Aggregator

A vulnerability classified as problematic was found in Pivotick up to 1.4.0. Impacted is the function tryResolveHTMLElement/createIcon of the component UI Element Resolution/Icon Rendering Utilities. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-67174. The attack may be launched remotely. There is no exploit available. It is best practice to apply a patch to resolve this issue.

A vulnerability classified as critical has been found in Schreibfaul1 ESP32-audioI2S 3.4.5. This issue affects the function MP3Decoder::decode of the file src/mp3_decoder/mp3_decoder.cpp of the component MP3 Decoder. This manipulation of the argument mainDataBegin/nSlots causes buffer overflow. This vulnerability appears as CVE-2026-51251. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as critical has been identified in schreibfaul1 ESP32-audioI2S 3.4.5. This vulnerability affects the function AudioBuffer::freeSpace of the file src/Audio.cpp. The manipulation results in race condition. This vulnerability is reported as CVE-2026-51261. The attack can be launched remotely. No exploit exists.

A vulnerability marked as critical has been reported in Anchore Enterprise up to 5.27.1/6.0.0. This affects an unknown part of the component User Management API. The manipulation leads to improper privilege management. This vulnerability is documented as CVE-2026-63727. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in schreibfaul1 ESP32-audioI2S 3.4.5. Affected by this issue is the function AudioBuffer::writeSpace of the file src/Audio.cpp. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is registered as CVE-2026-51260. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as critical has been detected in schreibfaul1 ESP32-audioI2S 3.4.5. Affected by this vulnerability is an unknown functionality of the file Audio.cpp. Performing a manipulation results in integer overflow. This vulnerability is cataloged as CVE-2026-51259. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability categorized as critical has been discovered in schreibfaul1 ESP32-audioI2S 3.4.5. Affected is the function MP3Decoder::GetBits of the file src/mp3_decoder/mp3_decoder.cpp of the component MP3 Decoder. Such manipulation of the argument nBits leads to integer underflow. This vulnerability is listed as CVE-2026-51254. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in Apache Axis2 and Java up to 2.0.0. It has been rated as critical. This impacts the function org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived of the component Tribes-based Clustering. This manipulation causes deserialization. This vulnerability is tracked as CVE-2026-66713. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in Apache Tomcat up to 9.0.120/10.1.57/11.0.24. It has been declared as problematic. This affects an unknown function of the component WebSocket Chat Example. The manipulation results in resource consumption. This vulnerability is identified as CVE-2026-66299. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

An employee's email account had been compromised, allowing unauthorized access to "certain data," Bank of Baroda reported.

AI-assisted research uncovered Linux kernel use-after-free allowing root escalation

Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of the 36,872 internet-exposed server-management interfaces running IPMI, 24,650 have been found to disclose password-derived authentication hashes before login due to

Биомаркер самой страшной болезни мозга сдвинулся в лучшую сторону благодаря тренировкам мозга.

本文链接

该文档由腾讯云安全出品，聚焦办公网AI Agent的安全治理实践。随着AI Agent从"内容生成"演进为"代为行动"，安全风险已从单点漏洞转变为"行动链失控"——通过Prompt注入、工具调用、权限继承、数据触达和审计断点，导致权限被放大、数据被外带、责任难追溯。

文档提出办公网智能体安全治理"五问"框架：围绕"身份可识别、环境可信任、工具有边界、数据受保护、行为可追溯"构建行动链治理体系。基于腾讯iOA产品，建立"事前预防—事中管控—事后溯源"三层闭环：事前通过AI资产盘点、Skill安全准入、运行时防护与沙箱隔离实现"看得见"；事中依托EDR全链路审计、Skill自动处置、零信任联动与DLP外发拦截实现"防得住"；事后通过统一资产台账与事件溯源取证实现"可追溯"。

文档还给出了30天落地路线，从试点人群和高风险工具入手，分阶段完成资产盘点、边界控制和审计运营。核心主张是：安全治理不是限制AI，而是让AI Agent在企业中走向可信、可控、可运营，实现放心规模化使用。

本文链接

该文档由萤石网络出品，聚焦AI驱动编程与智能体安全管控实践。文档指出，代理式开发模式正重塑软件生命周期，将传统数周至数月的开发周期压缩至数小时至数天，实现从"人工编写"到"人类引导、智能体执行"的范式转变。然而效率提升伴随显著风险：AI生成代码漏洞率高达40%-62%，API密钥硬编码率达28%，且存在智能体失控、提示词注入等安全隐患。

文档提出"用AI管理AI"的治理思路，构建覆盖需求评审、代码审查、安全测试、情报监控的AI-SDLC全链路防护体系，并借鉴员工管理逻辑，通过统一入口/出口、工具白名单、技能安全检查、密钥托管、行为可观测与幻觉抑制等机制，实现智能体的集中管控与全程审计。

面向未来，文档认为风险正从内容合规向行为失控转移，建议构建端点身份权限管控、网络隔离沙箱、AI多层护栏与策略校验、三位一体协同决策及安全态势反馈的闭环体系，推动安全防护从被动应对向主动适应演进，为企业在智能体时代的安全实践提供了系统性的方法论与落地路径。