Aggregator

发现SessionFilter鉴权绕过、MyBatis拼接SQL注入、三处任意文件上传、两处任意文件读取及一处任意文件删除漏洞。

Discord users will soon see a change to how their accounts work. From early March 2026, access to some features will require age verification using an ID or a face scan. The changes follow earlier deployments in a small number of countries and will apply to both new and existing accounts. Under the updated model, accounts are placed into a teen-oriented experience unless the user confirms they are 18 or older. The change affects access … More →

The post Face scans and ID checks are coming to Discord appeared first on Help Net Security.

这些面向企业安全需求而设计的浏览器，大多基于 Chromium 内核，定位并非普通消费者使用场景。

22 года попыток сделать интернет безопасным. И всё равно всё упирается в вашу внимательность.

各位亲爱的白帽师傅们： 年味渐浓，新春将至！OSRC团队现将春节放假安排公示如下，同时也为各位白帽师傅们，送上最诚挚的新春祝福！ 放假时间 2026 年 2 月 15 日 — 2 月 23 日 温馨提示： 假期期间，各位师傅们仍可以通过平台向我们提交漏洞报告。 漏洞的审核与回复工作将有所延迟，请各位师傅耐心等候。 若遇特殊紧急情况，请直接联系 OSRC 官方小助手微信：opposrc2018，我们将及时响应。 新的一年，期待各位师傅继续深耕漏洞挖掘，多多提交有效报告，在 OSRC 平台再创佳绩，明年我们线下盛典的舞台，依然为最优秀的你预留！ 最后，提前祝大家新年快乐，马年吉祥，阖家幸福，万事顺遂！ OSRC 安全团队 2026 年 2月 10 日

A vulnerability was found in Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn. It has been rated as critical. This vulnerability affects the function sub_47D878. This manipulation of the argument src causes stack-based buffer overflow. This vulnerability is tracked as CVE-2023-45480. The attack is only possible within the local network. No exploit exists.

A vulnerability was found in Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn. It has been declared as critical. This affects the function sub_49E098 of the component Parameter Handler. The manipulation of the argument list results in stack-based buffer overflow. This vulnerability is identified as CVE-2023-45479. The attack can only be performed from the local network. There is not any exploit available.

A vulnerability, which was classified as problematic, has been found in QAD Search Server up to 1.0.0.315. Affected by this issue is some unknown functionality. This manipulation causes cross site scripting. This vulnerability appears as CVE-2023-45471. The attack may be initiated remotely. There is no available exploit.

Правительство готовит закон об обязательной проверке «опасного» ИИ.

A vulnerability was found in Flowring AgentFlow 4.0. It has been classified as problematic. The affected element is an unknown function. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-2098. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Flowring Docpedia 3.0 and classified as critical. Impacted is an unknown function. The manipulation results in sql injection. This vulnerability is cataloged as CVE-2026-2094. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Flowring Docpedia 3.0 and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. This vulnerability is listed as CVE-2026-2093. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, was found in Flowring AgentFlow 4.0. This vulnerability affects unknown code. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2026-2099. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Flowring Agentflow. This affects an unknown part. Performing a manipulation results in unrestricted upload. This vulnerability is identified as CVE-2026-2097. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as critical was found in Flowring Agentflow. Affected by this issue is some unknown functionality. Such manipulation leads to authentication bypass using alternate channel. This vulnerability is referenced as CVE-2026-2096. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as critical has been found in Flowring Agentflow. Affected by this vulnerability is an unknown functionality of the component Authentication Token Handler. This manipulation causes authentication bypass using alternate channel. The identification of this vulnerability is CVE-2026-2095. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Linux Kernel up to 6.1.148/6.6.102/6.12.42/6.15.10/6.16.1. It has been declared as critical. Affected is the function bpf_int_jit_compile of the component LoongArch. Executing a manipulation can lead to improper initialization. This vulnerability is tracked as CVE-2025-38723. The attack is only possible within the local network. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.42/6.15.10/6.16.1/6.17-rc1. It has been rated as critical. The affected element is the function export_dmabuf of the component habanalabs. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2025-38722. The attack can only be performed from the local network. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.15.10/6.16.1/6.17-rc1. This vulnerability affects the function reset_prepare of the component Hibmcge Driver. Executing a manipulation can lead to deadlock. The identification of this vulnerability is CVE-2025-38720. The attack needs to be done within the local network. There is no exploit available. You should upgrade the affected component.

A vulnerability classified as critical has been found in Linux Kernel up to 6.17-rc1. This impacts the function ctnetlink_dump_table of the component netfilter. This manipulation causes improper update of reference count. This vulnerability appears as CVE-2025-38721. The attacker needs to be present on the local network. There is no available exploit. It is recommended to upgrade the affected component.