Aggregator

A vulnerability labeled as problematic has been found in external-secrets up to 2.2.x. This impacts the function TxtFuncMap of the file runtime/template/v2/template.go of the component DNS Resolution Handler. The manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-34984. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in MervinPraison PraisonAI and praisonaiagents. This affects an unknown function of the file /ws of the component WebSocket Endpoint. The manipulation leads to missing authentication. This vulnerability is listed as CVE-2026-40289. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in jqlang jq up to 1.8.1. The impacted element is the function jv_setpath/jv_getpath/delpaths_sorted of the file src/jv_aux.c. Executing a manipulation of the argument path can lead to uncontrolled recursion. This vulnerability is tracked as CVE-2026-33947. The attack is restricted to local execution. No exploit exists. Applying a patch is advised to resolve this issue.

A vulnerability was found in jqlang jq. It has been rated as critical. The affected element is the function jv_parse_sized. Performing a manipulation of the argument length results in out-of-bounds read. This vulnerability is identified as CVE-2026-39979. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in MervinPraison PraisonAI and praisonaiagents up to 4.5.138. It has been declared as critical. Impacted is the function import_tools_from_file of the file tools.py. Such manipulation leads to code injection. This vulnerability is referenced as CVE-2026-40287. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in 1Panel-dev MaxKB up to 2.7.x. It has been classified as problematic. This issue affects the function mcp_servers of the component Workflow Creation API. This manipulation causes enforcement of behavioral workflow. The identification of this vulnerability is CVE-2026-39417. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2026-21643 (CVSS score: 9.1) -  An SQL injection vulnerability in  Fortinet FortiClient EMS that could allow an

嗯，用户让我用中文总结一下这篇文章，控制在100字以内，而且不需要用“文章内容总结”之类的开头。好的，首先我得仔细阅读文章内容。 文章主要讲的是美国网络安全和基础设施安全局（CISA）在周一新增了六个安全漏洞到他们的已知被利用漏洞目录中。这些漏洞都有各自的CVE编号和CVSS评分，看起来都是比较严重的。 然后，我注意到每个漏洞的具体情况：比如Fortinet FortiClient EMS的SQL注入漏洞，CVSS得分9.1；Adobe Acrobat Reader的内存释放后使用漏洞，得分7.8；还有微软的一些漏洞，比如Windows Common Log File System Driver的越界读取和Exchange Server的反序列化问题。 接下来，文章提到CISA之所以加入这些漏洞是因为有证据显示它们正在被积极利用。例如，CVE-2026-21643被Defused Cyber检测到从2026年3月24日开始有攻击尝试。微软也提到一个威胁行为者利用CVE-2023-21529来传播Medusa勒索软件。至于CVE-2012-1854，微软在2012年的公告中提到有限且有针对性的攻击尝试。 其他三个漏洞目前还没有公开报告指出它们被利用的情况。最后，FCEB机构需要在2026年4月27日前修复这些漏洞。 总结的时候需要涵盖CISA新增六个漏洞、各个漏洞的严重性、部分已被利用的情况以及修复期限。要控制在100字以内，所以得简洁明了。 可能会这样组织语言：CISA新增六个高危漏洞至目录，涉及SQL注入、内存错误等；部分已被用于攻击；要求机构在4月前修复。 这样既涵盖了主要信息，又符合字数限制。 美国网络安全机构CISA新增六项高危安全漏洞至已知被利用列表，包括SQL注入、内存错误及特权提升等严重问题；部分漏洞已被用于实际攻击活动；相关机构需于四月底前完成修复以应对威胁。

A vulnerability was found in Ubiquiti UniFi Play PowerAmp and UniFi Play Audio Port and classified as critical. This vulnerability affects unknown code. The manipulation results in path traversal. This vulnerability was named CVE-2026-22562. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability has been found in MervinPraison PraisonAI and praisonaiagents and classified as critical. This affects the function subprocess.run of the file job_workflow.py of the component YAML File Parser. The manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2026-40288. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in SAP NetWeaver Application Server ABAP up to 816. Affected by this issue is some unknown functionality. Executing a manipulation can lead to open redirect. This vulnerability is handled as CVE-2026-34257. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

