Aggregator

SLH

Dark Feed IO
2 weeks ago

You must login to view this content

cohenido

CVE-2026-29793 | Feathersjs up to 5.0.41 getObjectId data query logic injection (GHSA-p9xr-7p9p-gpqx)

Vuldb Updates
2 weeks ago
A vulnerability categorized as critical has been discovered in Feathersjs up to 5.0.41. The impacted element is the function getObjectId. The manipulation results in improper neutralization of special elements in data query logic. This vulnerability was named CVE-2026-29793. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.
vuldb.com

CVE-2026-29792 | Feathersjs up to 5.0.41 OAuth Service improper authentication (GHSA-wg9x-qfgw-pxhj)

Vuldb Updates
2 weeks ago
A vulnerability described as critical has been identified in Feathersjs up to 5.0.41. The affected element is an unknown function of the component OAuth Service. Such manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-29792. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.
vuldb.com

CVE-2026-32112 | homeassistant-ai ha-mcp up to 6.x OAuth Endpoint cross site scripting (GHSA-pf93-j98v-25pv)

Vuldb Updates
2 weeks ago
A vulnerability marked as problematic has been reported in homeassistant-ai ha-mcp up to 6.x. This issue affects some unknown processing of the component OAuth Endpoint. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-32112. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-32103 | withstudiocms up to 0.4.2 create-reset-link authorization (GHSA-h7vr-cg25-jf8c)

Vuldb Updates
2 weeks ago
A vulnerability has been found in withstudiocms studiocms up to 0.4.2 and classified as problematic. This affects an unknown part of the file /studiocms_api/dashboard/create-reset-link. This manipulation causes authorization bypass. This vulnerability is registered as CVE-2026-32103. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.
vuldb.com

CVE-2026-32106 | withstudiocms up to 0.4.2 createUser Endpoint privileges management (GHSA-wj56-g96r-673q)

Vuldb Updates
2 weeks ago
A vulnerability labeled as critical has been found in withstudiocms studiocms up to 0.4.2. This issue affects some unknown processing of the component createUser Endpoint. The manipulation results in improper privilege management. This vulnerability is known as CVE-2026-32106. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.
vuldb.com

新能源危机迫使政府重新考虑对化石燃料的依赖

Solidot
2 weeks ago
正在爆发的新能源危机正促使全球决策者重新思考对化石燃料的依赖，提议扩大核能和可再生能源，推动能源供应来源多元化。欧洲上周公布了对核能的新金融担保，中国发改委的一个部门表示要加快可再生能源转型，多个亚洲国家建议居民在家办公节约能源，日本一直在讨论重启闲置的核反应堆。中国因拥有充足的应急石油储备和较高的电气化率而受到的影响相对较小，电动汽车占中国国内新车销量的半数以上，电网中逾 50% 的电力来自可再生能源。

When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

Threat intelligence | Microsoft Security Blog
2 weeks ago

During tax season, threat actors reliably take advantage of the urgency and familiarity of time-sensitive emails, including refund notices, payroll forms, filing reminders, and requests from tax professionals, to push malicious attachments, links, or QR codes.

The post When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures appeared first on Microsoft Security Blog.

Microsoft Threat Intelligence and Microsoft Defender Security Research Team

When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

Threat intelligence | Microsoft Security Blog
2 weeks ago

During tax season, threat actors reliably take advantage of the urgency and familiarity of time-sensitive emails, including refund notices, payroll forms, filing reminders, and requests from tax professionals, to push malicious attachments, links, or QR codes.

The post When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures appeared first on Microsoft Security Blog.

Microsoft Threat Intelligence and Microsoft Defender Security Research Team

Managed ad