Vulnerability analysis

CVE-2025-34291 是在 Langflow AI 代理与工作流平台中发现的一个严重漏洞链，安全评分达到 CVSS v4.0: 9.4。该漏洞允许攻击者通过诱导用户访问恶意网页，实现对 Langflow 实例的完全账户接管和远程代码执行（RCE）。

CVE-2025-55182漏洞受影响版本中React 19引入，Next.js App Router 将来自客户端的 RSC 序列化数据直接交由 ReactFlightReplyServer 反序列化，未对模型结构、引用路径与 Server Reference 元数据进行充分校验。攻击者可构造恶意 RSC请求，引导 parseModelString、getOutlinedModel、loadServerReference、initializeModelChunk 等解析链路进入异常状态，在模块加载与引用绑定阶段控制调用目标，最终在 Next.js 中可触发任意服务端代码执行。

This article introduces the actual vulnerability mining of mobile APP third-party SDK conducted by security researchers Li Bo and Zhang Xin of 360 Vulpecker Team. 360 Vulpecker Team focuses on the field of Android system and application security attack and defense, and has a self-developed automated system for Android application security auditing. This article starts from the security status of third-party SDKs, discusses the security risks brought by SDK integration, and introduces in detail the vulnerability risks and attack methods of different SDKs. The vulnerability exploitation methods of push SDK and sharing SDK are analyzed through examples, and the scope of impact of relevant vulnerabilities on applications is pointed out. Finally, some thoughts are put forward to arouse readers' attention and in-depth thinking on the security of mobile APPs.

Google Android 14 input method information disclosure vulnerability, due to side channel information leakage, there is a possible way to determine whether an application is installed without querying permissions. This may lead to local information disclosure without requiring additional execution permissions. Exploitation of this vulnerability requires no user interaction.

On November 24, 2021, the Alibaba Cloud security team reported the Apache Log4j2 remote code execution vulnerability to Apache officials. 01 Vulnerability Description Apache Log4j2 is an excellent Java logging framework. …