屏手机和智能手表等产品面临的压力，三星移动部门可能在 2026 年出现首次年度亏损。移动业务一直是三星的重要支柱，该业务可能亏损对公司的整体业绩构成了严重威胁。如果预测成真，这将是三星移动业务成立至今首次出现年度亏损。

Managed ad