Aggregator

A vulnerability identified as critical has been detected in phoca.cz Phoca Downloads Plugin. Affected by this issue is some unknown functionality. This manipulation causes unrestricted upload. This vulnerability is registered as CVE-2026-57828. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability categorized as critical has been discovered in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. This vulnerability is cataloged as CVE-2026-15479. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure.

A vulnerability was found in rsjoomla RSFiles Plugin up to 1.17.11. It has been rated as critical. Affected is an unknown function. The manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2026-57827. The attack may be initiated remotely. There is no available exploit.

Vom 19. bis 23. August 2026 findet unsere diesjährige “ChaosZeltZone”statt. Dieses Jahr si

看雪论坛作者ID：xnqjns

欢迎踊跃参与赢大奖

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

本文链接

一场关于“AI如何真正接管攻防闭环”的深度实践，这是又一个LLM+工具链的Demo，而是一次从“人指挥AI”到“AI自主求解”的范式跃迁——来自WgpSec安全团队2026年最新工程化成果：Alkaid智能体框架及其在真实攻防场景中的落地验证。

这份材料，凝结了三个关键突破：

🔹 第一，直面AI攻防的三大顽疾： 状态失忆（15轮后路径僵化）、知识幻觉（自编CVE/错PoC）、评测失真（90%通过率背后标准不一）——不是回避问题，而是用架构设计根治它。

🔹 第二，定义AI在攻防中的三级演进： - Level 1 副驾驶：嵌入现有工具，辅助写报告、生成Payload； - Level 2 半自主：多步规划+人工Checkpoint，如PentestGPT式对话渗透； - Level 3 全自主★：给定目标域名或CTF题目，AI自动完成侦察→定位→利用→拿flag全链路——Cairn已在腾讯云挑战赛实现54/54全解。

🔹 第三，用极简架构激发复杂智能： 摒弃RAG、MCP、微调等“外部依赖”，仅靠三原语黑板（Fact/Intent/Goal）+ OODA调度 + 自涌现机制，让攻击链像蚁群信息素一样自然生长。同样的基座模型，架构差异，能力上限天壤之别。

特别值得一提的是，Alkaid首次统一实现了“达成模式”（如拿flag）与“覆盖模式”（如代码审计挖尽漏洞）——同一套引擎，两种数学级终止判据，既防LLM“自我欺骗”，也保攻击面“滴水不漏”。

一场关于“AI如何真正接管攻防闭环”的深度实践，这是又一个LLM+工具链的Demo，而是一次从“人指挥AI”到“AI自主求解”的范式跃迁——来自W

A vulnerability was found in IceHRM up to 35.0.1. It has been declared as critical. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. This vulnerability is tracked as CVE-2026-15478. The attack can be launched remotely. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

Submit #837069 / VDB-377785

A vulnerability was found in Bahmni bahmnicore up to 0.93. It has been classified as critical. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test results in sql injection. This vulnerability is identified as CVE-2026-15477. The attack can be initiated remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.

Submit #836330 / VDB-377783

A vulnerability was found in QILING Disk Master 6.0.0.0 and classified as critical. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. This vulnerability is referenced as CVE-2026-15476. The attack can only be performed from a local environment. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Submit #836079 / VDB-377782

A vulnerability has been found in MiniTool Partition Wizard up to 13.6 and classified as critical. The affected element is an unknown function in the library pwdrvio.sys of the component Signed Kernel Driver. This manipulation causes improper access controls. The identification of this vulnerability is CVE-2026-15475. The attack can only be executed locally. Furthermore, there is an exploit available. The affected component should be upgraded. The vendor was contacted early about this disclosure.

Submit #835610 / VDB-377781

Submit #833842 / VDB-377780

A vulnerability, which was classified as problematic, was found in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recording Handler. The manipulation of the argument callId results in improper authorization. This vulnerability was named CVE-2026-15474. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.