Aggregator

德国主权科技基金（Sovereign Tech Fund)向联邦宇宙微博客项目 Mastodon 资助 61.4 万欧元，用于支持 Mastodon 及其软件生态系统的改进和更新。这笔资金将投入到改进：黑名单同步；新的 Fediverse Auxiliary Service Provider(FASP)允许服务器之间共享存储和媒体处理资源；自动化内容检测；私信端到端加密；改进文档。相关改进预计在 2026 年底到 2027 年完成。

A vulnerability was found in Linux Kernel up to 6.18.21/6.19.11 and classified as critical. The impacted element is the function bond_xmit_broadcast of the component net. The manipulation results in use after free. This vulnerability is cataloged as CVE-2026-31419. The attack must originate from the local network. There is no exploit available. It is suggested to upgrade the affected component.

今日暂未更新资讯~
更多最新文章，请访问SecWiki

Kraken exchange faces extortion after a staff member misused access to record internal systems, about 2,000 accounts affected, no funds or systems breached.

Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution. The vulnerabilities have been described as command injection flaws affecting the Perforce VCS (version control software) driver. Details of the two flaws are below - CVE-2026-40176 (CVSS

Moroccan Biomedical School SUPTECH SANTE Breached, 231 Student Dossiers With National IDs, Diplomas, and ID Card Photos Exposed

Microsoft has rolled out a fast-track process to help developers regain access to accounts recently suspended from its Windows Hardware Program, following widespread complaints that they were locked out without warning. [...]

OpenSSL 4.0.0 removes several long-deprecated features, adds support for Encrypted Client Hello, and introduces API-level changes that will require code updates for applications built against older versions. SSLv3, SSLv2 client hello, and engines are gone SSLv3 support has been removed. The protocol was deprecated in 2015, and OpenSSL had it disabled by default since version 1.1.0 in 2016. Support for the SSLv2 Client Hello has also been removed. The engine API, which provided a mechanism … More →

The post OpenSSL 4.0.0 release cuts deprecated protocols and gains post-quantum support appeared first on Help Net Security.

Неизвестные получили доступ к именам и адресам клиентов сервиса.

OpenSSL 项目释出了 v4.0 版本。主要新特性包括：支持 Encrypted Client Hello (ECH)，通过加密初始 TLS 握手以及隐藏服务器名称指示(SNI)提供更好的隐私保护；移除 SSLv3 等旧协议/引擎支持；通过支持 RFC 8998 改进后量子加密支持；移除 SSLv2 Client Hello，停止支持 Darwin i386 和 PowerPC/PPC64 等。

A vulnerability labeled as critical has been found in HT Mega Plugin up to 2.4.6 on WordPress. The impacted element is an unknown function. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2024-1974. The attack may be performed from remote. There is no available exploit.

A vulnerability classified as problematic was found in ShopLentor Plugin up to 2.8.1 on WordPress. Affected by this vulnerability is an unknown functionality of the component Banner Link Handler. The manipulation results in cross site scripting. This vulnerability is reported as CVE-2024-1960. The attack can be launched remotely. No exploit exists.

A vulnerability labeled as critical has been found in Everest Forms Plugin up to 2.0.7 on WordPress. This affects an unknown part. Executing a manipulation of the argument font_url can lead to server-side request forgery. This vulnerability is registered as CVE-2024-1812. The attack requires access to the local network. No exploit is available.

A vulnerability identified as critical has been detected in Easy Property Listings up to 3.5.2 on WordPress. This impacts an unknown function of the component Shortcode Handler. The manipulation leads to sql injection. This vulnerability is documented as CVE-2024-1893. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in WP Compress Plugin up to 6.11.10 on WordPress. Affected is an unknown function of the component CDN Handler. The manipulation results in missing authorization. This vulnerability is reported as CVE-2024-1934. The attacker must have access to the local network to execute the attack. No exploit exists.

A vulnerability, which was classified as problematic, has been found in Getwid Plugin up to 2.0.5 on WordPress. This issue affects some unknown processing of the component Block Content Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-1948. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in AI Post Generator Plugin up to 3.3 on WordPress and classified as critical. Impacted is an unknown function. Such manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2024-1850. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic was found in Forminator Plugin up to 1.29.0 on WordPress. Affected by this issue is some unknown functionality of the component File Upload. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2024-1794. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in WP-Members Membership Plugin up to 3.4.9.2 on WordPress. It has been rated as problematic. This affects an unknown part. Performing a manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2024-1852. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in CMB2 Plugin up to 2.10.1 on WordPress. It has been classified as critical. This affects an unknown function. This manipulation causes code injection. This vulnerability is handled as CVE-2024-1792. The attack can be initiated remotely. There is not any exploit available.