Aggregator

There are more reports than ever before of strong-arm tactics like home invasions and kidnappings against cryptocurrency holders, researchers say.

A vulnerability described as problematic has been identified in Hugging Face Datasets up to 5.0.0. This affects an unknown function of the component Folder-based Dataset Builders. Such manipulation of the argument file_name leads to path traversal. This vulnerability is referenced as CVE-2026-66007. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

A vulnerability marked as critical has been reported in Treeverse lakeFS up to 1.83.0. The impacted element is an unknown function. This manipulation causes improper authentication. The identification of this vulnerability is CVE-2026-66006. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability labeled as critical has been found in ahujasid blender-mcp. The affected element is the function download_polyhaven_asset. The manipulation results in path traversal. This vulnerability was named CVE-2026-66004. The attack may be performed from remote. There is no available exploit. A patch should be applied to remediate this issue.

A vulnerability identified as problematic has been detected in Easy Appointments Plugin up to 3.12.27 on WordPress. Impacted is the function ea_delete_multiple_connections. The manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-8789. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as problematic has been discovered in janhq Jan up to 0.8.4. This issue affects some unknown processing of the component Local API Server. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. This vulnerability is handled as CVE-2026-66005. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.

印度政府的网络犯罪协调中心命令 GitHub 移除 Jack Dorsey 的去中心化蓝牙聊天应用 Bitchat。前 Twitter CEO Dorsey 在 X/Twitter 上公布了收到的通知，通知的日期是 7 月 23 日，声称该应用能在网络受限的情况下进行通信，能被反国家分子、恐怖组织、有组织犯罪集团和网络犯罪分子滥用，他们试图逃避合法监测，继续在法律限制下进行通信。印度最近爆发了被称为“蟑螂人民党（Cockroach Janta Party)”的抗议活动。

Microsoft says a bug in its automated network maintenance request system caused Thursday's massive outage by mistakenly removing IP routes from more devices than intended, disrupting Azure and Microsoft 365 services. [...]

A vulnerability was found in Microsoft Azure App Service for Linux. It has been rated as critical. This vulnerability affects unknown code. Performing a manipulation results in improper access controls. This vulnerability is known as CVE-2026-58630. Remote exploitation of the attack is possible. No exploit is available. This product is a managed service, indicating that users are not permitted to maintain vulnerability countermeasures themselves.

A vulnerability was found in Microsoft Purview Data Governance. It has been declared as critical. This affects an unknown part. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-57106. The attack may be launched remotely. There is no exploit available. This product is provided as a managed service, meaning users do not have the ability to maintain vulnerability countermeasures themselves.

A vulnerability was found in Devolutions PowerShell Universal up to 2026.2.2. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Variables Feature. This manipulation causes cleartext storage of sensitive information. This vulnerability appears as CVE-2026-16802. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in Image::WebP up to 0.2 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation results in insufficient isolation of system-dependent functions. This vulnerability is reported as CVE-2026-58586. The attack can be launched remotely. No exploit exists.

A vulnerability has been found in Devolutions PowerShell Universal up to 2026.2.2 and classified as very critical. Affected is an unknown function of the file variables configuration file of the component Variables Feature. The manipulation of the argument variable value leads to code injection. This vulnerability is documented as CVE-2026-16801. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

A threat actor posting as anisanas2 claims to have extracted the full database of Distamed Morocco, a supplier of medical devices and healthcare solutions to hospitals, clinics, and practitioners, with a stated focus on cardiology, pulmonology, neurology, sleep diagnostics, rehabilitation, and medical imaging.

逛网页时突然弹出知名交易平台送免费会员，加密货币平台发新人奖励的广告，点进去是和官网几乎一模一样的页面，你以为

Other signatories of the letter include Meta, Palantir, Perplexity, Mistral, NVIDIA, Mozilla, The Linux Foundation, Hugging Face, Dell Technologies and IBM.

The post Microsoft, tech companies throw weight behind spread of open-source AI appeared first on CyberScoop.

Рабочий Firefox и личный Firefox — теперь в одном флаконе.

The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet

За привычный комфорт теперь придётся платить.