Aggregator

黑产新玩法

看雪论坛作者ID：qqqiu

A vulnerability labeled as critical has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engine. This vulnerability is referenced as CVE-2026-9498. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

近日，工业和信息化部、商务部、市场监管总局等部门联合启动实施《人工智能终端智能化分级》系列国家标准，为人工智能终端的“聪明程度”划定统一标尺。从行业自发探索到国家层面标准出台，从概念泛化滥用到规范有序发展……

5月22日-24日，由温州市人民政府主办、国家数据发展研究院等单位承办，以“瓯江论数·AI赢未来”为主题的2026数据安全发展大会在温州市举办。天融信科技集团董事长兼CEO李雪莹受邀出席主体大会做主旨报告，同与会嘉宾共探数据要素与AI创新协同新路径。

监测发现，全球主流JavaScript软件包管理平台npm遭“沙虫”（Shai-Hulud）供应链投毒攻击。攻击者攻陷了npm官方维护者账户，并在短时间内批量投放大量恶意软件包，涉及300余个独立程序包的600余个恶意版本，影响多个热门开源项目。

《取证规则》共六章61条，并附7类法律文书样式，整体结构较2019年规则更加完整，既保留了原有“取证—检查—检验鉴定”的基本流程，又将勘验、冻结、调取、抽样取证等内容按照侦查或调查取证流程加以展开，呈现出明显的体系化和精细化趋势。

意见反馈截止时间为2026年6月21日

人工智能正以前所未有的速度从“生成式对话”迈向“代理式执行”。这一范式跃迁迫切要求构建与之相匹配的数据安全治理制度。面对AI智能体带来的全场景渗透风险，法律责任的穿透重塑、工具供应链的准入审查，以及端到端技术防御围栏的构建……

上周关注度较高的产品安全漏洞(20260518-20260524)

国家信息安全漏洞共享平台（以下简称CNVD）本周共收集、整理信息安全漏洞501个，其中高危漏洞279个、中危漏洞174个、低危漏洞48个。

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. Affected by this vulnerability is the function smu_sys_set_pp_table. This manipulation causes buffer overflow. This vulnerability is handled as CVE-2025-21780. The attack can only be done within the local network. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.15/6.13.3/6.14-rc2. It has been rated as critical. Impacted is an unknown function of the component tracing. The manipulation of the argument mmap leads to memory corruption. This vulnerability is documented as CVE-2025-21778. The attack requires being on the local network. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. This issue affects some unknown processing of the component Hypercall Page Handler. Such manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2025-21779. The attack must be carried out from within the local network. There is no available exploit. The affected component should be upgraded.

A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. This affects the function usb_hub_to_struct_hub. Such manipulation leads to null pointer dereference. This vulnerability is traded as CVE-2025-21776. Access to the local network is required for this attack to succeed. There is no exploit available. The affected component should be upgraded.

A vulnerability classified as problematic has been found in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. This impacts the function ctucan_err_interrupt. The manipulation leads to allocation of resources. This vulnerability is traded as CVE-2025-21775. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.12.15/6.13.3/6.14-rc2. Affected is the function nr_subbufs of the component ring-buffer. The manipulation results in buffer overflow. This vulnerability is known as CVE-2025-21777. Access to the local network is required for this attack. No exploit is available. Upgrading the affected component is advised.

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.1.128/6.6.78/6.12.15/6.13.3/6.14-rc2. The affected element is the function put_dev_sector. Such manipulation leads to out-of-bounds read. This vulnerability is documented as CVE-2025-21772. The attack requires being on the local network. There is not any exploit available. The affected component should be upgraded.

A vulnerability marked as critical has been reported in Linux Kernel up to 6.6.78/6.12.15/6.13.3/6.14-rc2. The impacted element is an unknown function of the component etas_es58x. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2025-21773. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability described as critical has been identified in Linux Kernel up to 6.12.15/6.13.3/6.14-rc2. This affects the function rkcanfd_handle_rx_fifo_overflow_int. Executing a manipulation can lead to null pointer dereference. This vulnerability appears as CVE-2025-21774. The attacker needs to be present on the local network. There is no available exploit. Upgrading the affected component is recommended.