Aggregator

A vulnerability was found in IBM WebSphere Application Server up to 26.0.0.8. It has been declared as problematic. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. This vulnerability is documented as CVE-2026-2482. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Google ADK up to 2.4.x. It has been classified as problematic. Impacted is an unknown function of the component Tool Confirmation. This manipulation causes improper authorization. This vulnerability is registered as CVE-2026-18236. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Netty and classified as problematic. This issue affects the function Bzip2BlockDecompressor.read of the component Bzip2Decoder. The manipulation results in denial of service. This vulnerability is cataloged as CVE-2026-59901. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Netty and classified as critical. This vulnerability affects unknown code of the component Http2StreamFrameToHttpObjectCodec/InboundHttp2ToHttpAdapter. The manipulation leads to improper synchronization. This vulnerability is listed as CVE-2026-59900. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in Netty up to 4.1.135.Final/4.2.15.Final. This affects an unknown part of the component HAProxy Encoder. Executing a manipulation can lead to crlf injection. This vulnerability is tracked as CVE-2026-59919. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

A vulnerability, which was classified as very critical, has been found in BlackBerry QNX 7.0/7.1/8.0. Affected by this issue is the function decode of the component traceparser library. Performing a manipulation results in improper input validation. This vulnerability is identified as CVE-2026-40272. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as problematic was found in Netty. Affected by this vulnerability is an unknown functionality of the component HttpContentEncoder. Such manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-59899. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in Care Everywhere Gateway 14.3.10. Affected is an unknown function of the component Management Interface. This manipulation causes hard-coded credentials. The identification of this vulnerability is CVE-2026-41939. It is possible to initiate the attack remotely. There is no exploit available.

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

时间范围：2026-05-12 至 2026-07-29
写作定位：这不是开发日志，也不是提交记录。它是一份面向分享的回忆录：记录一个交易想法如何从两篇 X 文章，变成一套越来越严肃、越来越不敢轻易相信自己的量化系统。
AI 协作说明：这份回忆录由 AI 协助我整理、追问和写作，用来记录我从交易想法出发，逐步构建、怀疑、修正一套量化系统的过程。里面的判断、取舍和反思来自项目推进中的真实证据与对话复盘，AI 主要承担梳理脉络、改写表达和补齐遗漏的工作。

更新原则：这份文档以后会不定期更新，但不会按“今天改了哪个文件”继续堆流水账。

每次更新优先记录四件事：

• 当时我以为什么是对的。
• 后来系统或数据如何证明我想简单了。
• 我做了什么决定，为什么没有选另一条路。
• 这个决定留下了什么结果、教训或新的风险。

具体代码、命令、回测数字仍会保留，但放在章节中的证据段或附录里。正文要尽量像一篇可以给别人看的长文，而不是一份工作汇报。

第一幕：第一条权益曲线太好看了

这一幕写的是最早那种危险的兴奋感：两篇 X 文章、一套看起来很合理的交易框架、几条很快能跑起来的命令，以及第一条漂亮到让人愿意相信它的权益曲线。

那时我还没有真正理解，交易系统最会骗人的地方不是它跑不起来，而是它太快给你一个像答案的东西。第一幕的主线，就是从“策略好像有了”走到“数字开始互相打架”。

序章：最开始只是两篇文章

这个项目真正的开始，不是一个仓库，也不是一个数据库——而是我一次过于自信的“来都来了”。

Health-ISAC, a cybersecurity information-sharing organization for the health sector, is warning healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters. [...]

A vulnerability described as critical has been identified in Develar app-builder up to 4.2.0. This impacts the function zipx.Unzip of the component Extraction Routine. The manipulation results in path traversal. This vulnerability was named CVE-2026-13723. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as critical has been reported in Netty up to 4.1.135/4.2.15. This affects an unknown function of the component STOMP Encoder. The manipulation leads to injection. This vulnerability is uniquely identified as CVE-2026-59920. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in arnog MathLive up to 0.109.x. The impacted element is the function Box.toMarkup/xmlEscape/scanText/convertLatexToMarkup/convertLatexToMathMl/MathfieldElement.createHTML of the file src/core/box.ts/src/formats/atom-to-math-ml.ts of the component Text Mode Escaping. Executing a manipulation can lead to cross site scripting. This vulnerability is handled as CVE-2026-54705. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Devolutions Password Manager up to 2026.2.1. The affected element is an unknown function of the component Connection Handler. Performing a manipulation results in improper certificate validation. This vulnerability is known as CVE-2026-8497. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Better authentication UX helps B2B platforms reduce security fatigue, simplify account recovery, protect sensitive data, and keep business users engaged.

Fastjson 1.2.83最新RCE

The four additional targeted organizations weren’t named. OpenAI said they were not affected as severely as Hugging Face.

A vulnerability categorized as problematic has been discovered in nodejs undici up to 6.27.x/7.28.x/8.8.x. Impacted is the function setCookie of the component Cookie Sanitization. Such manipulation of the argument domain/unparsed leads to cross-site request forgery. This vulnerability is traded as CVE-2026-16729. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

题目都比较基础，适合新手熟悉一下题型和做题流程Saber附件名称是LSB.png 也就是PNG中的LSB隐写PNG - CTF Wiki我们用stegsolve分析一下这三个通道左上角有异常，分析可以提取出flagez_zipflag.zip被损坏了，用010看一下发现文件头缺了504B03,直接补上再次打开提示需要密码，看一下zip的本地文件头签名，14000900伪加密，直接用winrar修复