Aggregator

A vulnerability has been found in EZVIZ CS-C6N-B0-1G2WF, CS-C6N-R101-1G2WF, CS-CV310-A0-1B2WFR, CS-CV310-A0-1C2WFR-C, CS-C6N-A0-1C2WFR-MUL, CS-CV310-A0-3C2WFRL-1080p, CS-CV310-A0-1C2WFR, CS-CV248-A0-32WMFR and LC1C and classified as critical. Affected is the function mulicast_parse_sadp_packet of the component SADP Multicast Protocol Handler. This manipulation causes stack-based buffer overflow. This vulnerability is handled as CVE-2023-34552. The attack can only be done within the local network. There is not any exploit available. The affected component should be upgraded.

A vulnerability marked as critical has been reported in Eramba Community Edition and Enterprise Edition 3.19.1. The impacted element is an unknown function of the file /settings/download-test-pdf. Performing a manipulation of the argument path results in code injection. This vulnerability is cataloged as CVE-2023-36255. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

A vulnerability, which was classified as critical, was found in ZKTeco BioAccess IVS 3.3.1. This vulnerability affects unknown code of the component Door Handler. The manipulation results in improper access controls. This vulnerability is identified as CVE-2023-38958. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as critical, was found in NextGen Mirth Connect 4.3.0. The affected element is an unknown function. Such manipulation leads to command injection. This vulnerability is referenced as CVE-2023-37679. It is possible to launch the attack remotely. No exploit is available.

A vulnerability has been found in ZKTeco BioAccess IVS 3.3.1 and classified as critical. The impacted element is an unknown function. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2023-38954. The attack can only be performed from the local network. There is not any exploit available.

A vulnerability was found in ZKTeco BioAccess IVS 3.3.1. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Managed Device Handler. This manipulation causes information disclosure. This vulnerability is registered as CVE-2023-38955. The attack requires access to the local network. No exploit is available.

A vulnerability categorized as critical has been discovered in ZKTeco BioAccess IVS 3.3.1. Affected by this issue is some unknown functionality. Such manipulation leads to path traversal. This vulnerability is documented as CVE-2023-38956. The attack requires being on the local network. There is not any exploit available.

快来注册体验吧！

以安全基线加固提升工业终端防御能力。

A vulnerability categorized as problematic has been discovered in JetBrains YouTrack. This issue affects some unknown processing of the component Comment Templates Endpoint. Executing a manipulation can lead to missing authorization. This vulnerability appears as CVE-2026-57921. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability marked as problematic has been reported in JetBrains YouTrack. The impacted element is an unknown function. This manipulation causes improperly controlled modification of object prototype attributes. This vulnerability is handled as CVE-2026-57926. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Progress MOVEit Transfer up to 2025.0.7/2025.1.3/2026.0.0. Impacted is an unknown function of the component Custom Reports Module. Executing a manipulation can lead to improper neutralization. This vulnerability is handled as CVE-2026-10698. The attack can be executed remotely. There is not any exploit available.

A vulnerability marked as problematic has been reported in Progress MOVEit Transfer up to 2025.0.7/2025.1.3/2026.0.0. The affected element is an unknown function of the component Custom Reports Module. The manipulation leads to memory leak. This vulnerability is uniquely identified as CVE-2026-10699. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability classified as problematic has been found in Progress MOVEit Transfer up to 2025.0.7/2025.1.3/2026.0.0. This affects an unknown function of the component Ad Hoc Module. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-2026-11903. It is possible to initiate the attack remotely. There is no exploit available.

【事件核心】 2026年6月，全球制药巨头诺和诺德遭勒索软件团伙FulcrumSec定向攻击，利用MOVEit Transfer零日漏洞CVE-2026-42198突破外网，低速横向渗透2个月后分片加密导出1.3TB核心数据（含"蜻蜓"多模态AI全栈权重），索要2500万美元赎金遭拒。 【AI资产定义】 AI资产是指企业在人工智能研发与应用过程中形成的、具有经济价值和技术壁垒的核心资源，主要包括： ①AI模型权重（训练完成的神经网络参数文件，如诺和诺德"蜻蜓"模型全栈）； ②训练数据集（高质量标注数据、专有领域语料）； ③推理API与服务平台（模型部署环境、API密钥、调用日志）； ④AI研发配套设施（训练代码、实验记录、超参数配置）。其价值不仅在于重建成本高（"蜻蜓"研发投入超10亿美元），更在于一旦泄露，竞争对手可低成本复制核心能力，甚至通过"模型逆向"获取训练数据中的商业机密。 【安全启示】 此次事件标志着AI资产安全从"理论风险"进入"实战损失"阶段。攻击者采用"日均20GB慢速数据外传"规避传统DLP阈值检测，揭示行为分析必须从"阈值检测"转向"基线偏离检测"。勒索软件团伙展现出惊人的"商业分析能力"——2500万美元赎金相当于"蜻蜓"研发投入的2.5%，且威胁向竞品倒卖，本质是商业竞争情报战。 【个人观点】 作为安全从业人员，我观察到AI模型权重长期处于安全边界的"三不管"地带：研发团队认为"这是算法"，安全团队认为"这是业务系统"，法务团队认为"这归知识产权"。 结果AI训练环境既无网络隔离，也无行为监测。AI资产不是"算法"，是"核心知识产权+商业竞争力+国家安全"的三位一体。保护它，不是在保护数据，是在保护未来。 防护建议： 1、立即盘点AI资产清单，建立训练环境专用隔离区 2、优化DLP规则，覆盖"日均20GB"级别的慢速数据泄露 3、建立供应链软件漏洞情报机制，实现零日漏洞小时级响应 4、制定勒索软件专项应急预案，明确"不支付、快报告、重恢复"三原则

Полная инструкция по защите от кредитного мошенничества.

Dutch police said Thursday they had uncovered evidence suggesting that Dutch criminals were involved in the cyberattack on telecom provider Odido that exposed the personal data of more than 6 million customers earlier this year.

The OpenMandriva Linux project announced that it was the target of an attempted act of internal sabotage after a dispute among contributors. [...]

INTERPOL’s Operation First Light 2026 led to 5,811 arrests, blocked $293M in criminal assets, and disrupted global fraud and money laundering networks. INTERPOL coordinated a four-month operation across 97 countries and territories that ended with 5,811 arrests and the interception of USD 293 million in illicit assets. Operation First Light 2026 ran from January 15 […]

A vulnerability, which was classified as critical, was found in Mozilla Firefox up to 151. This affects an unknown function. Such manipulation leads to memory corruption. This vulnerability is traded as CVE-2026-12317. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.