Aggregator

有兴趣，在此重要前提下，超前学习数学工具，考场上会占便宜的。

试着部署一套开源EDR架构 by ourren

更多最新文章，请访问SecWiki

为在情报学领域深入落实国家人才培养战略，激发大学生对开源情报分析的热情，提升学生在数据采集、深度分析及情报应用等方面的综合能力，特举办“第四届全国大学生开源情报数据采集与分析挑战专项”活动。

今天把美国政府、军方、国会、大学、智库等机构中专门负责中国方向或者专门研究中国的机构列表发给大家，供大家有针对性收集资料。

A vulnerability was found in codexu NoteGen up to 0.31.x. It has been declared as problematic. This impacts the function dangerouslySetInnerHTML of the component chat-preview. Executing a manipulation can lead to cross site scripting. This vulnerability is handled as CVE-2026-17496. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

抬头看见天空划过的飞机时，你会不会好奇它从哪来要飞往哪去。不用掏出手机刷航班 APP，一块 ESP32 开发板加一枚圆形小屏，就能自制一台实时更新的迷你飞机雷达。 这个项目名叫 ESP32PlaneRadar，是完全开源的 ESP32 固件项目，代码以 C++ 编写，采用 MIT 开源协议，对应 GitHub 仓库为 https://github.com/ironicbadger/ESP32-Plane-Radar 它本质是一台基于 ADS-B 信号的便携式航班监视器，ADS-B 全称广播式自动相关监视，是当前民航客机普遍配备的定位广播系统，飞机会周期性向外发送自身位置高度航班号等公开数据。设备抓取周边空域的广播信号后，会在屏幕上以类似声呐扫描的界面呈现，按照真实的距离和方位标注每一架飞机，同时同步显示对应的航班细节。 整套硬件的核心是 ESP32-C3 开发板加一块 1.28 英寸圆形显示屏，组装门槛不高，只需要基础的焊接能力。作者选用细硅胶线完成接线，全程只用了 15 分钟左右，动手的过程还让他想起了早年组装竞速穿越机的日子。 现在给全新 ESP32 刷写固件的门槛已经降到极低，用浏览器端的 ESPHome 网页刷写工具就能一键完成，整个过程不到 30 秒，哪怕是新手也能轻松操作。 项目配套的原版 3D 打印模型曾登上 Makerworld 平台推荐位，外观设计相当精致，暂时换用了另一款适配 ESP32-S3 的打印方案。 最核心的优化是完善了航班上下文信息，只要数据源支持，屏幕上的飞机会直接展示出发地与目的地机场，没有对应数据时才以航班呼号作为兜底显示。机型标注也做了细化，会呈现 B737-800 这类完整型号信息，而不是只标注 B737 这样的宽泛分类，除此之外 固件还新增了本地天气温湿度以及时间日期显示，让设备的信息密度更高。 网页配置界面也做了全面优化，初始配网完成后，用户可以直接在网页端修改定位坐标，调整各类显示选项也不需要重置 WiFi 配置。设置项覆盖了单位切换跑道显示开关天气展示温度格式选择以及 12/24 小时制切换，基本能满足不同用户的使用习惯。文字显示同样做了人性化调整，默认字号放大了 10%，同时加入了 80% 到 130% 范围的调节滑块，用户可以根据自身需求自由调整显示大小。 最后一项重要的技术更新是加入了带认证机制的 OTA 无线升级功能。用户在本地电脑编译好固件二进制文件后，直接通过浏览器就能无线上传完成更新，不需要再把开发板连接到电脑 USB 接口，这套更新逻辑和 ESPHome 的固件更新方式类似，大大降低了后续固件迭代的操作成本。

