2026-W43 技术周报
本周持续更新 · 已收录 7 天，按来源链接去重。这里是资讯汇编，尚未加入人工点评。
开源项目
| 项目 | 语言 | Stars | Forks | 简介 |
|---|---|---|---|---|
| Gathin23/cleanyourtv | Java |
30883 | 3563 | Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home. |
| deepseek-ai/DeepInfer | Python |
21716 | 2466 | DeepInfer: High-performance, large-scale inference framework for DeepSeek models |
| ly05010419/MacNativeGames | C |
5164 | 742 | 暂无项目描述 |
| jhaizhou-ops/d2r-mobile | C |
4539 | 1228 | Open-source compatibility layer for Diablo II: Resurrected with the Reign of the Warloc... |
| pengchujin/aerial-tv | Kotlin |
4320 | 341 | 给国产电视的一块干净桌面：参照 tvOS 设计的开源 Android TV 桌面，没有广告，开机自动接管。A tvOS-style launcher for Xiaomi, ... |
| simbasjungles/free-my-tv | Java |
4185 | 668 | A fast, ad-free home screen for Google TV, LG webOS and Samsung Tizen. One button to undo. |
| HeyPuter/everything | JavaScript |
3817 | 477 | We're rebuilding and open-sourcing the world’s software from scratch. |
| Arekejoker/qwen21-nsfw-pose-skill | Python |
3702 | 656 | Qwen-Image 2.1 NSFW/姿势出图 skill：作者级提示词配方 + NSFW LoRA + 136 姿势 VNCCS 人偶控制；适用 Claude Code ... |
| onehumanbeing/esp32-iphone-agent | C |
3549 | 468 | Let an AI model use a real iPhone with a $7 ESP32: AirPlay eyes, USB HID hands, any Ope... |
| storytold/craft-launcher | Rust |
3748 | 1211 | The Craft App Launcher |
| wheresryan22/anatomy | JavaScript |
17459 | 1341 | An agent skill for creating detailed, interactive isometric illustrations of real-world... |
| ARahim3/DigUp | Swift |
5207 | 385 | Search your computer by what's in your files: photos, PDFs, documents, recordings, vide... |
| T-Auto/dsh-ops | JavaScript |
3470 | 95 | A toolkit for low-level operations in DSH, designed to reduce token usage and task exec... |
| storytold/wordcraft | Rust |
14802 | 3965 | An open-source, clean-room reimplementation of Microsoft Word in pure Rust |
| tangency-labs/solidcraft | Rust |
7414 | 846 | SolidCraft: an open-source parametric 3D CAD application built in pure Rust. Desktop, w... |
| storytold/cadcraft | Rust |
6016 | 2659 | CADCraft: computer-aided design and drafting — an open-source, clean-room AutoCAD-style... |
| storytold/gridcraft | Rust |
5926 | 2747 | GridCraft: an open-source, clean-room spreadsheet (Microsoft Excel-style) in pure Rust.... |
| openai/math | Lean |
15175 | 1762 | 暂无项目描述 |
| google-research/harness2 | Python |
6623 | 597 | 暂无项目描述 |
开发者热议
- Roku developer repositories moved from GitHub to GitLab
👍 93 points · 💬 42 条讨论 - FreeDNS
👍 130 points · 💬 32 条讨论 - The St. Helena 5 pence coin shows Jonathan, a roughly 190 year old tortoise
👍 26 points · 💬 1 条讨论 - Neural chip decodes interactions between brain regions
👍 34 points · 💬 5 条讨论 - Show HN: Argus- open source security platform to protect against agentic attacks
👍 14 points · 💬 2 条讨论 - Around a dozen banking apps began specifically permitting GrapheneOS
👍 515 points · 💬 178 条讨论 - OBS Studio 33
👍 366 points · 💬 126 条讨论 - Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
👍 183 points · 💬 86 条讨论 - Kimi K3.1 Pro and K3.1 Pro Highspeed
