Aggregator

2026年4月11日，深瞳漏洞实验室监测到一则Nginx组件存在缓冲区溢出漏洞的信息，漏洞编号：CVE-2026-27654，漏洞威胁等级：高危。

The North Korean hacking group tracked as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat actors approached targets on Facebook and added them as friends on the social media platform, turning the trust-building exercise into a delivery channel for a remote access trojan called RokRAT. "The threat actor used two Facebook

The UK Cyber Security Council has unveiled a new Associate Cyber Security Professional title aimed at supporting early‑career cybersecurity professionals

TailVNC A Windows remote desktop persistence tool built on top of Tailscale’s WireGuard-encrypted mesh network. TailVNC embeds a

The post Beyond the Firewall: How TailVNC Fuses WireGuard and VNC for Untraceable Access appeared first on Penetration Testing Tools.

Iran-linked group Handala claims to have breached three major UAE organizations, Dubai Courts, Dubai Land Department, and Dubai Roads & Transport Authority The group Handala claimed a major cyberattack against the UAE, targeting Dubai Courts Department, Dubai Land Department, and Dubai Roads and Transport Authority. They alleged destroying 6 petabytes of data and stealing 149 TB […]

Одна маленькая оплошность стала большой проблемой для всех.

基于经济学视角分析技术变革与恩格斯停滞（1780-1860）摘要18世纪末至19世纪中叶的英国工业革命期间，出

A vulnerability marked as critical has been reported in code-projects Easy Blog Site 1.0. This affects an unknown function of the file post.php. Performing a manipulation of the argument tags results in sql injection. This vulnerability was named CVE-2026-6202. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability labeled as critical has been found in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. This vulnerability is uniquely identified as CVE-2026-6201. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability identified as critical has been detected in Tenda F456 1.0.0.5. The affected element is the function formwebtypelibrary of the file /goform/webtypelibrary. This manipulation of the argument menufacturer/Go causes stack-based buffer overflow. This vulnerability is handled as CVE-2026-6200. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability categorized as critical has been discovered in Tenda F456 1.0.0.5. Impacted is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page results in stack-based buffer overflow. This vulnerability is known as CVE-2026-6199. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability was found in Tenda F456 1.0.0.5. It has been rated as critical. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. This vulnerability is traded as CVE-2026-6198. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Tenda F456 1.0.0.5. It has been declared as critical. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Executing a manipulation of the argument mit_ssid can lead to stack-based buffer overflow. This vulnerability appears as CVE-2026-6197. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability was found in Tenda F456 1.0.0.5. It has been classified as critical. This affects the function fromexeCommand of the file /goform/exeCommand. Performing a manipulation of the argument cmdinput results in stack-based buffer overflow. This vulnerability is reported as CVE-2026-6196. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Submit #797629 / VDB-357124

Submit #797515 / VDB-357123

A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024 and classified as critical. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument admpass leads to os command injection. This vulnerability is documented as CVE-2026-6195. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability has been found in Totolink A3002MU B20211125.1046 and classified as critical. Affected by this vulnerability is the function sub_410188 of the file /boafrm/formWlanSetup of the component HTTP Request Handler. This manipulation of the argument wan-url causes stack-based buffer overflow. This vulnerability is registered as CVE-2026-6194. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Submit #797472 / VDB-357122