Aggregator

SHIRASAGI Projectが提供するSHIRASAGIには、複数の脆弱性が存在します。

Советы директоров обнаружили зависимости, о которых раньше почти не думали.

整理 Fastjson1 全版本利用要点——反序列化流程、版本/依赖/期望类探测、WAF 绕过，以及 1.2.47 / 68 / 80 / 83 关键绕过与各利用链；并附配套工具，方便复习与落地。

CISOs are taking on AI governance without a matching increase in resources or expertise, adding to an already broad remit spanning data protection, identity, resilience and compliance, according to Proofpoint’s 2026 Voice of the CISO report. The Al mandate expands faster than resources (Source: Proofpoint) AI adds to security responsibilities GenAI is creating new concerns around sensitive data, access and employee activity. Seventy-eight percent of CISOs consider it a security risk, with the potential loss … More →

The post AI adoption brings new security headaches for already stretched CISOs appeared first on Help Net Security.

CVE-2026-64563 是 Linux 内核新近披露的本地权限提升漏洞，因哈希表重置未清空指针导致的释放后使用（UAF）漏洞，本文主要针对该漏洞进行分析以及利用

本文复盘某APP昵称存储型XSS挖掘全过程，通过抓包突破前端限制，FUZZ冷门事件、利用逗号表达式绕过WAF，绕过字符截断限制成功拿下漏洞赏金。

想让 AI Agent 直接操作 Burp Suite？网上那篇 OpenClaw 接 MCP 的教程，我照着配了一下午没跑通——WSL 和 Windows 之间隔着看不见的墙：Burp 默认只听 127.0.0.1、portproxy 端口冲突、JDK 17 跑不动 2026 版、Defender 静默拦截、Origin 过不了 CORS、tools/call 还得异步等 SSE。本文把 5 个

Currently trending CVE - Hype Score: 8 - RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling ...

Currently trending CVE - Hype Score: 8 - Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Currently trending CVE - Hype Score: 2 - Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated ...

Currently trending CVE - Hype Score: 2 - A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and ...

Фотон на 300 ТэВ не должен был долететь до Земли. Возможно, виновата квантовая гравитация.

OPAQUE, a confidential computing company that runs AI workloads inside hardware-isolated environments so operators cannot inspect them, released an open standard that lets AI model builders decide when and where their weights can be decrypted once those weights leave the builder’s own servers. The standard, called Weight Custody Manifest, ships as a developer-preview specification, a Python SDK, and a public test suite covering 91 cases. The release targets a specific squeeze. Enterprises are fine-tuning open … More →

The post A new open standard locks AI weights to approved hardware appeared first on Help Net Security.

A vulnerability was found in otwthemes Sidebar Manager Light Plugin up to 1.18 on WordPress. It has been classified as problematic. Impacted is an unknown function. The manipulation of the argument sbm_description leads to cross site scripting. This vulnerability is referenced as CVE-2026-76562. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in Builderall Plugin up to 3.0.2 on WordPress and classified as problematic. This issue affects some unknown processing of the component Photo Module. Executing a manipulation of the argument attributes can lead to cross site scripting. The identification of this vulnerability is CVE-2026-15820. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Builderall Plugin up to 3.0.2 on WordPress and classified as problematic. This vulnerability affects unknown code of the component Setting Handler. Performing a manipulation of the argument bg_video_service_url results in cross site scripting. This vulnerability was named CVE-2026-15796. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, was found in Easy Google Fonts Plugin up to 2.0.4 on WordPress. This affects an unknown part. Such manipulation of the argument control_selectors leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-4657. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as problematic, has been found in vsourz1td Advanced Contact Form 7 Plugin up to 2.1.3 on WordPress. Affected by this issue is some unknown functionality. This manipulation causes improper authorization. This vulnerability is handled as CVE-2026-18594. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as problematic was found in cssimmon WP BackItUp Community Edition Plugin up to 2.1.0 on WordPress. Affected by this vulnerability is the function basename. The manipulation of the argument backup_file results in path traversal. This vulnerability is known as CVE-2026-18386. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as critical has been found in rubenw Bulk Password Reset Plugin up to 1.3.3 on WordPress. Affected is an unknown function. The manipulation leads to weak password recovery. This vulnerability is traded as CVE-2026-14873. It is possible to initiate the attack remotely. There is no exploit available.