Aggregator

Оказывается, на самых мелких масштабах законы физики снова устойчивы и нерушимы.

Submit #769770 / VDB-351079

A vulnerability described as critical has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc_sync.php of the component HTTP Request Handler. Executing a manipulation of the argument template_path can lead to os command injection. This vulnerability is handled as CVE-2026-4170. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #769771 / VDB-351078

Submit #769769 / VDB-351078

Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it propagates through the Open VSX registry. "Instead of requiring every malicious listing to embed the loader directly, the threat actor is now abusing extensionPack and extensionDependencies to turn initially standalone-looking extensions into transitive

Submit #769768 / VDB-351077

A vulnerability marked as problematic has been reported in Tecnick TCExam up to 16.6.0. Affected is the function F_xml_export_users of the file admin/code/tce_xml_users.php of the component XML Export. Performing a manipulation results in cross site scripting. This vulnerability is known as CVE-2026-4169. Remote exploitation of the attack is possible. No exploit is available. There are still doubts about whether this vulnerability truly exists. It is suggested to upgrade the affected component. When the vendor was informed about another security issue, he identified and fixed this flaw during analysis. He doubts the impact of this: "However, this is difficult to justify as security issue. It requires to be administrator to both create and consume the exploit. Administrators can do pretty much anything in the platform, so I don't see the point of this from a security perspective." This is reflected by the CVSS vector.

A vulnerability labeled as problematic has been found in Tecnick TCExam 16.5.0. This impacts an unknown function of the file /admin/code/tce_edit_group.php of the component Group Handler. Such manipulation of the argument Name leads to cross site scripting. This vulnerability is traded as CVE-2026-4168. The attack may be launched remotely. Furthermore, there is an exploit available. The presence of this vulnerability remains uncertain at this time. The affected component should be upgraded. The vendor explained: "I was not able to reproduce the same exploit as the TCExam version was already advanced in the meanwhile." Therefore, it can be assumed that this issue got fixed in a later release.

近期，开源AI智能体OpenClaw（俗称“龙虾”）火了，AI“养龙虾”成为全网热点，多地宣布下场“养龙虾”。“龙虾”通

关于防范OpenClaw（“龙虾”）开源智能体安全风险的“六要六不要”建议针对“龙虾”典型应用场景下的安全风险，工业和信

提出工程关系管理（ERM）平台，重构企业工程风险管理方式

Submit #769826 / VDB-351075

A vulnerability identified as critical has been detected in Belkin F9K1122 1.00.33. This affects the function formReboot of the file /goform/formReboot. This manipulation of the argument webpage causes stack-based buffer overflow. This vulnerability appears as CVE-2026-4167. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

ShinyHunters claims it stole up to 1 petabyte of data from Telus Digital, including support recordings, code, and employee records after a breach.

A vulnerability categorized as problematic has been discovered in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. This vulnerability is reported as CVE-2026-4166. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure.

Submit #769727 / VDB-351074

A vulnerability was found in Worksuite HR, CRM and Project Management up to 5.5.25. It has been rated as problematic. The affected element is an unknown function of the file /account/orders/create. The manipulation of the argument Client Note leads to cross site scripting. This vulnerability is documented as CVE-2026-4165. The attack can be initiated remotely. Additionally, an exploit exists.

Submit #769726 / VDB-315004

Submit #769653 / VDB-351073