Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

CVE-2026-61448

### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a

来源摘录 · GitHub Advisory

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

CVE-2026-116578

### Summary `tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a templa

来源摘录 · GitHub Advisory

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

CVE-2026-116695

## Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a

来源摘录 · GitHub Advisory

Unwrapping Retail Peak Season Cyber Threats

Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend

来源摘录 · Palo Alto Unit 42

The CISO’s evolving role: Protecting and defending in the agentic era

As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity

来源摘录 · Microsoft Threat Intelligence

Generation, Not Selection: LLM Proposals for Certified Access-Control Policy Mining

Attribute-Based Access Control (ABAC) policy mining---recovering a compact, auditable policy from an access log---is pos

来源摘录 · arXiv cs.CR

Measuring Users' Security and Privacy Concerns About Third-Party Community Bots on Discord

Third-party community-based bots are central to how social platforms such as Discord work. They moderate content, manage

来源摘录 · arXiv cs.CR

SpecGuard: Detecting Multi-Turn LLM Jailbreaks via Specification-Based Runtime Monitoring

Multi-turn jailbreaks turn dialogue safety into a trace property: a violation may become identifiable only when user int

来源摘录 · arXiv cs.CR

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

CVE-2026-62013

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

来源摘录 · NVD

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privile...

CVE-2026-63190

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, f

来源摘录 · NVD

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute...

CVE-2026-89010

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command inject

来源摘录 · NVD

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwri...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file wr

来源摘录 · NVD

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially cra...

CVE-2026-97854

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitra

来源摘录 · NVD

Binance probes potential $5.8 billion crypto-theft hack

Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital ass

来源摘录 · BleepingComputer

ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old

来源摘录 · The Hacker News

GitHub Launches npm Firewall to Block Malicious Packages Before Installation

GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm p

来源摘录 · The Hacker News

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewal

来源摘录 · SecurityWeek

CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)

CVE-2026-111497

CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Sever

来源摘录 · Palo Alto Security Advisories

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

CVE-2026-115907

### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and

来源摘录 · GitHub Advisory

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

CVE-2026-115908

### Summary - **Verified version:** zip `9.0.0-pre3` - **Affected versions:** `7.2.0` and later - **Precondition:** The

来源摘录 · GitHub Advisory