CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse
CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse End-to-end encryption for a group call is only as strong as the membershi…
Testing & QA
⚑ Сообщить о проблемеПоследние новости Testing & QA от Tech News
Все темы
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
Android's external/ libraries: hunting n-days in code that upstream already fixed
"Android's external/ libraries: hunting n-days in code that upstream already fixed" (Alternative: "I built a fuzzing platform on a 2-core VPS. Here'…
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean
Exposure Context for CVE-2026-96358: What 436,276 Drupal Fingerprints Mean Vulnerability overview CVE-2026-96358 appears in CERT-BUND advisory WID-S…
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root
CVE-2026-84411 in MikroTik RouterOS: why a pre-authentication integer underflow reaches root The vulnerability in one paragraph MikroTik RouterOS be…
CVE-2026-67401 Analysis — cPanel & WHM EmailTrack SQL Injection, From Mail Account to Root
Vulnerability Overview Item Detail CVE ID CVE-2026-67401 Component cPanel & WHM — EmailTrack (Email ▸ Track Delivery) Vulnerability class CWE-89…
CVE-2026-31431 \"Copy Fail\": A Deep Dive into the Linux algif_aead Privilege Escalation
Vulnerability Overview Field Detail CVE ID CVE-2026-31431 Nickname Copy Fail CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected comp…
CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch
Overview CVE ID CVE-2026-16723 Affected Fastjson 1.2.68 – 1.2.83 (every 1.x release still receiving use) Preconditions Spring Boot executable fat-JA…
CVE-2026-12243 — How a Percent-Encoded Slash Bypasses NLTK's Path Traversal Guard
CVE ID CVE-2026-12243 Affects NLTK (Natural Language Toolkit) ≤ 3.9.4 Weakness CWE-22 (Path Traversal) CVSS 3.1 7.5 High — AV:N/AC:L/PR:N/UI:N/S:U/C…
A SQL escape is not a shell escape: OS command injection in GOautodial goAPIv2
TL;DR What: In GOautodial's goAPIv2 agent API, the goPhone request parameter is escaped for SQL ( mysqli_real_escape_string ) and then concatenated…
CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation
Originally published at HOL CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation TL;DR: HiveServer2's SAML HTTP path accepted a forged…
Я попросил ИИ-агента только описать топологию сети. Он сам взломал мой роутер за одну ночь и помог оформить CVE
Некоторое время назад я строил оркестратор своей домашней лаборатории. LLM-агент должен был облететь серверы, собрать метаданные и зафиксировать топ…
CVE-2026-48854: CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server
CVE-2026-48854: Unauthenticated Denial of Service via Resource Exhaustion in elixir-grpc Server Vulnerability ID: CVE-2026-48854 CVSS Score: 8.7 Pub…
Deep-Dive Write-up by Huynh Kien Minh: CVE-2026-13736 — NewPath WildApricotPress Member Directory PII Disclosure
🔐 Vulnerability ID: CVE-2026-13736 | 🎯 CVSS Score: 5.3 Medium | 🏆 Lead Researcher: Huynh Kien Minh (MinhHK) | 🔗 WPScan Advisory: Verified Report | 🌐…
GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles
GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles Vulnerability ID: GHSA-5CWR-5JXG-PCF6 C…
A text message that runs a command: OS command injection in Gammu SMSD (GHSA-9vjj-v46c-c5qf)
TL;DR What: Gammu SMSD — the daemon behind a huge number of SMS gateways, alerting rigs and 2FA senders — runs an operator-configured hook every tim…
They scoped the customer and forgot the customer's ledger — a High-severity cross-tenant BOLA in Open Food Network
TL;DR What: POST /api/v1/customer_account_transaction in Open Food Network authorized against the class , not the record. It took customer_id straig…
MITRE CVE ID Request and Support Follow-Up: No Confirmation Email Received Despite Anti-Filter Measures
Introduction: The CVE Request Process and Its Challenges The Common Vulnerabilities and Exposures (CVE) ID request process serves as a cornerstone f…
CVE Severity: Risk-Based Prioritization
In large networks, security teams receive hundreds of CVE notifications every day. It is resource-intensive to patch all vulnerabilities at once and…
Топ самых интересных CVE за май 2026 года
Май 2026 года ознаменовался всплеском критических уязвимостей в корпоративных и потребительских технологиях. Подводим итоги месяца: три уязвимости в…
Включил отладку по Wi-Fi — получил Mamont
В начале мая на устройствах Android была обнаружена уязвимость CVE-2026-0073 , которая позволяет удаленно выполнять команды на мобильном устройстве…
CVE-2026-48710: CVE-2026-48710: Starlette BadHost HTTP Host-Header Path-Poisoning and Authentication Bypass
CVE-2026-48710: Starlette BadHost HTTP Host-Header Path-Poisoning and Authentication Bypass Vulnerability ID: CVE-2026-48710 CVSS Score: 7.0 Publish…
[Перевод] Mythos «обнаружил» CVE, уже находящийся в его обучающих данных, но это всё равно тревожит
Anthropic попала в заголовки прессы, заявив, что Claude Mythos создала «первый удалённый эксплойт ядра, обнаруженный и использованный ИИ». Мы решили…
VPS Swap Fire: A Nightmare Started by a Kernel CVE Patch
Last week, precisely on a Monday morning, the "Critical Alert" notifications on my monitor struck fear into my eyes. The systems running on my own V…