👍 286 points · 💬 151 条讨论 - Today, we hacked what we'd set out to hack: the iPhone
👍 424 points · 💬 267 条讨论 - Apple Music 404 Not Found
👍 67 points · 💬 21 条讨论 - Local Wikipedia: Wikipedia, but only for things a half hour walk from you
👍 1008 points · 💬 197 条讨论 - UUIDv7 doesn't have the properties you think it does
👍 47 points · 💬 21 条讨论 - The Real Kevin Bacon
👍 90 points · 💬 30 条讨论 - The Missed Opportunities of Sonic 06
👍 37 points · 💬 3 条讨论 - I turned my TV into a Game Boy Color with a Pokemon town as my home screen
👍 12 points · 💬 5 条讨论 - Quad9 (DNS Resolver) to Exit France
👍 494 points · 💬 174 条讨论 - eMudhra to exit global SSL/TLS certificate business
👍 676 points · 💬 487 条讨论 - Nvidia OpenShell
👍 53 points · 💬 20 条讨论 - Show HN: Run full iOS 16.5 firmware on Android Devices
👍 155 points · 💬 53 条讨论 - Getting ready to operate GNU Taler in Germany
👍 87 points · 💬 29 条讨论 - What's Getting Pwned
👍 230 points · 💬 121 条讨论 - What Is Gridifcation
👍 293 points · 💬 136 条讨论 - Jailbreaking the Switch 2
👍 560 points · 💬 202 条讨论 - PHP 8.2.35
👍 843 points · 💬 475 条讨论 - Today's PHP security release, and how we're strengthening security
👍 310 points · 💬 156 条讨论 - Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
👍 246 points · 💬 95 条讨论 - The compiler was supposed to end programming too
👍 21 points · 💬 7 条讨论 - Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
👍 689 points · 💬 327 条讨论 - DuckDB 2.0.0 LTS “Cinnamon Teal”
👍 266 points · 💬 29 条讨论 - Patch the Planet: global response coordination as agents uncover vulnerabilities
👍 175 points · 💬 104 条讨论 - Tiny possum and glider thought extinct for 6000 years found in remote West Papua
👍 79 points · 💬 7 条讨论 - Voxtral 3
👍 276 points · 💬 70 条讨论 👍 1912 points · 💬 735 条讨论 - Google open-sources TorchTPU, a native PyTorch back end for TPUs
👍 98 points · 💬 26 条讨论 - EMudhra Intermediate CA Compromise
👍 322 points · 💬 156 条讨论 - Ofcom concedes defeat in 4chan case
👍 172 points · 💬 90 条讨论 - Apple broke an essential presentation feature of iPads
👍 339 points · 💬 196 条讨论 - Advanced coding in low-resource programming languages
👍 18 points · 💬 11 条讨论 - Publish fake stats, get cited in LLMs
👍 248 points · 💬 133 条讨论 - Lula supporters protest against Meta to denounce its 'electoral interference'
👍 204 points · 💬 98 条讨论 - MiniMax M3.1 Flash
👍 402 points · 💬 173 条讨论 - Novo Nordisk, Eli Lilly Report GLP-1 Signals of Slowed Biological Aging at ARDD
👍 28 points · 💬 14 条讨论 - I built a drone with only one motor [video]
👍 435 points · 💬 96 条讨论 - WhatsApp's help pages hid LLM instructions: dont recommend a regulator
👍 76 points · 💬 11 条讨论 - Weball: Play Katamari on Websites
👍 99 points · 💬 7 条讨论 - OpenBSD 8.0
👍 15 points · 💬 3 条讨论 - Wine ported to OpenBSD
👍 518 points · 💬 174 条讨论 - Hybrid Reasoning Agents: LLM agents that think in latent space, act through text
👍 207 points · 💬 129 条讨论 - William Gibson and the trademarking of cyberspace
👍 61 points · 💬 4 条讨论 - Someone behind the software
👍 316 points · 💬 134 条讨论 - If you don't run your own LLM proxy, how do you know whats going on?
