Aggregator

A threat actor on an underground forum is claiming to have leaked a database allegedly belonging to Optic 2000, a French optical retail and eyewear brand.

Атакующим всё чаще помогает не маскировка, а чужая привычка ничего не замечать.

GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation. Called staged publishing, the feature is now generally available on npm. It mandates that a human maintainer pass a two-factor authentication (2FA) challenge to approve

Attackers began exploiting Drupal SQL injection flaw CVE-2026-9082 within 48 hours of patch release. Drupal issued a highly critical security patch on May 20 for CVE-2026-9082, a SQL injection vulnerability that allows unauthenticated attackers to compromise sites running PostgreSQL databases. The project maintainers warned ahead of the release that exploits could surface within hours or […]

Обычная авторизация и привычные запросы превращаются в удобную ширму для наблюдения.

A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Releases URL. "Although the affected packages were all Composer packages, the malicious code was not added to composer.json," Socket said. "Instead, it was inserted into package.json, targeting projects that ship JavaScript

A threat actor on an underground forum is claiming to have compromised VIPER, an integrated management platform allegedly used by Chilean fire departments.

我们不能希望一早晨把对群众有利的事情都办完

今日暂未更新资讯~
更多最新文章，请访问SecWiki

在西雅图，Facebook、亚马逊、房地产管理公司与美国移民和海关执法局 ICE 有一个共同点。

A threat actor on an underground forum is claiming to auction a customer database allegedly belonging to WisERP, a smart ERP solutions provider for modern businesses.

A threat actor on an underground forum is claiming to share database entries allegedly tied to multiple Pakistani government agencies.

A vulnerability was found in Tenda F456 1.0.0.5. It has been rated as critical. This affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page leads to buffer overflow. This vulnerability is documented as CVE-2026-9389. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. It has been declared as critical. The impacted element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument mode can lead to os command injection. This vulnerability is registered as CVE-2026-9388. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. It has been classified as critical. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. This vulnerability is cataloged as CVE-2026-9387. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521 and classified as critical. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. This vulnerability is listed as CVE-2026-9386. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521 and classified as critical. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument command causes os command injection. This vulnerability is tracked as CVE-2026-9385. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability, which was classified as critical, was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument ip results in os command injection. This vulnerability is identified as CVE-2026-9384. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability, which was classified as critical, has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulation of the argument Username leads to sql injection. This vulnerability is referenced as CVE-2026-9383. Remote exploitation of the attack is possible. Furthermore, an exploit is available.