Aggregator

分享一篇文章。

2026年7月15日（北京时间），微软发布了2026年7月安全更新，共发布了622个CVE的补丁程序，比上月增多了418个。

A vulnerability has been found in Apache Fineract up to 1.14.0 and classified as critical. This issue affects some unknown processing of the component Report Execution API. This manipulation causes sql injection. This vulnerability is tracked as CVE-2026-35152. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as critical, was found in Apache Fineract up to 1.14.0. This vulnerability affects unknown code of the file /api/v1/clients of the component Client Search API. The manipulation of the argument orderBy/sortOrder results in sql injection. This vulnerability is identified as CVE-2026-56287. The attack can be executed remotely. There is not any exploit available.

暑期来临，孩子上网成了很多家长的挂心事。网络已经成为未成年人学习、娱乐、社交的重要空间，有关部门不断加强未成年人网络保护，但与此同时，个别新问题出现，隐蔽性、迷惑性、危害性更强，成为未成年人网络保护的新痛点。

如有意见或建议请于2026年9月13日24:00前反馈

近日，国家数据局正式印发《数据产权登记工作指引（试行）》，对健全数据基础制度具有引领性的制度意义、立标定规的实践意义，为我国数据产权登记工作提供了制度遵循和操作指南。

数字丝绸之路的“路基”安全防护是“一带一路”倡议数字化延伸的基础保障。针对日益隐蔽且复杂的跨境网络安全挑战，本文提出构建一个由“数据采集、安全合规、智能分析”组成的安全动态检测评估体系框架。该框架依托于人工智能……

2026年7月15日，绿盟科技成功举办AI安全创新成果发布会，正式发布新一代智能渗透系统 AI-PTS 2.0。本次新品围绕任务规划、资产（Web）测绘、漏洞分析、攻击验证与报告生成等核心环节，构建端到端自主化渗透测试闭环。

A vulnerability was found in WP Attachments Plugin up to 5.0.4 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Setting Handler. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2022-3469. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in puppyCMS up to 5.1. This issue affects some unknown processing of the file /admin/settings.php. Such manipulation of the argument site_name leads to cross site scripting. This vulnerability is listed as CVE-2022-3464. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability classified as critical has been found in Mediabridge Medialink. Impacted is an unknown function of the file /index.asp. Performing a manipulation results in improper authentication. This vulnerability is cataloged as CVE-2022-3465. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to use restrictive firewalling.

A vulnerability categorized as critical has been discovered in Jiusi OA. This vulnerability affects unknown code of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid results in sql injection. This vulnerability was named CVE-2022-3467. The attack needs to be approached within the local network. In addition, an exploit is available.

A vulnerability marked as critical has been reported in Contact Form Plugin up to 4.3.12 on WordPress. This impacts an unknown function. The manipulation leads to csv injection. This vulnerability is referenced as CVE-2022-3463. The attack needs to be initiated within the local network. No exploit is available. It is suggested to upgrade the affected component.

Одна строка текста теперь обезвреживает автономного ИИ-взломщика.

11 malicious NuGet packages masquerading as game cheats, automation bots, and management “panels” that deploy a Windows payload called pepesoft.exe. The packages were published as .NET command-line tools, enabling users to install them through the dotnet tool install workflow and execute bundled commands such as throne-run. The affected packages target communities around Albion Online, GTA5RP, […]

The post 11 Malicious NuGet Game Cheat Packages Deploy Pepesoft Windows Surveillance Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability classified as problematic has been found in FasterXML jackson-databind up to 2.18.8/2.21.4/3.1.3. Affected by this issue is the function BeanDeserializerBase.createContextual. This manipulation causes dynamically-determined object attributes. The identification of this vulnerability is CVE-2026-54515. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in FasterXML jackson-databind up to 2.21.3/3.1.3. This affects the function POJOPropertiesCollector._renameProperties. Such manipulation of the argument backing leads to dynamically-determined object attributes. This vulnerability is referenced as CVE-2026-54516. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in FasterXML jackson-databind up to 2.21.3/3.1.3. This vulnerability affects the function SetterlessProperty.isMerging. Performing a manipulation results in incorrect authorization. This vulnerability is identified as CVE-2026-54517. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in FasterXML jackson-databind up to 2.21.3/3.1.3. It has been declared as critical. Impacted is the function UnwrappedPropertyHandler.processUnwrappedCreatorProperties. The manipulation results in incorrect authorization. This vulnerability is reported as CVE-2026-54518. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.