Aggregator

关键词美的一、60秒看完全部要点🔴 用户爆料：美的洗衣机联网19小时40分，产生411.52MB流量😰 网

Submit #919190 / VDB-403270

Submit #919189 / VDB-403269

Submit #919185 / VDB-403268

A vulnerability labeled as problematic has been found in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. This vulnerability is identified as CVE-2026-90713. The attack is only possible with local access. Additionally, an exploit exists. The pull request to fix this issue awaits acceptance.

A vulnerability identified as problematic has been detected in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. This vulnerability is referenced as CVE-2026-90712. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #918762 / VDB-403267

Submit #918715 / VDB-403266

Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for ransomware attacks. Oleksii Oleksiyovych Lytvynenko had, by most accounts, a fairly ordinary legal career in Ukraine before he switched to writing malware. A US federal court sentenced the 44-year-old to four years in prison this week for conspiracy […]

Как забытые токены в истории коммитов, слепые слои контейнеров и избыточные роли ломают периметр еще до первого запуска.

A vulnerability categorized as critical has been discovered in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-90710. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

Currently trending CVE - Hype Score: 2 - A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Currently trending CVE - Hype Score: 2 - Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Currently trending CVE - Hype Score: 1 - RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet ...

Currently trending CVE - Hype Score: 1 - A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 ...

Currently trending CVE - Hype Score: 1 - RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to ...

Submit #918522 / VDB-403265

Алгоритм одновременно выращивает мышцу и проектирует скелет.