Skip to content

已发布刊物 · 免费预览

Ariquo Security News Stream — 2026-11-10

发布：　摘要更新：

59 daily news events from 77 source observations.

本期内容预览

1. CISA Adds Four Known Exploited Vulnerabilities to Catalog | CISA

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

2. CVE-2026-110468 WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint.

CVE-2026-110468 WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and … cve.org/CVERecord?id=C…

3. VU#188754 - FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities

Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices. Exploitation may enable an attacker to remotely control the rover, access audiovisual streams, or pivot into the user’s network.

4. Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that...

Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on `0.0.0.0:4195`, but authentication is disabled by default and there is no authentication gate protecting the stream CRUD routes.

5. The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request...

The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code execution. This vulnerability is being actively exploited in the wild.

6. Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write...

Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.

7. WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to...

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.

8. VU#385711 - PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability

PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration file.

9. ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)

The `readPsd()` function in `ag-psd` accepts a `totalMemoryLimit` option to cap memory usage when parsing untrusted PSD files, but this limit is never forwarded to the layer image buffer allocation path. A property name mismatch (`totalMemoryLimit` vs.

10. Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

The `read_file` MCP tool in `codebase_rag/mcp/tools.py` contains a path traversal vulnerability in its paginated branch (when `offset` or `limit` is supplied). The handler constructs a file path using `Path(self.project_root) / file_path` without subsequently validating that the resolved path remains within the configured project root.

11. tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

The HTTP server mode of `@tsparticles/mcp-server` accumulates all incoming request body chunks into an in-memory `Buffer[]` array with no size limit before calling `JSON.parse`. An unauthenticated remote attacker can stream an arbitrarily large body to `POST /mcp`, exhausting the Node.js process memory and causing a Denial of Service.

12. Malicious bee-js npm Release and Swarm Desktop Releases Deliver SleepyDuck Ethereum C2 Backdoor | Socket

Compromised maintainer accounts pushed malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2, reusing SleepyDuck’s Ethereum-addressed C2 infrastructure.

13. On the hunt for ARTEX: understanding agentic attacks in AWS environments | Datadog Security Labs

In October 2026, Datadog observed in-the-wild activity from ARTEX, an AI-native penetration framework, against several AWS environments, with a focus on accessing financial data.

14. QNAP Warns Users as Plex2Shell Flaws Are Used to Hack NAS Devices

Taiwanese vendor QNAP urges users to update Plex Media Server after reports of NAS compromises through the Plex2Shell vulnerability chain.

15. Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

The Traffic Manager `Tunnel` gRPC streaming endpoint accepts a session ID from the first bytes of the client-controlled message payload. No verification confirms the caller owns the session.

16. zizmor: Debug logging prints available GitHub credentials in cleartext

zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables (`GH_TOKEN`, `GITHUB_TOKEN`, `ZIZMOR_GITHUB_TOKEN`), or the corresponding command-line options (`--gh-token`, `--github-token`, `--zizmor-github-token`) are included in the debug representation of the parsed application configuration and written to stderr.

17. Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences

Any OIDC client registered in Pocket ID that has valid credentials (client secret or federated identity) can obtain a Pocket ID-signed access token scoped to any other registered client or arbitrary audience string. In deployments where services use the client credentials grant and validate incoming bearer tokens against Pocket ID's JWKS, this allows a compromised or malicious client to bypass audience-based access controls and present tokens to resource servers it should not be authorized to access.

18. CVE-2026-113364 Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a re

CVE-2026-113364 Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a re

19. CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.

20. isomorphic-git: 3 security advisories

GitHub published 3 security advisories affecting isomorphic-git. Reported issues include: isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout; isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS); isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE).

21. Binance denies data breach after alleged ShinyHunters claims

Binance, the world's largest crypto exchange, has denied claims of a new security breach made by a threat actor using the 'ShinyHunters' handle on a newly emerged underground cybercrime forum.

22. Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization

ShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences (e.g. `../../../../tmp/pwned.txt`) in entry names will have those entries reproduced verbatim in the output shadow JAR.

23. Attackers backdoor trusted AWS integrations to steal secrets

Unknown attackers used compromised identity and access management (IAM) credentials associated with Qubole's AWS account to access customer AWS environments, stealing secrets and other sensitive data from S3 buckets.

24. Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today.

25. Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns

Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns.

26. Russian cloud firm Beget rebuilds from scratch after data wiper attack

A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said.

27. NIST: Solo Shouldn't Mean Less Secure

Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.

28. French bank Crédit Mutuel Arkéa hit in cyberattack — up to $133 million stolen and systems shut down | TechRadar

Crédit Mutuel Arkéa, a major French banking and financial services group, has confirmed it recently suffered a cyberattack that resulted in the theft of around $133 million.

29. Another huge data breach hits a major Japanese company — Iris Ohyama attack exposes info of 7.7 million customers | TechRadar

Major Japanese consumer goods manufacturer Iris Ohyama has confirmed suffering a cyberattack which saw it lose data on 7.7 million people.

30. Revolve Puts Data Breach Victim Count at 1.5 Million - SecurityWeek

Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals.

31. Amplifon Americas Data Breach Impacts 1.3 Million - SecurityWeek

SecurityWeek has emailed Amplifon for additional information on the data breach and confirmation on impact and will update this article if the company responds.

32. $133 million stolen from French bank via exploited service provider - Help Net Security

Attackers siphoned an estimated $133 million from Crédit Mutuel Arkéa by using the bank’s own account to wire money to other banks, from where it was possibly converted into cryptocurrency.

33. Over 3 Million People Hit by Frontline Education Data Breach - SecurityWeek

Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students.

34. Google DeepMind's AI Agents Make 1024-Bit RSA Keys Cheaper to Attack - SecurityWeek

Working with cryptographers, DeepMind’s AI agents cut the cost of forging RSA-1024 signatures and found a cheaper way to factor keys.

35. Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf...

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

36. Attackers Searching for SAP Netweaver Webshells - SANS ISC

This request is part of a larger campaign to exploit SAP NetWeaver or to find already installed webshells.

37. rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of...

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which runs without authentication in affected deployments. Laravel's CallQueuedHandler unserializes the job without class restrictions, allowing attackers to instantiate the existing App\\Jobs\\TaskDownloadRun class and invoke an attacker-controlled Artisan command.

38. A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825...

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint.

39. LND update blocks one attack route, not the Linux flaw

LND’s October 30 update blocks a demonstrated attack route, but affected, unpatched Linux hosts still need a kernel fix and reboot.

40. esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

The documented `web.NewHandler` static file server can read files outside `Config.AppDir` when the request path contains URL-encoded dot-segments such as `%2e%2e`. Go's `ServeMux` redirects plain `/../` paths, but it passes encoded dot-segments to the handler after decoding `r.URL.Path`.

41. A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting...

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler.

已展示本期 59 条中的 41 条。注册并开通相应订阅后，可在阅读页查看完整刊物。