Aggregator

A vulnerability was found in Tautulli up to 2.15.x. It has been classified as problematic. Affected by this issue is some unknown functionality of the file /image of the component API Endpoint. This manipulation causes relative path traversal. This vulnerability is registered as CVE-2025-58760. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability classified as problematic was found in 9001 copyparty up to 1.19.7. The affected element is an unknown function. Executing manipulation can lead to missing authorization. This vulnerability appears as CVE-2025-58753. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

A vulnerability was found in OctoPrint up to 1.11.2. It has been classified as critical. The impacted element is an unknown function. The manipulation leads to os command injection. This vulnerability is listed as CVE-2025-58180. The attack must be carried out from within the local network. There is no available exploit. Upgrading the affected component is recommended.

This issue was flagged as a false-positive. Please consult the sources mentioned and consider not using this entry at all.

A vulnerability was found in Microsoft Entra ID. It has been declared as critical. This affects an unknown part. Executing manipulation can lead to improper authentication. This vulnerability is registered as CVE-2025-55241. It is possible to launch the attack remotely. No exploit is available. This product is provided as a managed service, meaning users do not have the ability to maintain vulnerability countermeasures themselves.

A vulnerability identified as problematic has been detected in MongoDB Server up to 6.0.24/7.0.21/8.0.11. Affected by this issue is some unknown functionality. The manipulation leads to operation on a resource after expiration. This vulnerability is documented as CVE-2025-10060. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

再获认可！

Bundlehunt发布2025夏季Mac软件包，包含44款高质量应用自选组合（10款订阅+34款买断），授权直接来自开发者。支持微信、支付宝支付及多重折扣优惠（满30-3, 满50-4等），返利购买直达链接提供。

文章探讨了赛车游戏的没落与模拟竞速系统的兴起。传统赛车游戏因玩法单一、缺乏创新逐渐失去主流玩家青睐，而硬核模拟竞速系统则通过专业化的驾驶体验和真实数据授权吸引了特定群体。这些系统不仅用于娱乐，还被应用于职业赛事训练和电竞比赛。尽管传统赛车游戏市场萎缩，但模拟驾驶系统的快速发展为汽车文化和竞技体育注入了新活力。

Счётчик в коде игры достиг предела и вызвал сбой.

从8月起, YouTube创作者发现视频观看次数大幅下滑,谷歌称因用户使用广告拦截工具拦截其统计API所致,尤其是EasyList规则集更新后影响更大,科技类频道受影响最严重。

1.Qilin勒索团伙公布了新的受害者 2.Play勒索团伙公布新的受害公司 3.INC Ransom团伙公布新的受害公司

谷歌发布紧急安全更新修复Chrome浏览器中的零日漏洞CVE-2025-10585，该漏洞已被黑客利用。新版本140.0.7339.185/186正在逐步推送，用户可手动更新以封堵漏洞。

Default credentials, weak passwords, misconfigurations and a variety of other security shortcomings are exposing millions of medical devices and their data on the internet, said Soufian El Yadmani, CEO and co-founder of Modat, who shared recent research findings.

Users Download Malware in Bid to Placate Meta
A newly surfaced FileFix social engineering campaign puts a new spin on ClickFix attacks by goading users into loading malware under the guise of reporting a wrongful account suspension to social media giant Facebook. Victims likely get sucked into the scam by following a link from a phishing email.

Also, Colt Services Outage Persists, Finland Charges Americans in Vastaamo Hack
This week, Microsoft hit RaccoonO365, Colt Technology Services, Finland charged a U.S. citizen in Vastaamo hack. RevengeHotels hackers used AI, Meta can't overturn a privacy case verdict. Chinese hackers unleashed spear phishing emails. Prosper confirmed a data breach, as did Kering fashion houses.

Silicon Valley Startup Brings AI Agent and Prompt Injection Protections to Falcon
CrowdStrike plans to purchase Pangea to add native AI detection and response capabilities to its Falcon platform. The company says the acquisition will help secure AI models and users alike from preventing prompt injection to tracking agent activity across enterprise environments.

Senate Homeland Security Cancels Markup Session
Lawmakers are racing to extend a key cyber sharing law before it expires Sept. 30, but partisan gridlock and proposed restrictions on the U.S. cyber defense agency's disinformation work threaten reauthorization - risking federal insight into active threats and chilling private cooperation.

主要分享一下今年挖企业src的一些过程、案例

先知社区双十一投稿活动｜月满中秋，奖励加倍！