Aggregator

2026年度备受瞩目的网络安全国家赛事——“湾区杯”网络安全大赛，报名通道现已全面开放！无论你是网安从业者、

A vulnerability classified as problematic was found in Passeum Ticketing Plugin up to 1.0 on WordPress. The affected element is the function get_shop_url of the component Setting Handler. The manipulation of the argument shop_name results in cross site scripting. This vulnerability was named CVE-2026-7421. The attack may be performed from remote. There is no available exploit.

A vulnerability described as problematic has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. This vulnerability is registered as CVE-2026-10692. It is possible to launch the attack remotely. Furthermore, an exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. This vulnerability is cataloged as CVE-2026-10691. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. This vulnerability is listed as CVE-2026-10690. The attack may be performed from remote. In addition, an exploit is available. It is best practice to apply a patch to resolve this issue.

June 5, 2026Thank you t

Cybercriminals have devised an insidious method to infiltrate macOS environments. Specifically, they disguise malicious payloads within seemingly innocuous applications. Beneath the elegant aesthetics of podcast players and PDF readers lies a dual-threat mechanism. Consequently,...

The post Operation FlutterBridge: Sophisticated Malware Masquerades as Legitimate macOS Utilities appeared first on Information Security News.

魏哲家：台积电目前不存在失去竞争优势的风险台积电CEO表示，该公司在下一代芯片制造领域并未落后。此举驳斥了外界疑虑。外界此前担心，竞争对手已采用极昂贵设备制造尖端芯片，使台积电处于劣势。在年度股东大会

阅读： 0日前，针对Mythos Preview模型的最新公开研究表明，该模型不仅能独立发现漏洞，更能将多个低危漏洞串联成完整的攻击链，形成更为严重漏洞利用链，并自

June 5, 2026Interoperab

A fork of the original HexStrike AI project has been released as HexStrike AI v6.0, an advanced Model Context Protocol (MCP)-based cybersecurity automation framework that merges 127 professional security tools with BOAZ, a multi-layered, EDR/AV payload evasion engine built for real-world red team operations The platform enables Claude, GPT, VS Code Copilot, Cursor, and any MCP-compatible […]

The post HexStrike AI RED-TEAM With 127 Security Tools and BOAZ Red Team Integration appeared first on Cyber Security News.

Balancing Compute with Conservation In response to intense public backlash over data center resource consumption, Google expanded its water stewardship commitments. Consequently, the enterprise aims to achieve a net water-positive status by 2030. This...

The post The Aqua Nexus: Google Expands Water Stewardship Pledges Amid AI Expansion appeared first on Information Security News.

A vulnerability has been found in Apple Safari up to 15.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the component WebKit. The manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2022-32886. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability was found in Apple iOS and iPadOS up to 15.6.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component WebKit. The manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2022-32886. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in webkit2gtk. The impacted element is an unknown function. Such manipulation leads to Remote Code Execution. This vulnerability is listed as CVE-2022-32885. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in Microsoft Copilot Chat. It has been classified as critical. This vulnerability affects unknown code of the component Downstream. Performing a manipulation results in injection. This vulnerability is known as CVE-2026-47644. Remote exploitation of the attack is possible. No exploit is available. This product is a managed service, indicating that users are not permitted to maintain vulnerability countermeasures themselves.