Aggregator

A vulnerability categorized as critical has been discovered in textract up to 2.5.0. This impacts the function child_process.exec in the library lib/extractors/doc.js of the file child_process.exec. Such manipulation of the argument filepath leads to os command injection. This vulnerability is documented as CVE-2026-26831. The attack requires being on the local network. There is not any exploit available.

A vulnerability labeled as critical has been found in node-tesseract-ocr up to 2.2.1. Affected by this vulnerability is the function recognize of the file src/index.js. Executing a manipulation can lead to os command injection. This vulnerability appears as CVE-2026-26832. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as critical has been reported in thumbler up to 1.1.2. Affected by this issue is the function thumbnail. The manipulation of the argument size leads to os command injection. This vulnerability is traded as CVE-2026-26833. Access to the local network is required for this attack to succeed. There is no exploit available.

CareCloud: Intruder Accessed Systems for 8 Hours, Still Assessing Extent of Breach
Electronic health records vendor CareCloud has notified the U.S. Securities and Exchange Commission of a cyber incident earlier this month that temporarily disrupted the software and accessed one of its EHR environments. The company is assessing whether patient data was accessed or stolen.

Officials Aim to Head Off Calls for New Cyber Force Using Existing CyberCom Powers
For the private sector, the cyber talent gap is an HR issue. But for the U.S. military, it's a looming strategic crisis, the Pentagon's top cyber official said this week. "We cannot afford to continue this way," said Assistant Secretary of War for Cyber Policy Katherine Sutton.

Experts Cite Prepositioning Risk in Iranian Cyber Operations Amid Escalating War
Warnings from Iranian-linked hacking groups targeting U.S. water systems highlight a growing risk of prepositioned cyber access and rapid attack activation, analysts told ISMG, as federal defenders confront rising geopolitical tensions and operational strain across critical infrastructure sectors.

CEO Danny Brickman on Intent-Based Access and Non-Human Identity Governance
Oasis Security has raised $120 million in a Series B round to expand its identity platform focused on non-human identities and AI agents. CEO Danny Brickman says enterprises need intent-based access controls and automated governance to securely scale agentic adoption.

A supply chain attack hit Axios when attackers used stolen npm credentials to publish malicious versions containing a phantom dependency. This triggered a cross-platform RAT during installation and replaced its files with clean decoys, making detection challenging.

This blog looks at how AI‑driven vibecoding speeds up software development while increasing security risk by outpacing traditional review and ownership. It explains why security needs to move earlier and be built into modern development workflows.

TrendAI™ Research explored agentic AI cybercrime and EV infrastructure security through two research sessions at RSAC 2026.

好，我现在需要帮用户总结一篇文章，控制在100字以内。用户的要求很明确，不需要以“文章内容总结”或“这篇文章”开头，直接写描述即可。 首先，我得通读整篇文章，抓住主要内容。文章看起来是关于一个奥地利的黑客活动，叫做Håck ma’s Castle。时间在2026年8月27日至30日，地点是Schloss Ottenschlag。活动包括露营、住宿、演讲、工作坊和派对。还有门票信息和志愿者机会。 接下来，我需要将这些信息浓缩到100字以内。要涵盖活动名称、组织者、时间地点、主要活动内容以及参与方式。同时要确保语言简洁明了，不使用复杂的词汇。 可能的结构是：活动名称+组织者+时间地点+主要活动+参与方式。这样既全面又简洁。 现在开始组织语言：奥地利混沌社区举办Håck ma’s Castle活动，2026年8月27日至30日在Schloss Ottenschlag。活动包括露营、住宿、演讲、工作坊和派对，并有志愿者机会。 检查字数是否在限制内，并确保没有遗漏关键信息。 奥地利混沌社区举办Håck ma’s Castle活动，2026年8月27日至30日在Schloss Ottenschlag举行。活动包括露营、住宿、演讲、工作坊和派对，并提供志愿者机会。

威努特成功案例已覆盖政企、医疗、制造、煤炭等关键行业。

Kernel-level visibility reveals hidden data movement in breaches, exposing gaps in modern security tools and improving detection, compliance, and system behavior tracking.

A vulnerability described as critical has been identified in Login Disable up to 2.1.2 on Drupal. The impacted element is an unknown function. Such manipulation leads to authentication bypass using alternate channel. This vulnerability is uniquely identified as CVE-2026-1917. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability labeled as problematic has been found in Cisco IOS XE. This affects an unknown function of the component DHCP Snooping. Such manipulation leads to resource consumption. This vulnerability is traded as CVE-2026-20084. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability marked as critical has been reported in Cisco IOS XE up to 17.18.1. This impacts an unknown function of the component CAPWAP. Performing a manipulation results in improper handling of missing values. This vulnerability is known as CVE-2026-20086. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability described as problematic has been identified in Cisco IOS XE. Affected is an unknown function of the component Application Hosting Environment Management Interface. Executing a manipulation can lead to crlf injection. This vulnerability is handled as CVE-2026-20113. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, was found in Cisco IOS XE. This vulnerability affects unknown code of the component Extensible Authentication Protocol. Such manipulation leads to missing reference to active allocated resource. This vulnerability is referenced as CVE-2026-20004. The attack needs to be initiated within the local network. No exploit is available. You should upgrade the affected component.

A vulnerability has been found in Cisco IOS XE and classified as problematic. This issue affects some unknown processing of the component CLI. Performing a manipulation results in incorrect privilege assignment. This vulnerability is identified as CVE-2026-20110. The attack is only possible with local access. There is not any exploit available. The affected component should be upgraded.

A vulnerability was found in Cisco IOS XE and classified as problematic. Impacted is an unknown function of the component Secure Copy Protocol. Executing a manipulation can lead to improper handling of extra parameters. This vulnerability is tracked as CVE-2026-20083. The attack is restricted to local execution. No exploit exists. It is suggested to upgrade the affected component.