Aggregator

A vulnerability marked as critical has been reported in Contact Form Plugin up to 4.3.12 on WordPress. This impacts an unknown function. The manipulation leads to csv injection. This vulnerability is referenced as CVE-2022-3463. The attack needs to be initiated within the local network. No exploit is available. It is suggested to upgrade the affected component.

Одна строка текста теперь обезвреживает автономного ИИ-взломщика.

11 malicious NuGet packages masquerading as game cheats, automation bots, and management “panels” that deploy a Windows payload called pepesoft.exe. The packages were published as .NET command-line tools, enabling users to install them through the dotnet tool install workflow and execute bundled commands such as throne-run. The affected packages target communities around Albion Online, GTA5RP, […]

The post 11 Malicious NuGet Game Cheat Packages Deploy Pepesoft Windows Surveillance Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability classified as problematic has been found in FasterXML jackson-databind up to 2.18.8/2.21.4/3.1.3. Affected by this issue is the function BeanDeserializerBase.createContextual. This manipulation causes dynamically-determined object attributes. The identification of this vulnerability is CVE-2026-54515. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in FasterXML jackson-databind up to 2.21.3/3.1.3. This affects the function POJOPropertiesCollector._renameProperties. Such manipulation of the argument backing leads to dynamically-determined object attributes. This vulnerability is referenced as CVE-2026-54516. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in FasterXML jackson-databind up to 2.21.3/3.1.3. This vulnerability affects the function SetterlessProperty.isMerging. Performing a manipulation results in incorrect authorization. This vulnerability is identified as CVE-2026-54517. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in FasterXML jackson-databind up to 2.21.3/3.1.3. It has been declared as critical. Impacted is the function UnwrappedPropertyHandler.processUnwrappedCreatorProperties. The manipulation results in incorrect authorization. This vulnerability is reported as CVE-2026-54518. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

原理拆解+实战落地+AI赋能

微软7月补丁破纪录修复622个漏洞，两个0Day正被积极利用。

看雪论坛作者ID：一只鸭子

纽约州成为美国第一个暂停建造大型数据中心的州。这一禁令适用于用电量 50 MW 或更高的数据中心。随着美国民众越来越担心污染风险、能源成本上涨和水资源短缺，美国各地要求停建数据中心的呼声日益高涨。佛蒙特州参议员 Bernie Sanders 和纽约州民主党众议员 Alexandria Ocasio-Cortez 已提出立法，寻求在全国范围内禁止数据中心建设。但特朗普政府不支持此类禁令。

A vulnerability labeled as problematic has been found in Adobe ColdFusion 2023/2025. Affected by this vulnerability is an unknown functionality of the component Pathname Handler. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-48318. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as critical has been detected in Adobe ColdFusion 2023/2025. Affected is an unknown function. Performing a manipulation results in improper input validation. This vulnerability is cataloged as CVE-2026-48284. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability marked as critical has been reported in Adobe ColdFusion 2023/2025. Affected by this issue is some unknown functionality. The manipulation leads to code injection. This vulnerability is documented as CVE-2026-48322. The attack can be initiated remotely. There is not any exploit available.

A vulnerability has been found in Adobe ColdFusion and classified as critical. Impacted is an unknown function. The manipulation leads to missing authentication. This vulnerability is traded as CVE-2026-48325. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as problematic has been found in Red Hat OpenShift GitOps. This affects an unknown function of the component ClusterRole Reconciler. The manipulation of the argument Name results in denial of service. This vulnerability is known as CVE-2026-14251. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as problematic has been reported in Grafana MCP Server up to 0.17.1. This impacts an unknown function of the component URL Handler. This manipulation of the argument X-Grafana-URL causes server-side request forgery. This vulnerability is handled as CVE-2026-15583. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as critical has been identified in MetaGuru HCM up to 7.5.2. Affected is an unknown function. Such manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2026-15804. The attack can be launched remotely. No exploit exists.

4个实景验证降噪效果与研判准确性