Aggregator

A vulnerability described as critical has been identified in Apache Doris up to 3.0.x. This issue affects some unknown processing of the component Frontend HTTP API. Executing a manipulation can lead to improper authentication. This vulnerability is registered as CVE-2026-58319. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

弗林效应（Flynn Effect）预测人类的 IQ 得分呈上升趋势，每十年增加 3 到 5 分。但最近几年的研究发现，弗林效应出现了逆转，IQ 得分不增反降。根据发表在 PNAS 期刊上的一项研究，挪威研究人员调查了 579,379 名挪威男性，观察弗林效应及其逆转是否因社会经济地位而异，以及教育水平是否可解释差异。研究人员发现，弗林效应逆转首先出现在高收入家庭的男性后代中，中低收入家庭的认知峰值较晚，且峰值后的下降幅度较小。研究结果表明，认知能力得分存在一种潜在的群体层面下降趋势。低收入群体教育水平的提升短暂抵消了下降趋势，但教育水平趋稳后各个群体的认知能力得分均出现下降，其中高收入群体的下降幅度最为显著。

弗林效应（Flynn Effect）预测人类的 IQ 得分呈上升趋势，每十年增加 3 到 5 分。但最近几年的研究发现，弗林效应出现了逆转，IQ 得分不增反降。根据发表在 PNAS 期刊上

A vulnerability marked as critical has been reported in Nice Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. This vulnerability is cataloged as CVE-2026-15703. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Submit #856152 / VDB-378250

A vulnerability labeled as critical has been found in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipulation leads to improperly controlled modification of object prototype attributes. This vulnerability is listed as CVE-2026-15702. The attack may be performed from remote. In addition, an exploit is available. The affected component should be upgraded.

Пугающе живучий вредонос практически невозможно удалить со смартфона.

A vulnerability identified as critical has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. This vulnerability is tracked as CVE-2026-15701. The attack is possible to be carried out remotely. Moreover, an exploit is present.

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

一颗卫星经过的时候，普通人看见的是一张照片。情报分析师看见的，是一段尚未被人知道的历史。

Smart home security research runs on a scarce ingredient: recordings of how real people use the gadgets in their homes. Getting that data means wiring up someone’s house and watching for months, which is slow, costly, and about as invasive as it sounds. So the datasets stay small and cover a thin slice of how people live. The smart home testbed used by the researchers A group from Leipzig University and ipoque, a Rohde & … More →

The post Fake smart home residents could stand in for real ones in security research appeared first on Help Net Security.

Submit #856138 / VDB-378249

A vulnerability categorized as critical has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. This vulnerability is identified as CVE-2026-15700. The attack can be executed remotely. Additionally, an exploit exists.

Submit #856136 / VDB-378248

seek 是 DeepSeek-first 的本地终端 Agent，通过间接提示词注入可能导致写入WebShell、任意文件读取等危害

Submit #856135 / VDB-378247

Submit #856134 / VDB-369787

A vulnerability described as problematic has been identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of the component Shared Client Library. Such manipulation of the argument Server_NamespaceArray leads to null pointer dereference. This vulnerability is documented as CVE-2026-15690. The attack can be executed remotely. Additionally, an exploit exists. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

A vulnerability was found in spencermountain compromise up to 14.15.1. It has been rated as critical. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. This vulnerability is referenced as CVE-2026-15699. Remote exploitation of the attack is possible. Furthermore, an exploit is available. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.