Aggregator

A vulnerability was found in Microsoft Windows up to Server 2022. It has been rated as critical. The impacted element is an unknown function of the component DWM Core Library. The manipulation leads to privilege escalation. This vulnerability is listed as CVE-2022-41096. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft Windows. It has been declared as critical. The affected element is an unknown function of the component Digital Media Receiver. Executing a manipulation can lead to privilege escalation. This vulnerability is tracked as CVE-2022-41095. The attack can be launched remotely. No exploit exists. It is best practice to apply a patch to resolve this issue.

A forum user posting as 0xSec has published what they describe as the database of Lire Demain, the schools and institutions network of the French children's publisher Auzou, which supplies books, kamishibai theatres, and educational materials to schools, early years settings, and local authorities.

多份文档从不同维度（产业政策、专利竞争、下水道基础设施检测、经济产业省工作、行业市场）系统呈现了日本无人机（UAS/ドローン）的发展现状、制度演进与战略课题。

一、文章主要内容总结该报告为日本防卫研究所（NIDS）2026年4月发布的《中俄无人机生产网络分析》，报告基于开源情报（OSINT）方法，系统揭示了俄乌冲突背景下中俄在无人机（UAV）生产领域的深度产业整合与供应链协作。

A vulnerability has been found in Apple macOS up to 26.5 and classified as very critical. The impacted element is an unknown function of the component Keychain. The manipulation leads to state issue. This vulnerability is uniquely identified as CVE-2026-43728. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability was found in Apple iOS, iPadOS, macOS, tvOS and visionOS. It has been declared as very critical. This vulnerability affects unknown code. The manipulation results in out-of-bounds write. This vulnerability is known as CVE-2026-64770. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in Joomshaper SP Page Builder Extension up to 6.7.0. It has been classified as critical. The impacted element is an unknown function. The manipulation leads to hard-coded credentials. This vulnerability is listed as CVE-2026-65879. The attack may be initiated remotely. There is no available exploit.

A vulnerability marked as very critical has been reported in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS. Impacted is an unknown function. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2026-43711. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability identified as problematic has been detected in Linux Kernel up to 7.1.4. The affected element is the function pefile_digest_pe_contents of the file crypto/asymmetric_keys/verify_pefile.c of the component asymmetric_keys. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-64544. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

2026年7月2日，The Hacker News披露了首个完全由AI Agent执行的自动化勒索攻击。攻击者利用CVE-2025-3248（Langflow未授权RCE）和CVE-2021-29441（Nacos默认签名密钥绕过），在10分钟内完成从初始访问到数据加密的完整攻击链。AI Agent展现了自我修正能力（31秒内完成错误修正），且勒索密钥仅显示一次从不保存，即使支付也无法恢复数据。 这标志着勒索攻击从"高水平黑客专属"进入"AI自动化时代"。传统勒索需要高水平黑客数天甚至数周的时间，现在AI Agent可在10分钟内完成。更危险的是，AI具备自我修正能力——攻击过程中遇到错误可自动调整策略，无需人类干预。 防御方必须从根本上重构安全策略： 1、补丁管理：从"定期打补丁"变为"立即打补丁"，窗口期从数周缩短至数小时； 2、凭证管理：禁止将API密钥存放于AI工具环境变量，使用专业密钥管理器隔离存储； 3、运行时检测：将"运行时异常行为检测"置于"打补丁竞赛"之上，因为攻击者可数小时内武器化新漏洞。

Dormant nonhuman identities can create security blind spots, says security researcher Aleksandr Krasnov, who plans to release an open source tool next week at Black Hat USA 2026 that sniffs out trust paths.

A vulnerability, which was classified as problematic, has been found in Fission up to 1.24.x. The impacted element is the function HTTPTriggerSpec.Validate of the component Direct Kubernetes REST API. Performing a manipulation results in permissive cross-domain policy with untrusted domains. This vulnerability is known as CVE-2026-50569. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in IBM WebSphere Application Server up to 26.0.0.7 and classified as problematic. This affects an unknown function. Such manipulation leads to denial of service. This vulnerability is documented as CVE-2026-15057. The attack can be executed remotely. There is not any exploit available.

A vulnerability classified as problematic has been found in IBM WebSphere Application Server and WebSphere Application Server Liberty 9.0/8.5/17.0.0.3/26.0.0.7. This vulnerability affects unknown code of the component HTTP Channel. Performing a manipulation results in allocation of resources. This vulnerability is identified as CVE-2026-14981. The attack can be initiated remotely. There is not any exploit available.

A vulnerability, which was classified as critical, was found in IBM WebSphere Application Server up to 26.0.0.8. The affected element is an unknown function. The manipulation results in code injection. This vulnerability is cataloged as CVE-2026-14976. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in IBM Aspera Faspex up to 5.0.15.4. It has been rated as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to manage user sessions. This vulnerability is traded as CVE-2026-14996. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability has been found in IBM WebSphere Application Server 8.5/9.0 and classified as critical. The impacted element is an unknown function. This manipulation causes deserialization. This vulnerability is registered as CVE-2026-14974. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability categorized as problematic has been discovered in IBM Aspera Desktop App up to 1.0.19. Affected by this issue is some unknown functionality. The manipulation results in path traversal. This vulnerability is known as CVE-2026-14973. Attacking locally is a requirement. No exploit is available.

CubePilot, an Australian firm that designs flight controllers for drones (UAVs), announced a severe operational disruption caused by a DNS hijacking attack. [...]