CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse
CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse End-to-end encryption for a group call is only as strong as the membershi…
Open Source
⚑ Сообщить о проблемеПоследние новости Open Source от Tech News
Все темы
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Чистим шумный SBOM: как убрать неэксплуатируемые уязвимости в Kubernetes с помощью VEX
В SBOM-отчёте оказались уязвимости компонентов, которых даже нет в вашем софте. Ничего необычного: просто сканер безопасности подтянул все непрямые…
CVE-2026-40281 Explained: A Patch That Guarded "=" on One Side Only
Overview Item Detail CVE ID CVE-2026-40281 Affected product Gotenberg (Docker-powered PDF conversion API, thecodingmachine/gotenberg) Affected versi…
Android's external/ libraries: hunting n-days in code that upstream already fixed
"Android's external/ libraries: hunting n-days in code that upstream already fixed" (Alternative: "I built a fuzzing platform on a 2-core VPS. Here'…
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean Vulnerability overview CVE-2026-96358 appears in CERT-BUND advisory WID-S…
Глитчи глитчами, дамп дампом, но It's Time to End Information Anarchy
В этом году мы провели уже седьмую конференцию OFFZONE. Кроме того что на площадке можно послушать крутые технические доклады, каждый год здесь пров…
CVE-2026-61500: Forging an HFS Admin Session Without Logging In
CVSS 3.1: 9.8 (Critical) / CVSS 4.0: 9.3 / CWE-338 (Use of a cryptographically weak PRNG) Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.…
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root The vulnerability in one paragraph MikroTik RouterOS be…
CVE-2026-92957: CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass
CVE-2026-92957: Sandbox Escape and Remote Code Execution in vm2 via node: Prefix Policy Bypass Vulnerability ID: CVE-2026-92957 CVSS Score: 9.9 Publ…
CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root
Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel & WHM — EmailTrack (Email ▸ Track Delivery) Vulnerability class CWE-89…
cKEV Index: успеть до полуночи
ИИ помогает быстрее искать уязвимости, разбирать исправления и готовить эксплойты. Окно технологических работ от этого длиннее не становится. У кома…
GitLab ships critical patch across 19.4, 19.3 and 19.2
What shipped GitLab pushed a critical patch release on 23 September covering three active branches at once: 19.4.1, 19.3.3 and 19.2.7. The release n…
CVE-2026-31431 \"Copy Fail\": A Deep Dive into the Linux algif_aead Privilege Escalation
Vulnerability Overview Field Detail CVE ID CVE-2026-31431 Nickname Copy Fail CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected comp…
Сентябрьский «В тренде VM»: уязвимости TeamCity, TrueConf, SharePoint, Windows и Zimbra Collaboration
Хабр, привет! На связи Александр Леонов, ведущий эксперт центра безопасности Positive Technologies (PT ESC) и дежурный по самым опасным уязвимостям…
Разбор CVE-2026-83557 в jackson-databind: почему не всех CVE надо бояться
Утро четверга. Вы открываете таск-трекер, а там тикет от сканера зависимостей: «jackson-databind, CVE-2026-83557, критично, патчить». Ссылка на GitH…
Automating Threat Intelligence: Integrating CVE Bots and Open Datasets into Your SecDevOps Pipeline
Originally published on tamiz.pro . Introduction: The Shift from Reactive to Proactive Security The traditional security operations model is no long…
CVE-2026-63349: CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module
CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module Vulnerability ID: CVE-2026-63349 CVSS Score: 7.0 Publishe…
How Log4Shell Works: Breaking Down CVE-2021-44228
INTRODUCTION Log4jShell is a software vulnerability in Apache Log4j 2 which is a popular java library used for logging events in java-based applicat…
CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch
Overview CVE ID CVE-2026-16723 Affected Fastjson 1.2.68 – 1.2.83 (every 1.x release still receiving use) Preconditions Spring Boot executable fat-JA…
CVE-2026-12243 — How a Percent-Encoded Slash Bypasses NLTK's Path Traversal Guard
CVE ID CVE-2026-12243 Affects NLTK (Natural Language Toolkit) ≤ 3.9.4 Weakness CWE-22 (Path Traversal) CVSS 3.1 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C…
CVE: история о том, как два инженера устали от хаоса и создали идентификатор, связавший все уязвимости мира
Одна уязвимость, дюжина названий, 321 запись и стенд, за которым конкуренты договорились “дружить”. История создания самого известного идентификатор…
A SQL escape is not a shell escape: OS command injection in GOautodial goAPIv2
TL;DR What: In GOautodial's goAPIv2 agent API, the goPhone request parameter is escaped for SQL ( mysqli_real_escape_string ) and then concatenated…
CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files
Originally published at HOL CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files from Checkpoint Indexes TL;DR…
BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass
Originally published at HOL BREAKING: CVE-2026-18500 - @fastify/jwt key override authorization bypass TL;DR: CVE-2026-18500 affects @fastify/jwt ver…
CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation
Originally published at HOL CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation TL;DR: HiveServer2's SAML HTTP path accepted a forged…
Чем опасны старые версии Nexus Repository CE
Хранилище артефактов, как правило, находится в критическом месте инфраструктуры компании: между сборкой продукта и внешним миром. Через него команды…
CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server
CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server Vulnerability ID: CVE-2026-48854 CVSS Score: 8.7 Pub…
Deep-Dive Write-up by Huynh Kien Minh: CVE-2026-13736 — NewPath WildApricotPress Member Directory PII Disclosure
🔐 Vulnerability ID: CVE-2026-13736 | 🎯 CVSS Score: 5.3 Medium | 🏆 Lead Researcher: Huynh Kien Minh (MinhHK) | 🔗 WPScan Advisory: Verified Report | 🌐…
GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles
GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles Vulnerability ID: GHSA-5CWR-5JXG-PCF6 C…
nginx is not the bug. Two lines of your config are. CVE-2026-42945 on a live stand
A critical nginx vulnerability, 9.2 on CVSS, sat in the code for eighteen years. It was found not by a human but by an AI agent, and six hours were…