好的，我现在需要帮助用户总结一篇文章的内容，控制在100字以内，并且直接写描述，不需要开头语。首先，我得仔细阅读用户提供的文章内容，理解其主要观点和结论。 这篇文章主要讨论了大型语言模型（LLMs）在发现软件漏洞方面的能力。作者通过实验和分析，探讨了LLMs是如何找到漏洞的，以及它们的表现与传统方法有何不同。实验中使用了Opus 4.6模型，并测试了其在不同代码表示（如源代码、编译二进制、混淆二进制）下的表现。 从实验结果来看，Opus在识别已知漏洞时表现良好，但在处理混淆后的代码时遇到了困难，不得不依赖运行时的枚举和模糊测试。这表明LLMs在一定程度上依赖于模式匹配，并且在复杂的代码结构面前表现有限。 文章还提到了Mythos模型的潜力，认为它可能带来更强大的漏洞发现能力，但目前Opus的表现更接近于传统的模糊测试工具。此外，作者强调了LLMs在解释其推理过程时的潜在问题，如编造答案的情况。 总结起来，文章揭示了LLMs在漏洞发现中的现状、优势和局限性，并对未来的发展提出了展望。 文章探讨了大型语言模型（LLMs）如何发现软件漏洞。通过实验分析Opus 4.6模型在源代码、编译二进制和混淆二进制上的表现，发现其依赖模式匹配识别已知漏洞，在复杂或混淆代码上需借助动态分析。尽管LLMs能生成有效 exploits，但目前仍以模式匹配为主而非深度推理。未来Mythos等模型可能带来更大突破。

A vulnerability, which was classified as problematic, has been found in 1Panel-dev MaxKB up to 2.7.x. Affected by this vulnerability is an unknown functionality of the component Service. Performing a manipulation results in injection. This vulnerability is known as CVE-2026-39419. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in SAP NetWeaver Application Server Java 7.50. Affected is an unknown function. Such manipulation leads to code injection. This vulnerability is traded as CVE-2026-27674. The attack may be launched remotely. There is no exploit available. Applying a patch is advised to resolve this issue.

A vulnerability classified as problematic has been found in jqlang jq. This impacts an unknown function of the component JSON Object Hash Table Handler. This manipulation causes use of weak hash. This vulnerability appears as CVE-2026-40164. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

A vulnerability described as critical has been identified in 1Panel-dev MaxKB up to 2.7.x. This affects an unknown function of the file sandbox.so of the component ToolExecutor. The manipulation of the argument LD_PRELOAD results in protection mechanism failure. This vulnerability is reported as CVE-2026-39421. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in 1Panel-dev MaxKB up to 2.7.x. The impacted element is the function socket.sendto. The manipulation leads to server-side request forgery. This vulnerability is documented as CVE-2026-39418. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in 1Panel-dev MaxKB up to 2.7.x. The affected element is an unknown function of the file sandbox.so of the component Tool Debug API. Executing a manipulation of the argument LD_PRELOAD can lead to protection mechanism failure. This vulnerability is registered as CVE-2026-39420. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in wp_media BackWPup Plugin up to 5.6.6 on WordPress. Impacted is the function str_replace of the file /wp-json/backwpup/v1/getblock of the component REST Endpoint. Performing a manipulation of the argument block_name results in path traversal. This vulnerability is cataloged as CVE-2026-6227. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

好，我需要帮用户总结这篇文章的内容，控制在100字以内。首先，文章讲的是汇丰银行在美国推出了代币化存款项目。他们是在Canton Network这个公共区块链上完成的试点，并正式上线了。这是他们第一次在公共链上发行和应用代币化存款。 接下来，文章提到在试点过程中，汇丰验证了TDS与多种数字资产在同一网络上的交割对接能力，并模拟了发行、转移以及与其他资产的“原子结算”。这意味着他们能够实现快速、无缝的资金流动。 然后，代币化存款支持美元、英镑、欧元、港元和新加坡元等多种主流货币，按照1:1的比例将法币转换为代币。符合条件的客户可以全天候在美国国内和跨司法管辖区进行支付转账，改善流动性管理和全球贸易。 总结一下，文章主要介绍了汇丰银行在美国推出代币化存款项目的情况，包括试点的成功、支持的货币种类以及带来的便利。我需要把这些关键点浓缩到100字以内，确保信息准确且简洁。 首先，提到汇丰银行推出代币化存款项目，并在Canton Network上完成试点。然后说明支持多种货币，并实现快速资金流动。最后强调这对全球贸易和流动性管理的改善。 这样组合起来应该能符合用户的要求。 汇丰银行在美国推出代币化存款服务，在Canton Network区块链上完成试点并正式上线。该服务支持美元、英镑等多货币种，按1:1比例转换为代币，实现全天候无缝资金流动，提升全球贸易和流动性管理效率。