Aggregator

广聚全国高校青年英才，不拘一格降人才。

APT组织持续瞄准美国OT系统，Harvester新增Linux恶意软件，AI辅助攻击与防御并行，axios等供应链攻击波及广泛。

0代码、低成本、大规模、高隐蔽性的入侵

打哈欠是一种常见的人类行为，可能是感觉疲劳或无聊，或者是看到同伴打哈欠的反射行为。但科学家至今并不清楚人类为什么要打呵欠。根据发表在《Respiratory Physiology & Neurobiology》期刊上的一项研究，澳大利亚研究人员利用实时 MRI 扫描技术，观察了打哈欠时头部和颈部内部的变化，与正常呼吸和深呼吸进行对比。结果显示，打哈欠会触发一种特定的脑脊液和静脉血同时流出颅骨，而深呼吸时脑脊液则会流入颅骨。脑脊液充当了缓冲，能保护大脑和脊髓免受损伤，还能帮助输送营养物质和排出垃圾。研究表明打哈欠有助于清除脑脊液，其作用很可能是发生在临睡前。这项研究为理解打哈欠的生理功提供了一条新途径。

A vulnerability described as critical has been identified in fatbobman mail-mcp-bridge up to 1.3.3. Affected is an unknown function of the file src/mail_mcp_server.py. Executing a manipulation of the argument message_ids can lead to path traversal. This vulnerability is handled as CVE-2026-7386. The attack can be executed remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c. This impacts the function search_papers of the file research_server.py. Performing a manipulation of the argument topic results in path traversal. This vulnerability is known as CVE-2026-7384. Remote exploitation of the attack is possible. Furthermore, an exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability labeled as critical has been found in weDevs WP User Frontend Plugin up to 4.3.1 on WordPress. This affects an unknown function. Such manipulation leads to missing authorization. This vulnerability is traded as CVE-2026-42412. The attack may be launched remotely. There is no exploit available.

Submit #803096 / VDB-360107

A vulnerability identified as problematic has been detected in CDAC-Noida e-Sushrut Hospital Management Information System. The impacted element is an unknown function of the component API Request Handler. This manipulation causes authorization bypass. This vulnerability appears as CVE-2026-42515. The attack may be initiated remotely. There is no available exploit.

A vulnerability categorized as problematic has been discovered in CDAC-Noida e-Sushrut Hospital Management Information System. The affected element is an unknown function of the component API. The manipulation results in cleartext transmission of sensitive information. This vulnerability is reported as CVE-2026-42514. The attack can be launched remotely. No exploit exists.

A vulnerability was found in CDAC-Noida e-Sushrut Hospital Management Information System. It has been rated as critical. Impacted is an unknown function of the component Server Response Handler. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2026-42513. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in WSO2 Identity Server. It has been declared as problematic. This issue affects some unknown processing of the component Authentication Endpoint. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2025-10503. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two security flaws impacting ConnectWise ScreenConnect and Microsoft Windows to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerabilities are listed below - CVE-2024-1708 (CVSS score: 8.4) - A path traversal vulnerability in  ConnectWise ScreenConnect

Submit #803095 / VDB-360106

Не помогают антидепрессанты и психолог? Есть еще один вариант…

When a customer business system experiences a security incident, they often need to conduct forensic analysis on historical network traffic to identify the source of the intrusion and reconstruct the entire incident for targeted emergency response. In scenarios where customers have such traffic-analysis requirements, we can leverage the traffic forensics capabilities of the ISOP platform […]

The post ISOP Traffic Forensics appeared first on NSFOCUS.

The post ISOP Traffic Forensics appeared first on Security Boulevard.

Microsoft is working to resolve a known issue that prevents some Microsoft Teams Free users from chatting and calling others. [...]

2026年4月28日，美国网络司令部打算测试并用上目前最强的人工智能模型，不管政治因素，也不看模型是哪个国家做

Top AI-powered vendor risk platforms for SaaS companies in 2026, compare tools, features, and how to choose the…

实现 95% 资产可见度与秒级阻断，灵境 AIDR 守护 Agentic AI 应用全版图！