Aggregator

X情报中心Skill广场上线，上传审核即解锁权益，优质Skill还有现金奖

OPPO 明确子品牌全球产品策略：realme 聚焦海外，一加主力中国；小米具身基座模型发布；消息称阿里千问首款 AI 智能体耳机将在 WAIC 亮相

A vulnerability labeled as problematic has been found in Wazuh up to 4.10.3/4.14.4. This vulnerability affects the function wopendir of the component authd. Executing a manipulation of the argument group can lead to path traversal. This vulnerability is registered as CVE-2026-39359. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as critical has been detected in Wazuh up to 4.14.4. This affects an unknown part of the component Cluster Protocol Parser. Performing a manipulation results in uncontrolled memory allocation. This vulnerability is cataloged as CVE-2026-33754. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability categorized as very critical has been discovered in Wazuh up to 4.14.4. Affected by this issue is the function CheckRateLimitsMiddleware.dispatch of the component CheckRateLimitsMiddleware. Such manipulation leads to injection. This vulnerability is listed as CVE-2026-33434. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in H2O. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component HPACK Decompressor. This manipulation causes state issue. This vulnerability is tracked as CVE-2026-54340. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in Wazuh up to 4.14.4. It has been declared as critical. Affected is the function W_JSON_ParseRootcheck of the component wazuh-analysisd. The manipulation of the argument Value results in heap-based buffer overflow. This vulnerability is identified as CVE-2026-34150. The attack can be executed remotely. There is not any exploit available.

让基础设施架构真正匹配业务需求。

A vulnerability was found in h2o. It has been classified as problematic. This impacts the function alloca of the component File Path. The manipulation leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2026-44453. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in h2o and classified as problematic. This affects an unknown function of the component TLS/QUIC Handshake Handler. Executing a manipulation can lead to memory corruption. The identification of this vulnerability is CVE-2026-44452. The attack may be launched remotely. There is no exploit available.

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments.

The post ACR Stealer: Two observed intrusion chains amid increased threat activity appeared first on Microsoft Security Blog.

A vulnerability has been found in h2o quicly and classified as problematic. The impacted element is an unknown function of the component CRYPTO Stream. Performing a manipulation results in reachable assertion. This vulnerability was named CVE-2026-44435. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, was found in h2o quicly. The affected element is an unknown function of the component Packet Decoder. Such manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2026-44436. The attack can be launched remotely. No exploit exists.

Pinning 状态下的 Thread.sleep、Object.wait、阻塞式 IO 走的是普通平台线程阻塞分支，载体线程在 FJP 的视角里仍然处于 RUNNING 状态，只是在执行一个很慢的任务。FJP 不会为一个看起来"还在跑"的任务开新载体

A vulnerability, which was classified as problematic, has been found in h2o quicly. Impacted is an unknown function of the component Stateless Reset Validator. This manipulation causes injection. This vulnerability is handled as CVE-2026-44434. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as problematic was found in h2o quicly. This issue affects some unknown processing of the component Flow Control. The manipulation results in uncontrolled memory allocation. This vulnerability is known as CVE-2026-44433. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as problematic has been found in wger-project wger up to 2.5. This vulnerability affects the function has_object_permission of the file wger/manager/api/views.py of the component RoutineViewSet. The manipulation leads to permission issues. This vulnerability is traded as CVE-2026-43977. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as critical has been identified in Legion of the Bouncy Castle BC-LTS up to 2.73.12.0. This affects an unknown part of the file native_c/arm/sha/shake.C of the component SHA3 SHAKE Handler. Executing a manipulation can lead to out-of-bounds write. This vulnerability appears as CVE-2026-15997. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as problematic has been reported in jupyter-server Enterprise Gateway up to 3.2.x. Affected by this issue is some unknown functionality of the component Kubernetes Manifest Renderer. Performing a manipulation results in improper neutralization of special elements used in a template engine. This vulnerability is reported as CVE-2026-44182. The attack is possible to be carried out remotely. No exploit exists.