Aggregator

点击查看更多本周网络安全大事件。

很多人看战争，第一眼盯的是导弹、坦克、战斗机。这很正常，毕竟这些东西最显眼，最像"战争本身"。

Researcher: If Exploited, Bug Could Crash Hospital Medical Imaging Systems
The Cybersecurity Infrastructure and Security Agency is warning of a high severity in Grassroots DICOM, an open-source library commonly used for medical imaging products, that if exploited could allow an attacker to send a specially crafted file resulting in a denial-of-service situation.

Google's Accelerated PQC Timeline Demands Enterprise Action Now
Google set a public deadline for migrating to post-quantum cryptography, setting a strong signal for IT and security leaders that they too should transition their encryption into more robust algorithms. Enterprises need a migration strategy now before the window closes.

Federal Review Questions Whether Private Insurers Can Absorb Cyber Losses
A Department of the Treasury review of cyber risk under the Terrorism Risk Insurance Program comes amid concern that nation-state attacks and systemic cyber events may overwhelm private insurers, raising the prospect of a federal backstop to protect critical infrastructure and economic stability.

European Commission Publishes Draft Guidance for Cyber Resilience Act
Key implementation deadlines loom for one of Europe's most consequential cybersecurity laws and draft guidance from the European Union may help manufacturers comply - up to a point.

I’ve been watching my phone battery go to 37% lately and it’s giving me anxiety even though I know I can make it through the day. This is why I don’t think I’ll ever be able to live with an electric car. The Scanner That Scanned Itself Trivy, the widely used security scanner that’s been … Continue reading Breach of Confidence – 27 March 2026 →

The post Breach of Confidence – 27 March 2026 appeared first on Security Boulevard.

A vulnerability was found in locutusjs locutus up to 3.0.24. It has been classified as problematic. This affects an unknown function of the component Query Handler. The manipulation leads to improperly controlled modification of object prototype attributes. This vulnerability is referenced as CVE-2026-33994. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in locutusjs locutus up to 3.0.24. It has been classified as problematic. This affects an unknown function of the component Query Handler. The manipulation leads to improperly controlled modification of object prototype attributes. This vulnerability is referenced as CVE-2026-33994. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in mobile-next mobile-mcp up to 0.0.48 and classified as critical. The impacted element is the function mobile_save_screenshot/mobile_start_screen_recording of the component Fileystem Operation Handler. Executing a manipulation of the argument saveTo/output can lead to path traversal. The identification of this vulnerability is CVE-2026-33989. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in mobile-next mobile-mcp up to 0.0.48 and classified as critical. The impacted element is the function mobile_save_screenshot/mobile_start_screen_recording of the component Fileystem Operation Handler. Executing a manipulation of the argument saveTo/output can lead to path traversal. The identification of this vulnerability is CVE-2026-33989. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in dgtlmoon changedetection.io up to 0.54.6 and classified as problematic. The affected element is an unknown function of the component Environment Variable Handler. Performing a manipulation of the argument SALTED_PASS/PLAYWRIGHT_DRIVER_URL/HTTP_PROXY results in information disclosure. This vulnerability was named CVE-2026-33981. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability has been found in dgtlmoon changedetection.io up to 0.54.6 and classified as problematic. The affected element is an unknown function of the component Environment Variable Handler. Performing a manipulation of the argument SALTED_PASS/PLAYWRIGHT_DRIVER_URL/HTTP_PROXY results in information disclosure. This vulnerability was named CVE-2026-33981. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in benmcollins libjwt up to 3.2.x. Impacted is an unknown function of the component JWK Parser. Such manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2026-33996. The attack can only be initiated within the local network. No exploit exists. You should upgrade the affected component.

A vulnerability, which was classified as problematic, was found in benmcollins libjwt up to 3.2.x. Impacted is an unknown function of the component JWK Parser. Such manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2026-33996. The attack can only be initiated within the local network. No exploit exists. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in LabRedesCefetRJ WeGIA up to 3.6.6. This issue affects the function deletar_tag of the file html/socio/sistema/deletar_tag.php. This manipulation of the argument $_REQUEST causes sql injection. This vulnerability is handled as CVE-2026-33991. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in LabRedesCefetRJ WeGIA up to 3.6.6. This issue affects the function deletar_tag of the file html/socio/sistema/deletar_tag.php. This manipulation of the argument $_REQUEST causes sql injection. This vulnerability is handled as CVE-2026-33991. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in tlsfuzzer python-ecdsa up to 0.19.1. This vulnerability affects the function ECDSA.der.remove_octet_string. The manipulation results in denial of service. This vulnerability is known as CVE-2026-33936. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability classified as problematic was found in tlsfuzzer python-ecdsa up to 0.19.1. This vulnerability affects the function ECDSA.der.remove_octet_string. The manipulation results in denial of service. This vulnerability is known as CVE-2026-33936. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.