Aggregator

A vulnerability identified as critical has been detected in Adobe ColdFusion 2023/2025. Affected is an unknown function. Performing a manipulation results in improper input validation. This vulnerability is cataloged as CVE-2026-48284. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability marked as critical has been reported in Adobe ColdFusion 2023/2025. Affected by this issue is some unknown functionality. The manipulation leads to code injection. This vulnerability is documented as CVE-2026-48322. The attack can be initiated remotely. There is not any exploit available.

A vulnerability has been found in Adobe ColdFusion and classified as critical. Impacted is an unknown function. The manipulation leads to missing authentication. This vulnerability is traded as CVE-2026-48325. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as problematic has been found in Red Hat OpenShift GitOps. This affects an unknown function of the component ClusterRole Reconciler. The manipulation of the argument Name results in denial of service. This vulnerability is known as CVE-2026-14251. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as problematic has been reported in Grafana MCP Server up to 0.17.1. This impacts an unknown function of the component URL Handler. This manipulation of the argument X-Grafana-URL causes server-side request forgery. This vulnerability is handled as CVE-2026-15583. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as critical has been identified in MetaGuru HCM up to 7.5.2. Affected is an unknown function. Such manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2026-15804. The attack can be launched remotely. No exploit exists.

4个实景验证降噪效果与研判准确性

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances. [...]

Регулятор eSafety обвинил крупнейшие платформы в неэффективной борьбе с секс-шантажом.

APT-C-26（Lazarus）是高危活跃 APT 组织，针对金融、政企、军工、航空航天等行业攻击，以牟利和窃取机密为目的，攻击手段多样、可跨系统运作，隐蔽性极强。其定制远程监控程序，近期新增键盘记录组件。

A vulnerability, which was classified as problematic, has been found in weeblr 4Analytics Plugin up to 5.0.1. This affects an unknown part of the component AI Analysis Feature. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-57833. Remote exploitation of the attack is possible. No exploit is available.

讲师阵容夯爆了！报名从速！！

A vulnerability was found in Citrix Secure Access Client for Windows and Endpoint Analysis Client for Windows. It has been classified as problematic. This impacts an unknown function. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2026-53565. An attack has to be approached locally. There is no exploit available.

A vulnerability labeled as problematic has been found in Citrix Secure Access Client for Windows 26.5.1.7. This vulnerability affects unknown code. Executing a manipulation can lead to out-of-bounds read. The identification of this vulnerability is CVE-2026-53566. The attack can only be executed locally. There is no exploit available.

A vulnerability labeled as critical has been found in Rockwell Automation CompactLogix 5380 Recovery Image Compact GuardLogix 5380 Recovery Image CompactLogix 5480 Recovery Image ControlLogix 5580 Recovery Image GuardLogix 5580 Recovery Image 1.072. Affected is an unknown function. Executing a manipulation can lead to buffer overflow. This vulnerability appears as CVE-2025-11698. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 152.0.5. Impacted is an unknown function. This manipulation causes Remote Code Execution. This vulnerability is registered as CVE-2026-15719. Remote exploitation of the attack is possible. No exploit is available.

2026年5月OSRC奖励公告

Salesforce；MemGhost向AI代理植入虚假记忆；埃森哲35GB数据遭窃；NCSC警告勒索软件应急准备成董事会要务。

这款木马偷走的不是几个孤立的密码或文件，而是用户在一台 Mac 上逐渐建立起来的整套本地信任关系。

LYSRC感谢大家在端午活动中倾注的热情与专业，每一份漏洞报告都是大家对lysrc安全生态最坚