上海交通大学 | 贤者之石：大型语言模型的插件木马攻击
本文首次系统提出并验证了 Trojan Adapter 攻击威胁。
Aggregator
CVE-2025-66319 | Huawei HarmonyOS 5.1.0/6.0.0 Resource Scheduling access control
3 months 3 weeks ago
A vulnerability, which was classified as critical, has been found in Huawei HarmonyOS 5.1.0/6.0.0. This affects an unknown part of the component Resource Scheduling Module. The manipulation leads to improper access controls.
This vulnerability is referenced as CVE-2025-66319. The attack can only be performed from a local environment. No exploit is available.
vuldb.com
CVE-2026-21628 | astroidframe.work Astroid Template Framework 2.0.0-3.3.10 unrestricted upload
3 months 3 weeks ago
A vulnerability classified as critical was found in astroidframe.work Astroid Template Framework 2.0.0-3.3.10. Affected by this issue is some unknown functionality. Executing a manipulation can lead to unrestricted upload.
The identification of this vulnerability is CVE-2026-21628. The attack may be launched remotely. There is no exploit available.
vuldb.com
CVE-2026-3236 | Octopus Deploy Octopus Server up to 2025.3.14760/2025.4.10408 New API Key authorization (EUVD-2026-9817 / WID-SEC-2026-0613)
3 months 3 weeks ago
A vulnerability classified as critical has been found in Octopus Deploy Octopus Server up to 2025.3.14760/2025.4.10408. Affected by this vulnerability is an unknown functionality of the component New API Key Handler. Performing a manipulation results in incorrect authorization.
This vulnerability was named CVE-2026-3236. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
vuldb.com
CVE-2026-1605 | Eclipse Jetty up to 12.0.31/12.1.5 HTTP Request resource consumption (GHSA-xxh7-fcf3-rj7f / EUVD-2026-9815)
3 months 3 weeks ago
A vulnerability described as problematic has been identified in Eclipse Jetty up to 12.0.31/12.1.5. Affected is an unknown function of the component HTTP Request Handler. Such manipulation leads to resource consumption.
This vulnerability is uniquely identified as CVE-2026-1605. The attack can be launched remotely. No exploit exists.
vuldb.com
CVE-2025-11143 | Eclipse Jetty up to 9.4.58/10.0.26/11.0.26/12.0.30/12.1.4 URI Parser input validation (GHSA-wjpw-4j6x-6rwh)
3 months 3 weeks ago
A vulnerability marked as problematic has been reported in Eclipse Jetty up to 9.4.58/10.0.26/11.0.26/12.0.30/12.1.4. This impacts an unknown function of the component URI Parser. This manipulation causes improper input validation.
This vulnerability is handled as CVE-2025-11143. The attack can be initiated remotely. There is not any exploit available.
vuldb.com
OpenText security advisory (AV26-199)
3 months 3 weeks ago
Canadian Centre for Cyber Security
DeepAudit源码深度解析
3 months 3 weeks ago
对DeepAudit的架构以及实现进行了分析
CVE-2025-59059
3 months 3 weeks ago
Currently trending CVE - Hype Score: 1 - Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
CVE-2025-54136
3 months 3 weeks ago
Currently trending CVE - Hype Score: 8 - Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's ...
Видишь сбой? А его нет. РКН объяснил, почему сервис Detector404.ru — это «вброс»
3 months 3 weeks ago
РКН назвал популярный сервис мониторинга сбоев источником фейков.
CoinBase Cartel
3 months 3 weeks ago
You must login to view this content
cohenido
Authorities Shut Down Tycoon 2FA Phishing Platform Used to Bypass MFA
3 months 3 weeks ago
Europol and partners dismantle Tycoon 2FA phishing service used to bypass MFA, disrupting a global phishing-as-a-service operation targeting organisations.
Waqas
Police dismantle major phishing platform blamed for attacks on hospitals and schools
3 months 3 weeks ago
International law enforcement agencies have dismantled a major phishing-as-a-service platform used to target hundreds of thousands of accounts worldwide, including those tied to hospitals and schools, Europol said Wednesday.
Pear
3 months 3 weeks ago
You must login to view this content
cohenido
That attractive online ad might be a malware trap
3 months 3 weeks ago
Malware increasingly travels through the infrastructure that delivers online advertising. The Media Trust’s Global Report on Digital Trust, Ad Integrity, and the Protection of People describes a digital ad ecosystem where scam campaigns, malicious redirects, and malware delivery appear alongside marketing traffic. The financial impact of these threats continues to grow. Estimated consumer and business losses in the United States tied to malware, scams, and ad-borne fraud exceeded $12.5 billion in 2025. Exposure also remains … More →
The post That attractive online ad might be a malware trap appeared first on Help Net Security.
Anamarija Pogorelec
Police dismantles online gambling ring exploiting Ukrainian women
3 months 3 weeks ago
Spanish and Ukrainian law enforcement authorities dismantled a criminal ring that exploited war-displaced Ukrainian women to run an online gambling scheme that laundered nearly €4.75 million in illicit proceeds. [...]
Sergiu Gatlan
Старые шахты — мусор? Энергетики с вами поспорят. Они переделывают катакомбы в исполинские водяные аккумуляторы
3 months 3 weeks ago
Токсичная вода старых рудников больше не пугает экологов и начинает крутить подземные турбины.
LilacCTF2026 Writeup
3 months 3 weeks ago
本届 LilacCTF 2026由XCTF联赛的合作单位哈尔滨工业大学 Lilac 战队组织，由赛宁网安提供技术支持。作为第十届XCTF国际联赛的分站赛，本次比赛将采用在线网络安全夺旗挑战赛的形式，面向全球开放
Coruna Exploit Kit Targets Older iPhones in Multi-Stage Campaigns
3 months 3 weeks ago
Exploit kit "Coruna" targets iPhones running iOS 13.0 to 17.2.1, focusing on financial data theft