Aggregator

Anthropic Finds Claude Breached Real Companies During Security Evaluations

安全资讯导视 • 中国人民银行等九部门印发《关于加强科技金融领域数据开发利用的通知》• 美国明州30多个供水工

致力于第一时间为企业级用户提供权威漏洞情报和有效解决方案。

A vulnerability classified as critical was found in ANDRITZ HIPASE-250 and 250 SCALA up to 7.20/8.14. Affected by this issue is some unknown functionality. The manipulation results in hard-coded credentials. This vulnerability is identified as CVE-2026-65313. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in ANDRITZ HIPASE-250 and 250 SCALA up to 7.20/7.39. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-65310. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in ANDRITZ HIPASE-250 up to 7.20. Affected is an unknown function of the component HTTP Server. Executing a manipulation can lead to improper privilege management. The identification of this vulnerability is CVE-2026-65311. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Traefik Labs has introduced the Distro Zero image, a hardened, vendor-supported secure runtime delivered as Traefik Hub in proxy mode. It gives platform and security teams a container whose entire executable content is a single memory-safe binary, with validated cryptography built inside it and every advanced capability, from API gateway to AI and MCP gateway to full API management, unlocked by license on that same binary. No binary swap, no migration, no re-validation as needs … More →

The post Traefik Labs introduces Distro Zero secure runtime for API and AI gateways appeared first on Help Net Security.

On May 14, 2026, security researcher Orange Tsai demonstrated a Microsoft Edge sandbox escape at Pwn

Horizon3.ai has expanded its NodeZero platform with AI-powered web application pentesting. The platform can now autonomously test web applications and identify attack paths that chain application vulnerabilities, credential theft, lateral movement, cloud access, and data exposure. Web applications have never been more exposed or more critical to secure. The rapid deployment of “vibe-coded” applications built with generative AI has introduced a wave of systems riddled with exploitable flaws. At the same time, threat actors are … More →

The post Horizon3.ai expands NodeZero with automated web application attack path testing appeared first on Help Net Security.

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

AttackIQ has announced AVA Agentic OS, an agentic operating system designed to operationalize Continuous Threat Exposure Management. CTEM has emerged as the strategic framework for managing cyber risk, yet many organizations continue to struggle to operationalize CTEM across fragmented security technologies, disconnected workflows, and manual processes. Security teams have invested heavily in tools that identify risk, but they lack an intelligent operational layer that continuously transforms intelligence into action. AVA Agentic OS fills that gap … More →

The post AttackIQ targets CTEM execution with AVA Agentic OS appeared first on Help Net Security.

A vulnerability marked as problematic has been reported in ANDRITZ 250 SCALA and HIPASE-250 up to 7.20/7.49. This impacts an unknown function. Performing a manipulation results in password hash with insufficient computational effort. This vulnerability was named CVE-2026-65309. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Rich Source DMS+ up to 5.63. This affects an unknown function. Such manipulation leads to hard-coded credentials. This vulnerability is uniquely identified as CVE-2026-18452. The attack can be launched remotely. No exploit exists.

A vulnerability identified as critical has been detected in WP Go Maps Plugin up to 10.1.3 on WordPress. The impacted element is an unknown function. This manipulation causes sql injection. This vulnerability is handled as CVE-2026-15381. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in JS Help Desk Plugin up to 3.1.4 on WordPress. The affected element is an unknown function. The manipulation results in authorization bypass. This vulnerability is known as CVE-2026-15209. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in Geeky Bot Plugin up to 1.2.7 on WordPress. It has been rated as problematic. Impacted is an unknown function. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-15048. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability was found in BuddyPress Plugin up to 14.4.x on WordPress. It has been declared as critical. This issue affects some unknown processing. Executing a manipulation can lead to authorization bypass. This vulnerability appears as CVE-2026-8155. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability was found in Product Feed Manager for WooCommerce Plugin up to 7.6.0 on WordPress. It has been classified as critical. This vulnerability affects unknown code of the component Custom Filter. Performing a manipulation results in sql injection. This vulnerability is reported as CVE-2026-15258. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability was found in Realtyna Organic IDX Plugin and WPL Real Estate up to 5.3.0 on WordPress and classified as critical. This affects the function saveLiveImages/get_keys of the component Save Live Images/Get Keys Handler. Such manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-16236. The attack can be executed remotely. There is not any exploit available.