Aggregator

Currently trending CVE - Hype Score: 14 - GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, ...

Currently trending CVE - Hype Score: 14 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path ...

Currently trending CVE - Hype Score: 1 - JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

Currently trending CVE - Hype Score: 14 - Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

За цифровой сбой теперь может расплачиваться тот, кто вообще не участвовал в инциденте.

NTTドコモビジネス株式会社が提供するAndroidアプリ「【保護者専用】まなびポケット」には、アクセス制限不備の脆弱性が存在します。

Триллионная инфраструктурная гонка всё сильнее зависит от денег, которых пока нет.

Спутники научились замечать то, что постоянно ускользает из сводок.

Электроника сделала ещё один шаг в сторону биологических систем.

九月初 GitLab 放了个 CVSS 10.0 的紧急补丁，仓库 commits API 既漏了鉴权、又直接信了客户端可控的文件路径，未登录就能读服务器上的任意文件。补丁发布第二天就有在野探测，随后进了 CISA KEV 目录。这篇博客就从 patch diff 入手，扒一扒这个洞的两个根因和官方的修复思路。

Будущее добралось до гостиной, но пока не знает, чем там заняться.

LITE-ON Technology Corporationが提供するO-RU「FF-RFI079I4」および「FF-RFI078I4」には、複数の脆弱性が存在します。

One justice said the attempt to change the rules ahead of the 2026 elections would be "arbitrary and capricious” and violated the Administrative Procedures Act.

The post Supreme Court denies Trump request to allow USPS mail ballot changes appeared first on CyberScoop.

近日，微步已正式完成对开源AI渗透测试工具CyberStrikeAI（https://github.com/AIPentest/CyberStrikeAI）的收购。CyberStrikeAI将纳入微步的AI渗透和红队能力体系中，成为微步面向企业防御场景的AI自主渗透测试工具。 CyberStrikeAI是一款开源AI原生自主渗透测试工具，上线几个月以来已经在GitHub上获得了6600+星标，测绘公网部署量2300+，是全球应用最广的AI渗透工具之一。 收购后，微步将保留CyberStrikeAI的开源版本，并在开源版基础上推出CyberStrikeAI企业版，作为面向企业防御场景的受控平台。在开源版本上，微步会加入更多管控机制，避免CyberStrikeAI的技术被滥用。 微步创始人、CEO薛锋表示：“AI攻击的演进速度远超预期，旧防御体系里‘攻击者也需要时间’的假设已经作废。过去防守方赖以响应的时间窗口，正在被自动化的侦察、挖掘与利用抹平。这样一种力量，不应该只掌握在黑产、APT和破坏者的手中。我们希望把它交到认真建设这个世界的防御者手里，让能力平权，让防御者也能像攻击者一样思考和行动，把攻防之间的信息差抹平。” 微步技术合伙人赵林林表示：“我们始终认为，对一位CISO来说，最理想的状态是能看见企业里全部的威胁和风险，并按优先级逐步清理。过去这件事受限于渗透和红队人力的稀缺与昂贵，往往一年只能做几次、覆盖有限；有了昼夜不眠的AI黑客之后，每家企业都可以拥有持续运转的优秀渗透和红队能力，让安全决策建立在更清晰、更完整的风险视图之上。” 未来，微步将持续投入CyberStrikeAI的开源版本与企业版建设，让AI自主渗透测试的能力更可靠、更可控、更可用。

A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform. It has been classified as critical. The impacted element is an unknown function of the component PAM Responder. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-90995. The attack is restricted to local execution. No exploit exists.

A vulnerability was found in Red Hat Enterprise Linux and OpenShift Container Platform. It has been rated as critical. This impacts the function pam_parse_in_data of the component PAM responder. Performing a manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-90994. The attack must be initiated from a local position. There is no exploit available.

A vulnerability described as problematic has been identified in libgit2 up to 1.8.5/1.9.4. This affects the function set_data of the file src/libgit2/transports/smart_pkt.c of the component Smart Protocol Transport. The manipulation results in improper input validation. This vulnerability is identified as CVE-2026-53587. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability categorized as very critical has been discovered in Apple macOS up to 15.7/26/26.6. This affects an unknown function. Such manipulation leads to improper input validation. This vulnerability is documented as CVE-2026-43692. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability categorized as critical has been discovered in Apple iOS and iPadOS up to 26. Affected by this issue is some unknown functionality. Executing a manipulation can lead to denial of service. This vulnerability is registered as CVE-2026-86879. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in michaelliao itranswarp up to 2.19. It has been rated as problematic. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability appears as CVE-2026-90835. The attack may be initiated remotely. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.