Aggregator

A vulnerability marked as problematic has been reported in getgrav Grav up to 2.0.1. Affected by this issue is the function offsetGet of the file admin.pages of the component Twig Sandbox. This manipulation of the argument config causes sandbox issue. This vulnerability is handled as CVE-2026-61450. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in MervinPraison PraisonAI up to 4.6.77. Affected by this vulnerability is the function subprocess.Popen of the file deploy/api.py of the component Code Generator. The manipulation of the argument agents_file results in code injection. This vulnerability is known as CVE-2026-61444. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as critical has been detected in MervinPraison PraisonAI up to 1.6.77. Affected is the function AgentFlow._resolve_pydantic_class of the file src/praisonai-agents/praisonaiagents/workflows/workflows.py of the component AgentFlow. The manipulation leads to sandbox issue. This vulnerability is traded as CVE-2026-61437. It is possible to initiate the attack remotely. There is no exploit available.

新冠疫情加速了被称为安静辞职(quiet quitting)的现象，年轻一代的上班族将工作热情不高的态度视为某种形式的“辞职”，他们还想继续领工资，但仅完成最低工作要求，把精力放在工作之外的事情上。韩国嘉泉大学的研究人员调查了权威型领导如何推动中国中小企业员工的安静辞职现象（即躺平）。他们收集了 363 名中国中小企业员工数据。结果显示权威型领导通过增加工作倦怠间接导致躺平，而非自愿出勤通过放大倦怠加速躺平。研究有助于更深入地理解权威型领导带来的有害后果，阐明躺平在中国文化背景下的出现和演变。

CISA reveals how it responded after sensitive AWS GovCloud credentials and internal data were exposed in a public GitHub repository

A vulnerability, which was classified as problematic, was found in Samsung SmartThingsKit. This issue affects some unknown processing of the component Access Control. Such manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-21050. An attack has to be approached locally. There is no exploit available.

A vulnerability categorized as problematic has been discovered in Samsung Health up to 6.30.5.105. Affected is an unknown function of the component Authorization. Such manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-21056. The attack can only be performed from a local environment. No exploit is available.

A vulnerability was found in themeatelier ChatHelp Plugin up to 3.1.3. It has been rated as problematic. This vulnerability affects unknown code of the file /wp-json/chat-help/v1/leads of the component REST API. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-15291. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as problematic has been found in wealcoder Animation Addons for Elementor Plugin up to 2.6.3 on WordPress. This impacts the function render of the file widgets/weather.php of the component Weather Widget. Performing a manipulation of the argument weather_style/move_direction results in cross site scripting. This vulnerability is reported as CVE-2026-15299. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability described as critical has been identified in FlaskBB up to 2.2.0. This issue affects some unknown processing of the component Topic Handler. Such manipulation leads to authorization bypass. This vulnerability is referenced as CVE-2026-22659. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as problematic has been found in FlaskBB up to 2.2.0. Impacted is an unknown function of the component Bulk AJAX Endpoint. Performing a manipulation results in improper authorization. This vulnerability is identified as CVE-2026-22660. The attack can be initiated remotely. There is not any exploit available.

今日暂未更新资讯~
更多最新文章，请访问SecWiki

Researchers at firmware security firm Binarly have found six new flaws in U-Boot, the small program that starts up hardware as varied as home routers, smart cameras, and the management chips inside data-center servers. Four of the bugs can crash a device. The other two could let an attacker who slips a malicious image in front of the bootloader run their own code, before the device

Защита личных данных стала прикрытием для крупной аферы.

A vulnerability categorized as problematic has been discovered in osquery up to 5.23.0. This impacts an unknown function of the file Temporary Files of the component File Handler. Executing a manipulation can lead to path traversal. This vulnerability appears as CVE-2026-46388. The attack requires local access. There is no available exploit.

Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators. [...]

A vulnerability was found in osquery up to 5.23.0. It has been rated as problematic. This affects the function getOriginalProgramName of the component Authenticode. Performing a manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2026-54001. The attack requires a local approach. No exploit exists.

A vulnerability was found in osquery up to 5.23.0. It has been declared as very critical. The impacted element is an unknown function of the component Process Command-Line/Current Directory Parser. Such manipulation leads to out-of-bounds write. This vulnerability is documented as CVE-2026-54000. The attack needs to be performed locally. There is not any exploit available.

A vulnerability was found in Red Hat OpenShift AI. It has been classified as problematic. The affected element is an unknown function of the component File Type Content Detector. This manipulation causes server-side request forgery. This vulnerability is registered as CVE-2026-15143. Remote exploitation of the attack is possible. No exploit is available.