Aggregator

A vulnerability marked as critical has been reported in Treeverse lakeFS up to 1.83.0. The impacted element is an unknown function. This manipulation causes improper authentication. The identification of this vulnerability is CVE-2026-66006. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability labeled as critical has been found in ahujasid blender-mcp. The affected element is the function download_polyhaven_asset. The manipulation results in path traversal. This vulnerability was named CVE-2026-66004. The attack may be performed from remote. There is no available exploit. A patch should be applied to remediate this issue.

A vulnerability identified as problematic has been detected in Easy Appointments Plugin up to 3.12.27 on WordPress. Impacted is the function ea_delete_multiple_connections. The manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-8789. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as problematic has been discovered in janhq Jan up to 0.8.4. This issue affects some unknown processing of the component Local API Server. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. This vulnerability is handled as CVE-2026-66005. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.

印度政府的网络犯罪协调中心命令 GitHub 移除 Jack Dorsey 的去中心化蓝牙聊天应用 Bitchat。前 Twitter CEO Dorsey 在 X/Twitter 上公布了收到的通知，通知的日期是 7 月 23 日，声称该应用能在网络受限的情况下进行通信，能被反国家分子、恐怖组织、有组织犯罪集团和网络犯罪分子滥用，他们试图逃避合法监测，继续在法律限制下进行通信。印度最近爆发了被称为“蟑螂人民党（Cockroach Janta Party)”的抗议活动。

A vulnerability was found in Microsoft Azure App Service for Linux. It has been rated as critical. This vulnerability affects unknown code. Performing a manipulation results in improper access controls. This vulnerability is known as CVE-2026-58630. Remote exploitation of the attack is possible. No exploit is available. This product is a managed service, indicating that users are not permitted to maintain vulnerability countermeasures themselves.

A vulnerability was found in Microsoft Purview Data Governance. It has been declared as critical. This affects an unknown part. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-57106. The attack may be launched remotely. There is no exploit available. This product is provided as a managed service, meaning users do not have the ability to maintain vulnerability countermeasures themselves.

A vulnerability was found in Devolutions PowerShell Universal up to 2026.2.2. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Variables Feature. This manipulation causes cleartext storage of sensitive information. This vulnerability appears as CVE-2026-16802. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

AI×Cybersecurity Challenge人工智能网络安全挑战赛线上初赛部分web题wp

A vulnerability was found in Image::WebP up to 0.2 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation results in insufficient isolation of system-dependent functions. This vulnerability is reported as CVE-2026-58586. The attack can be launched remotely. No exploit exists.

A vulnerability has been found in Devolutions PowerShell Universal up to 2026.2.2 and classified as very critical. Affected is an unknown function of the file variables configuration file of the component Variables Feature. The manipulation of the argument variable value leads to code injection. This vulnerability is documented as CVE-2026-16801. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

逛网页时突然弹出知名交易平台送免费会员，加密货币平台发新人奖励的广告，点进去是和官网几乎一模一样的页面，你以为

之前那篇关于SSTI的文章有朋友说无法复现，今天我重新手动复现一遍后发现了原因，也进行了进一步优化。同时非常感谢各位白帽朋友指出我的缺点，后面我也会仔细审核，确保能够给各位带来更有价值的文章。

前言ezfastjson是我接触的第一个java题，断断续续也是研究了很长时间，本文将会详细介绍java题的操作流程供新手参考，毕竟有关java安全的问题难度高题量大而且入门资料很少。环境准备：JDK8，IDEA，jd-gui信息收集首先附件是一个jar文件，我们用jd-gui工具对jar包进行反编译我们重点关注控制器部分和依赖部分，先看Unser类这里有反序列化的入口，我们再去看一下依赖，结合题

因为护网要开始了，重新分析了一遍哥斯拉的整个通信原理和对消息加解密进行了分析，以及一些常见的特征。

详细总结了多种模板引擎

最近笔者分析到一个名单类型的银狐，标题关键字是裁员补贴，依旧高活跃度，分析过程中发现这个样本中的代码混淆是有强有弱，同一天的样本可能会用多种混淆方式，本文会分享复原的思路

AI编码工具中指令文件的隐式信任链攻击面分析

大模型时代，AI Agent正在重塑自动化测试的边界。从单纯的聊天框到能够模拟人类操作的智能体，像strix、pentestgpt这样的工具正在让模拟人的全自动测试成为现实。当下，公司内部应用安全团队越来越多地部署**AI 驱动的安全扫描器**——利用大语言模型（LLM）来自动化扫描 Web 应用中的漏洞。确实提升了安全测试的效率，但同时也引入了一个新的攻击面：当AI 驱动的安全扫描器本身成为攻击

MCP 未授权接口可被跨站请求触发工具调用，文章结合两个 CVE 分析成因与防御。