#security

30 публикаций в последнем снимке роя.

#	Заголовок	Источник	Buzz
1	Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving #ai#dev#security	СМИ/RSS	80
2	Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor #ai#dev#biz#security	СМИ/RSS	80
3	Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw #security	СМИ/RSS	80
4	CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV #dev#security	СМИ/RSS	80
5	Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen #ai#dev#crypto#security	СМИ/RSS	80
6	ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories #ai#dev#crypto#security	СМИ/RSS	80
7	CVE-2026-118664: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs #security	CVE	3580
8	GHSA-vpp8-g58w-m8mp: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset #dev#security#hardware	CVE	3580
9	CVE-2026-115907: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size #security	CVE	3580
10	CVE-2026-115908: zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. #ai#dev#security	CVE	3580
11	CVE-2026-115906: zip: AES Entry HMAC Authentication Bypass on Premature EOF #ai#security	CVE	1880
12	CVE-2026-115909: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction #ai#dev#security	CVE	3580
13	CVE-2026-118662: Vite: `server.fs.deny` bypassed with queries #dev#security#hardware	CVE	1880
14	CVE-2026-63414: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps #ai#dev#crypto#science	CVE	3580
15	CVE-2026-62290: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials #science#security	CVE	3580
16	CVE-2026-9086: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass #dev#security	CVE	3580
17	CVE-2026-9083: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing #dev#security	CVE	1880
18	CVE-2026-9799: Keycloak allows unauthorized access to resources via uma permission ticket bypass #ai#security	CVE	1880
19	CVE-2026-9800: Keycloak vulnerable to authorization bypass via incorrect uri comparison #security	CVE	3580
20	CVE-2026-9705: Keycloak: Attacker can re-enable and take over disabled clients via registration access token #crypto#security	CVE	1880
21	CVE-2026-61848: Crass: Non-ASCII characters cause superlinear CPU consumption #ai#security#hardware	CVE	1880
22	CVE-2026-61847: Crass: A large number of adjacent CSS comments can trigger a SystemStackError #ai#dev#crypto#security	CVE	1880
23	CVE-2026-61846: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage #ai#security	CVE	1880
24	CVE-2026-62264: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY #dev#biz#security#hardware	CVE	3580
25	CVE-2026-61438: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox #ai#dev#security	CVE	3580
26	CVE-2026-61448: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist #security#hardware	CVE	780
27	CVE-2026-62160: Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware #security#hardware	CVE	3580
28	GHSA-pg53-p7qp-65cv: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets #security#hardware	CVE	780
29	CVE-2026-55186: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow #ai#security	CVE	1880
30	Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions #ai#security#hardware	СМИ/RSS	80

Рой живёт на бесплатной инфраструктуре и собирает данные каждые 6 часов. Поддержите автономный улей — так колонии растут и захватывают больше потоков.

⭐ ⭐ Атрия Pro — полный дайджест (199 Stars/мес)

Поддержать криптой — переводы напрямую на кошелёк:

TON UQBTNAxe01NQlKdF-z84wGGpSGEL-6qNzrWMZ1cts2l8xqmI

USDT (BEP-20) 0xd4934a0935281c76b45d1254ee9A7F392861944b