Aggregator

A vulnerability was found in OrangeHRM up to 5.8.0. It has been rated as critical. Affected by this issue is some unknown functionality of the component Request Path Handler. This manipulation causes improper access controls. This vulnerability appears as CVE-2026-39346. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-27966是Langflow平台中一个严重程度为高危的远程代码执行（RCE）漏洞。Langflow作为一个开源的AI工作流构建平台,允许用户通过可视化界面创建和管理AI驱动的自动化流程。该漏洞存在于CSV Agent组件的代码执行配置中，Langflow在其CSV Agent组件中显式把LangChain Experimental CSV Agent的危险代码执行能力打开了。攻击

A vulnerability was found in ChurchCRM up to 6.5.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component URL Handler. The manipulation results in server-side request forgery. This vulnerability is reported as CVE-2026-35572. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability was found in ChurchCRM up to 7.0.x. It has been classified as problematic. Affected is an unknown function of the file /family/ of the component Role-Based Access Control. The manipulation leads to authorization bypass. This vulnerability is documented as CVE-2026-39331. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability was found in NVIDIA Triton Inference Server and classified as critical. This impacts an unknown function. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-24147. It is possible to launch the attack remotely. No exploit is available.

A vulnerability has been found in NVIDIA DALI and classified as critical. This affects an unknown function. Performing a manipulation results in deserialization. This vulnerability is cataloged as CVE-2026-24156. The attack must be initiated from a local position. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Volcengine OpenViking up to 0.3.2. The impacted element is an unknown function of the file /api/v1/tasks of the component Task Polling Endpoint. Such manipulation of the argument task_id leads to missing authorization. This vulnerability is listed as CVE-2026-22680. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in moritzmyrz coursevault-preview up to 0.1.0. The affected element is an unknown function. This manipulation of the argument relativePath causes path traversal. This vulnerability is tracked as CVE-2026-35613. The attack is restricted to local execution. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in polarnl PolarLearn up to 0-PRERELEASE-14. Impacted is an unknown function. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-35610. The attack can be executed remotely. There is not any exploit available.

A vulnerability classified as critical has been found in OpenPrinting cups up to 2.4.16 on Linux. This issue affects the function _ppdCreateFromIPP of the file cups/ppd-cache.c of the component IPP Attribute Handler. The manipulation of the argument length leads to integer underflow. This vulnerability is referenced as CVE-2026-39314. The attack can only be performed from a local environment. No exploit is available.

A vulnerability described as problematic has been identified in OrangeHRM up to 5.8.0. This vulnerability affects unknown code of the component Attachment Handler. Executing a manipulation can lead to missing authorization. The identification of this vulnerability is CVE-2026-39348. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Online crime continues to generate rising financial losses, with totals reaching $20.877 billion in 2025. The FBI’s Internet Crime Complaint Center (IC3) report shows a 26% increase in total reported losses from the previous year. (Source: FBI) More than one million complaints were submitted during the year, with fraud accounting for the majority of losses. Cyber-enabled fraud totaled $17.7 billion, representing 85% of all reported financial damage. Complaint counts show a different pattern. Phishing or … More →

The post Cybercrime losses break the $20 billion mark appeared first on Help Net Security.

车联网安全基础：NFC中继攻击

A vulnerability labeled as critical has been found in Linux Kernel up to 6.6.129/6.12.77/6.18.19/6.19.9/7.0-rc4. This issue affects the function parse_durable_handle_context of the component ksmbd. Such manipulation leads to use after free. This vulnerability is documented as CVE-2026-23427. The attack requires being on the local network. There is not any exploit available. The affected component should be upgraded.

A vulnerability described as critical has been identified in Linux Kernel up to 7.0-rc2. This vulnerability affects unknown code of the component wifi. Such manipulation leads to denial of service. This vulnerability is traded as CVE-2026-23420. Access to the local network is required for this attack to succeed. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability categorized as critical has been discovered in Linux Kernel up to 7.0-rc4. Impacted is the function rose_connect. Such manipulation of the argument sk_state leads to null pointer dereference. This vulnerability is listed as CVE-2026-23460. The attack must be carried out from within the local network. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability identified as critical has been detected in Linux Kernel up to 7.0-rc4. This impacts the function DecodeQ931 of the component netfilter. The manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-23455. The attack must be carried out from within the local network. There is no available exploit. You should upgrade the affected component.

A vulnerability was found in Linux Kernel up to 7.0-rc4. It has been rated as critical. This issue affects the function mvpp2_bm_switch_buffers of the component mvpp2. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-23438. The attack is only possible within the local network. No exploit exists. Upgrading the affected component is advised.

A dangerous cyberattack campaign is actively hitting web applications across the internet at a frightening speed. Hackers are exploiting a critical security flaw called React2Shell, targeting websites built on the widely used Next.js framework. In just 24 hours, attackers broke into 766 servers and walked away with massive amounts of sensitive data, including passwords, cloud […]

The post Hackers Exploit Next.js React2Shell Flaw to Steal Credentials From 766 Hosts in 24 Hours appeared first on Cyber Security News.