Aggregator

A vulnerability described as critical has been identified in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. This vulnerability is referenced as CVE-2026-16076. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability marked as problematic has been reported in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/open_api.py of the component session-listing Endpoint. This manipulation of the argument Username causes authorization bypass. The identification of this vulnerability is CVE-2026-16075. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability labeled as critical has been found in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument download_url/download_urls/proxy results in server-side request forgery. This vulnerability was named CVE-2026-16074. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as problematic has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.text_to_image/NetworkRenderStrategy.render of the file astrbot/core/star/base.py of the component T2I Feature. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-16073. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A financially motivated, Russian-speaking threat actor tracked as UAT-11795, orchestrating a large-scale campaign since at least June 2025. A sophisticated Python-based remote access trojan dubbed “Starland RAT,” alongside a stealthy in-memory PowerShell implant known as the “WLDR agent.” The operation targets users across the United States and parts of Europe, with a primary focus on […]

The post New Starland RAT Steals Browser Credentials and Scans for Over 40 Crypto Wallets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability categorized as problematic has been discovered in HCL Aftermarket EPC 1.0.0. Affected by this vulnerability is an unknown functionality of the component URL Parameter. Executing a manipulation of the argument URL can lead to information disclosure. This vulnerability is handled as CVE-2024-23567. The attack can be executed remotely. There is not any exploit available.

Fairlife’s U.S. operation includes plants in Michigan, New York and Arizona, and the company's retail sales passed $1 billion in 2022.

Submit #852865 / VDB-379792

Submit #852864 / VDB-379791

Submit #852863 / VDB-379790

A vulnerability was found in HCL Aftermarket EPC. It has been rated as problematic. Affected is an unknown function of the component Password Recovery. Performing a manipulation results in open redirect. This vulnerability is known as CVE-2024-23564. Remote exploitation of the attack is possible. No exploit is available.

Submit #852842 / VDB-379789

Submit #852825 / VDB-379788

A vulnerability was found in IKAS E-Commerce 03062026. It has been declared as problematic. This impacts an unknown function. Such manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-7488. The attack may be launched remotely. There is no exploit available.

企业拥有模型权重，只得到一个会迅速过时的快照。更有价值的是掌握数据、强化学习和评测闭环，并判断哪些工作负载值得承担相应的复杂度成本。

blackeye也是一个频道列表实际上，真正除了15400+那个和蓝色底的有东西，其它都是乱七八糟的没用的玩意

Прежде чем позвать вас на собеседование, они уже могут знать о вас больше, чем друзья.

WAIC 2026 首日观察：20 个创新产品里的 AI

A Windows zero-day vulnerability, dubbed LegacyHive (MSNightmare), abuses the User Profile Service to enable local privilege escalation, tampering with administrator accounts, and admin-level code execution. LegacyHive targets the Windows User Profile Service (ProfSvc), which is responsible for loading and unloading user profiles and their registry hives during logon and logoff. The public proof‑of‑concept (PoC) from the […]

The post New Windows LegacyHive 0-Day Vulnerability Allows Hackers to Gain Admin Access appeared first on Cyber Security News.

A vulnerability was found in Proliz Software Ltd. OBS up to 3.5.x. It has been classified as problematic. This affects an unknown function of the component ACLs. This manipulation causes information disclosure. This vulnerability appears as CVE-2026-7189. The attack may be initiated remotely. There is no available exploit.