Aggregator

A vulnerability was found in Click Studios Passwordstate up to 9785. It has been classified as problematic. This affects an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2023-43295. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as problematic has been identified in SCOL Members Card mini-app on Line 13.6.1. This vulnerability affects unknown code of the component Channel Access Token Handler. The manipulation results in information disclosure. This vulnerability is known as CVE-2023-43298. Access to the local network is required for this attack. No exploit is available.

A vulnerability marked as problematic has been reported in Nothings stb 2.28. Affected by this vulnerability is the function stbi_load_gif_main of the file Image.h of the component File Handler. This manipulation causes denial of service. This vulnerability is handled as CVE-2023-43281. The attack can be initiated remotely. Additionally, an exploit exists.

Winos4控制平台、木马上线环节、木马控制环节、通信模型分析

A Taiwanese man was sentenced to 30 years for running Incognito Market, a major darknet drug site that sold over $105 million in illegal drugs. Rui-Siang Lin (24) was sentenced to 30 years in prison for running Incognito Market, a major darknet drug marketplace that sold over one ton of narcotics. The Taiwanese man pled […]

A vulnerability identified as critical has been detected in Linux Kernel up to 6.6.114/6.12.55/6.17.5. This affects the function enetc_mdio_lock. Performing a manipulation results in deadlock. This vulnerability was named CVE-2025-40347. The attack needs to be approached within the local network. There is no available exploit. You should upgrade the affected component.

A vulnerability described as critical has been identified in Linux Kernel up to 6.6.114/6.12.55/6.17.5. This vulnerability affects the function bpf_xdp_adjust_tail of the component mlx5e. The manipulation results in privilege escalation. This vulnerability was named CVE-2025-40350. The attack needs to be approached within the local network. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability identified as critical has been detected in Linux Kernel up to 6.17.8. The affected element is an unknown function of the component panthor. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2025-40276. The attack can only be initiated within the local network. No exploit exists. You should upgrade the affected component.

通过继承链访问 catch_warnings.__init__.__globals__，绕过限制获取原始 __builtins__，实现任意代码执行。

可用于触发Claude模型拒绝响应的字符串、png图片、docx文档、pdf文档、IDA伪代码、恶意脚本等

DeepChat FilePresenter 组件未校验路径参数，导致通过 ../ 路径遍历可读写 userData 目录外任意文件，包括明文存储的 API 密钥。

记一次某管理服务器审计拿下CNVD高危证书过程

漏洞简介vLLM 是大型语言模型（LLM）的推理和服务引擎。在 0.14.1 版本之前，vLLM 项目多模态功能集中的“MediaConnector”类别存在SSRF漏洞。load_from_url和load_from_url_async方法通过用户提供的URL获取和处理媒体，在限制目标主机时使用不同的Python解析库。这两个解析库对反斜线有不同的解释，这使得可以绕过主机名的限制。这使得攻击者能

自动化漏洞检测工具（如模糊测试、静态分析工具）已广泛应用，但漏洞修复仍严重依赖安全专家人工经验，形成“检测快、修复慢”的效率失衡，大量漏洞长期未修复，成为安全防护体系的核心薄弱环节。本文提出一种基于AI Agent及Workflow实现漏洞根源修复的端到端自动化技术，突破传统修复方案瓶颈。

对DeepAudit的架构以及实现进行了分析

某OA系统0Day审计过程

漏洞简介n8n 在其工作流表达式评估系统中存在一个关键的远程代码执行（RCE）漏洞。经过认证的用户在工作流配置过程中提供的表达式，可以在与底层运行时隔离不足的执行上下文中进行评估。 经过认证的攻击者可能会滥用这种行为，以n8n进程的权限执行任意代码。成功的利用可能导致受影响实例的全面入侵，包括未经授权访问敏感数据、修改工作流程以及系统级作的执行。漏洞影响评分：9.9版本：<1.123.17,

漏洞来源漏洞描述n8n 的工作流表达式求值系统存在严重的远程代码执行 (RCE) 漏洞。已认证用户在工作流配置期间提供的表达式可能会在与底层运行时隔离不足的执行上下文中进行求值。已认证的攻击者可以利用此漏洞，以 n8n 进程的权限执行任意代码。成功利用此漏洞可能导致受影响实例完全被攻陷，包括未经授权访问敏感数据、修改工作流以及执行系统级操作。漏洞分析漏洞入口点在packages/cli/src/s

使用相同技术原理，可实现篡改支付宝收款二维码、微信收款二维码的效果