Aggregator

Currently trending CVE - Hype Score: 10 - RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a ...

Currently trending CVE - Hype Score: 4 - Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Государство натренировало хакеров и искренне удивилось когда они ограбили Центробанк.

卷完参数之后，硬件开始卖「愧疚感」了。

AFX Trade лишилась почти всех заблокированных в ней активов после атаки на мост.

Name: DIVER OSINT CTF 2026 (an DIVER OSINT CTF event.)
Date: July 25, 2026, 3:10 a.m. — 26 July 2026, 03:10 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://ctfd.diverctf.org/
Rating weight: 0.00
Event organizers: diver_osint

Новое оборудование поможет создавать чиплеты, фотонные компоненты, квантовые устройства и сложные многокристальные системы.

A vulnerability, which was classified as critical, has been found in techjewel Fluent Forms Pro Add On Pack Plugin up to 6.2.6 on WordPress. This issue affects some unknown processing. The manipulation leads to deserialization. This vulnerability is documented as CVE-2026-15962. The attack can be initiated remotely. There is not any exploit available.

  逛各大电商平台这么多年，今天才发现，居然还有88VIP专属助手返利机器人这种购物省钱神器！我不

马斯克：SpaceX 将在下一次飞行中尝试用发射塔捕获星舰；Verizon 与 Google 达成逾 10 亿美元合作；Waymo 与 Uber 合作关系生变

Steam discussion forums are being abused in ClickFix attacks that pretend to be fixes for game and computer problems but actually infect devices with cryptominers. [...]

US agencies warn Iran-linked actors are targeting internet-exposed water and energy control systems, risking disruption. Federal agencies updated their cybersecurity advisory this week: Iran-linked actors are inside American water and energy control systems, and they’re not just looking around. They’re changing things. The updated advisory from CISA, the FBI, NSA, and the Department of Energy […]

A vulnerability classified as critical was found in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. This vulnerability is registered as CVE-2026-17459. It is possible to launch the attack remotely. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #862468 / VDB-383321

A vulnerability classified as critical has been found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. This vulnerability is cataloged as CVE-2026-17458. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability described as problematic has been identified in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. This vulnerability is listed as CVE-2026-17457. The attack may be performed from remote. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #862453 / VDB-383320

Submit #862452 / VDB-383319