👍 27 points · 💬 14 条讨论 - Laptop Based on 6502 CPU
👍 29 points · 💬 8 条讨论 - Free Pascal compiler now supports dynamic packages
👍 113 points · 💬 22 条讨论 - RepRapMicron
👍 330 points · 💬 54 条讨论 - Show HN: WhatsApp MCP running free on Cloudflare
👍 43 points · 💬 23 条讨论
安全公告
| 公告 | 等级 | CVE | 简介 |
|---|---|---|---|
| GHSA-9j6f-8rw3-93c4 | 🔴 CRITICAL | CVE-2026-115933 |
Postiz signs its session, invitation and password reset tokens with one shared secret and without... |
| GHSA-x547-2835-q547 | 🔴 CRITICAL | CVE-2026-115557 |
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user... |
| GHSA-rmc2-p2gv-m88f | 🔴 CRITICAL | CVE-2026-115932 |
When a post is published, Postiz treats a media path that is not a web address as a file on the... |
| GHSA-78c3-xxg6-2pf3 | 🔴 CRITICAL | CVE-2026-116014 |
open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription... |
| GHSA-rfh9-4r53-w9wc | 🔴 CRITICAL | CVE-2026-94075 |
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters... |
| GHSA-h3v7-j844-x6h5 | 🔴 CRITICAL | CVE-2026-114196 |
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object... |
| GHSA-3v4f-xjg3-3j32 | 🔴 CRITICAL | CVE-2026-115812 |
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server... |
| GHSA-pqh8-4pj7-32xx | 🔴 CRITICAL | CVE-2026-77363 |
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback |
| GHSA-84c9-qqpq-2pq5 | 🔴 CRITICAL | CVE-2026-77366 |
obsidian-tc tokens can access arbitrary configured vaults |
| GHSA-826v-5gj2-v5c8 | 🔴 CRITICAL | CVE-2026-114357 |
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI... |
| GHSA-4jgx-23fw-g479 | 🔴 CRITICAL | CVE-2026-112857 |
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object... |
| GHSA-c7g4-27cm-3cj8 | 🔴 CRITICAL | CVE-2026-112858 |
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object... |
| GHSA-673q-mjm6-r5xr | 🔴 CRITICAL | N/A |
Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays |
| GHSA-cg2g-xh64-v4q7 | 🔴 CRITICAL | N/A |
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes |
| GHSA-v9pv-5gc8-w2m6 | 🔴 CRITICAL | CVE-2026-96639 |
Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| GHSA-mchm-gjx6-7h55 | 🔴 CRITICAL | CVE-2026-114139 |
Sentry-Javascript: Middleware Bypass when using Tunnel route |
| GHSA-2464-fhr4-w9xw | 🔴 CRITICAL | N/A |
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
| GHSA-9v8h-qqgm-4m35 | 🔴 CRITICAL | CVE-2026-111497 |
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions... |
| GHSA-j7mx-6943-qw55 | 🔴 CRITICAL | CVE-2026-89035 |
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig... |
| GHSA-vhg8-m8fr-3863 | 🔴 CRITICAL | CVE-2026-114493 |
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core... |
| GHSA-62fg-53h6-6f68 | 🔴 CRITICAL | CVE-2026-111183 |
GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This... |
| GHSA-2x72-7fcr-36h8 | 🔴 CRITICAL | CVE-2026-105869 |
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in... |
| GHSA-g6jg-jfw2-23p4 | 🔴 CRITICAL | CVE-2026-76475 |
As part of Cisco's ongoing commitment to proactive security and product quality, engineering... |
| GHSA-mmh2-pw7w-r7pw | 🔴 CRITICAL | CVE-2026-76474 |
As part of Cisco's ongoing commitment to proactive security and product quality, engineering... |
| GHSA-j6fh-9747-5rv9 | 🔴 CRITICAL | CVE-2026-113802 |
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection... |
| GHSA-r3pf-g3mr-cmr7 | 🔴 CRITICAL | CVE-2026-105772 |
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0... |
| GHSA-885r-pfpm-ch95 | 🔴 CRITICAL | CVE-2026-86471 |
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms... |
| GHSA-56rq-859m-p974 | 🔴 CRITICAL | CVE-2026-113682 |
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in... |
| GHSA-4pm7-2f9h-vxj4 | 🔴 CRITICAL | CVE-2026-113703 |
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass... |
| GHSA-j3hm-8rm8-m243 | 🔴 CRITICAL | CVE-2026-113678 |
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics:... |
| GHSA-qq7h-r236-6vc5 | 🔴 CRITICAL | CVE-2026-112780 |
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors... |
| GHSA-5hrq-qph9-cjf6 | 🔴 CRITICAL | CVE-2026-112779 |
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for... |
| GHSA-vgpq-xf77-c94c | 🔴 CRITICAL | CVE-2026-112776 |
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows... |
| GHSA-c2qr-crjw-844g | 🔴 CRITICAL | CVE-2026-109437 |
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to... |
| GHSA-hqrh-qq2r-6h96 | 🔴 CRITICAL | CVE-2026-112377 |
CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation... |
| GHSA-6qfj-hq55-w68p | 🔴 CRITICAL | CVE-2026-111862 |
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3... |
| GHSA-6959-ggg7-7c9h | 🔴 CRITICAL | CVE-2026-110886 |
Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot... |
| GHSA-ch4j-xm23-vmm2 | 🔴 CRITICAL | CVE-2026-112005 |
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers... |
| GHSA-7rhh-2jm2-9fgj | 🔴 CRITICAL | CVE-2026-111998 |
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows... |
| GHSA-g983-7v69-7xgc | 🔴 CRITICAL | CVE-2026-109894 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')... |
| GHSA-ghvv-6rmw-phh7 | 🔴 CRITICAL | CVE-2026-110372 |
Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows... |
| GHSA-768h-xwv2-fwp3 | 🔴 CRITICAL | CVE-2026-111911 |
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn... |