Aggregator

A vulnerability described as problematic has been identified in Oracle Advanced Benefits 12.2.15. This vulnerability affects unknown code of the component Internal Operations. Executing a manipulation can lead to improper authorization. This vulnerability appears as CVE-2026-61325. The attack may be performed from remote. There is no available exploit.

A vulnerability labeled as very critical has been found in Apple iOS, iPadOS and macOS. This affects an unknown part. Executing a manipulation can lead to buffer overflow. This vulnerability appears as CVE-2026-43776. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability was found in SepineTam stata-mcp up to 1.12.x. It has been rated as critical. This affects an unknown function of the component File Content Handler. Performing a manipulation results in code injection. This vulnerability is known as CVE-2026-31040. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability labeled as problematic has been found in OpenAirInterface oai-cn5g-amf 2.2.0. Affected by this vulnerability is an unknown functionality of the component Security Mode. The manipulation results in algorithm downgrade. This vulnerability was named CVE-2026-30080. The attack may be performed from remote. There is no available exploit.

A vulnerability categorized as problematic has been discovered in Red Hat OpenShift Mirror Registry. Affected by this issue is some unknown functionality. The manipulation results in information exposure through error message. This vulnerability is known as CVE-2025-14243. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as problematic has been detected in OpenAirInterface oai-cn5g-amf 2.2.0. This affects an unknown part of the component AUSF. This manipulation causes denial of service. This vulnerability is handled as CVE-2026-30075. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in Frappe ERPNext and Framework 16.0.1/16.1.1. This vulnerability affects unknown code of the component HTTP Request Handler. Such manipulation leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2026-31017. The attack can be launched remotely. No exploit exists.

A vulnerability classified as critical has been found in Siklu EtherHaul 8010 10_6_2-18707-ea552dc00b. The affected element is an unknown function. The manipulation leads to use of hard-coded password. This vulnerability is referenced as CVE-2025-57175. It is possible to launch the attack on the physical device. No exploit is available.

A vulnerability classified as critical was found in QD 20230821. The impacted element is an unknown function. The manipulation results in server-side request forgery. This vulnerability is identified as CVE-2023-46945. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in D-Link DI-8300 16.07.26A1. It has been classified as critical. This issue affects the function ip_position_asp. This manipulation of the argument ip causes buffer overflow. This vulnerability is registered as CVE-2025-45057. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability marked as critical has been reported in Red Hat OpenShift. This issue affects some unknown processing of the component mirror registry. Performing a manipulation results in server-side request forgery. This vulnerability was named CVE-2026-2377. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as problematic has been identified in Elastic Kibana up to 8.19.13. Impacted is an unknown function. Executing a manipulation can lead to execution with unnecessary privileges. The identification of this vulnerability is CVE-2026-4498. The attack may be launched remotely. There is no exploit available.

科学家表示，太平洋上持续增强的厄尔尼诺气候现象，有望成为 150 年来最强的一次。如果他们预测的可怕情况成真，厄尔尼诺将从海洋释放大量热量，加上人为引起的气候变化带来的升温效应，很可能使 2027 年成为有记录以来最热的一年，并在全球多地引发极端天气。非营利研究机构“伯克利地球”预测，此次厄尔尼诺事件与气候变化相结合，导致 2027 年全球平均气温较工业化前水平升高 1.7 摄氏度“并非完全没有可能”。厄尔尼诺-南方涛动（ENSO）是热带太平洋海面温度与风的自然波动。历史上该现象每 2-7 年会在高温厄尔尼诺与低温拉尼娜之间交替出现。上一轮厄尔尼诺发生在 2023-2024年。此前气象专家就警告新一轮强厄尔尼诺即将到来，而今年的厄尔尼诺已于 6 月出现。此次厄尔尼诺距离上一轮仅两年，可能意味着人为造成的气候变化正在驱动 ENSO  周期发生系统性转变。

Microsoft has launched its first cybersecurity-specific model inside MDASH, its multi-model vulnerability identification and remediation harness. The company says MDASH, using MAI-Cyber-1-Flash and GPT-5.4, scored 95.95% on CyberGym. It also claims the configuration costs 50% less than its current best MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. Access is limited to approved

Уязвимость скрывалась там, где водители привыкли видеть только источник энергии.

In this Help Net Security interview, Brandy Wityak, VP of Complex Matters at LevelBlue, explains what happens in the hours after a shadow AI incident. She describes how quickly logs roll over, why firewall records of outbound traffic to AI platforms are often gone before responders arrive, and what regulators look for when they assess whether a company did enough. Wityak also discusses the gap between an AI policy in a wiki and a control … More →

The post Shadow AI incident response begins with logs that may already be gone appeared first on Help Net Security.

A vulnerability was found in Microsoft Office 2019/LTSC 2021/365 Apps for Enterprise. It has been classified as critical. The impacted element is an unknown function of the component Word. This manipulation causes Remote Code Execution. This vulnerability is handled as CVE-2022-41031. The attack can be initiated remotely. There is not any exploit available. It is suggested to install a patch to address this issue.

A vulnerability was found in Yokogawa WTViewerE and WTViewerEfree. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Filename Handler. Such manipulation leads to stack-based buffer overflow. This vulnerability is documented as CVE-2022-40984. The attack requires being on the local network. There is not any exploit available.

A vulnerability classified as critical has been found in Buffalo WHR-HP-G300N, WHR-HP-GN, WPL-05G300, WRM-D2133HP, WRM-D2133HS, WTR-M2133HP, WTR-M2133HS, WXR-1900DHP, WXR-1900DHP2, WXR-1900DHP3, WXR-5950AX12, WXR-6000AX12B, WXR-6000AX12S, WZR-300HP, WZR-450HP, WZR-600DHP, WZR-900DHP, WZR-1750DHP2, WZR-HP-AG300H, WZR-HP-G302H, WEM-1266, WEM-1266WP, WLAE-AG300N, FS-600DHP, FS-G300N, FS-HP-G300N, FS-R600DHP, BHR-4GRV, DWR-HP-G300NH, DWR-PG, HW-450HP-ZWE, WER-A54G54, WER-AG54, WER-AM54G54, WER-AMG54, WHR-300, WHR-300HP, WHR-AM54G54, WHR-AMG54, WHR-AMPG, WHR-G, WHR-G300N, WHR-G301N, WHR-G54S, WHR-G54S-NI, WHR-HP-AMPG, WHR-HP-G, WHR-HP-G54, WLI-H4-D600, WS024BF, WS024BF-NW, WXR-1750DHP, WXR-1750DHP2, WZR-1166DHP, WZR-1166DHP2, WZR-1750DHP, WZR2-G300N, WZR-450HP-CWT, WZR-450HP-UB, WZR-600DHP2, WZR-600DHP3, WZR-900DHP2, WZR-AGL300NH, WZR-AMPG144NH, WZR-AMPG300NH, WZR-D1100H, WZR-G144N, WZR-G144NH, WZR-HP-G300NH, WZR-HP-G301NH, WZR-HP-G450H, WZR-S1750DHP, WZR-S600DHP and WZR-S900DHP. This impacts an unknown function. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2022-40966. The attack requires being on the local network. There is not any exploit available.

A vulnerability classified as problematic has been found in Mozilla Thunderbird up to 102.2. This vulnerability affects unknown code. The manipulation leads to denial of service. This vulnerability is listed as CVE-2022-40957. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.