加州大学河滨分校（UC Riverside）钱志云教授招聘！

Claude 共享对话功能曝出高危隐私安全漏洞。用户通过该功能生成的公开分享链接未配置搜索引擎禁止抓取标识，致使大量对话内容被谷歌等搜索引擎收录索引，任意网民只需检索关键词，就能完整浏览对话全文。 此次泄露内容覆盖多类高敏感数据，包括接口密钥、加密货币钱包地址、个人求职简历、法律咨询记录、企业内部项目文档、社保身份编号等。约一年前 ChatGPT 曾出现完全一致的共享链接爬虫泄露问题，当时 OpenAI 迅速完成漏洞修复。反观开发 Claude 的 Anthropic，截至目前仍未推出修复方案。安全人员提醒所有用户，尽快进入账号设置内的「共享对话」管理页面，手动删除包含个人隐私、财务信息的聊天会话，规避信息持续外泄风险。

A vulnerability was found in codexu NoteGen up to 0.31.x. It has been declared as problematic. This impacts the function dangerouslySetInnerHTML of the component chat-preview. Executing a manipulation can lead to cross site scripting. This vulnerability is handled as CVE-2026-17496. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in codexu NoteGen up to 0.31.x. It has been classified as problematic. This affects an unknown function of the component Tauri shell plugin. Performing a manipulation results in cross site scripting. This vulnerability is known as CVE-2026-17497. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Microsoft Surface Management Services. It has been rated as very critical. This issue affects some unknown processing. This manipulation causes improper input validation. This vulnerability is tracked as CVE-2026-54120. The attack is possible to be carried out remotely. No exploit exists. This product is a managed service, so users do not have direct control over vulnerability countermeasures.

A vulnerability categorized as critical has been discovered in Microsoft Account. Impacted is an unknown function. Such manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-56165. The attack may be performed from remote. There is no available exploit. This product is a managed service, which means users themselves cannot handle vulnerability countermeasures.

A vulnerability was found in Microsoft Graph. It has been declared as problematic. This vulnerability affects unknown code. The manipulation results in information disclosure. This vulnerability is identified as CVE-2026-49159. The attack can be executed remotely. There is not any exploit available. This product is a managed service, indicating that users are not permitted to maintain vulnerability countermeasures themselves.

A vulnerability labeled as critical has been found in Microsoft Azure API Management. The impacted element is an unknown function. Executing a manipulation can lead to improper access controls. This vulnerability is registered as CVE-2026-35425. It is possible to launch the attack remotely. No exploit is available. This product is a managed service. This means that users are not able to maintain vulnerability countermeasures themselves.

A vulnerability identified as very critical has been detected in Microsoft Azure Red Hat OpenShift. The affected element is an unknown function. Performing a manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-56160. It is possible to initiate the attack remotely. There is no exploit available. This product is a managed service, therefore users are not responsible for maintaining vulnerability countermeasures.

A vulnerability classified as critical was found in Microsoft Azure AI Search. Affected by this vulnerability is an unknown functionality. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-56167. The attack may be launched remotely. There is no exploit available. This product is a managed service, so users are unable to manage vulnerability countermeasures on their own.

A vulnerability was found in meum Kirki Plugin up to 6.0.14 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation of the argument context results in improper control of resource identifiers. This vulnerability was named CVE-2026-13464. The attack may be performed from remote. There is no available exploit.

A vulnerability described as critical has been identified in Microsoft Azure DNS. This impacts an unknown function. The manipulation results in improper authorization. This vulnerability is reported as CVE-2026-58275. The attack can be launched remotely. No exploit exists. This product is a managed service. It is not possible for users to maintain vulnerability countermeasures themselves.

A vulnerability was found in Microsoft Exchange Server. It has been classified as very critical. This affects an unknown part. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-56191. Remote exploitation of the attack is possible. No exploit is available. This product is provided as a managed service, meaning users do not have the ability to maintain vulnerability countermeasures themselves.

A vulnerability classified as critical has been found in Microsoft Azure Key Vault. Affected is an unknown function. This manipulation causes improper authentication. This vulnerability appears as CVE-2026-62825. The attack may be initiated remotely. There is no available exploit. This product is a managed service. This means that users cannot maintain vulnerability countermeasures themselves.