Aggregator

马年伊始，愿大家都能做自己领域的黑马。既有执缰扬鞭的果敢，也有运筹帷幄的定力；在复杂的逻辑与纷扰的世事中，保持清醒的洞察，守住内心的平和。 新年快乐！

A vulnerability identified as problematic has been detected in Blog2Social Plugin up to 8.7.4 on WordPress. Impacted is the function curationDraft. The manipulation of the argument ID leads to missing authorization. This vulnerability is traded as CVE-2026-1942. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability categorized as problematic has been discovered in Business Directory Plugin up to 6.4.20 on WordPress. This issue affects the function wpbdp_ajax of the component Requests Handler. Executing a manipulation can lead to missing authorization. This vulnerability appears as CVE-2026-1656. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in WPNakama Plugin up to 0.6.5 on WordPress. It has been rated as critical. This vulnerability affects unknown code of the file /wp-json/WPNakama/v1/boards of the component REST API Endpoint. Performing a manipulation of the argument order results in sql injection. This vulnerability is reported as CVE-2026-2495. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in Plus Addons for Elementor Plugin up to 6.4.7 on WordPress. It has been declared as critical. This affects the function tpae_create_page of the component AJAX Handler. Such manipulation of the argument post_type leads to improper authorization. This vulnerability is documented as CVE-2026-2386. The attack can be executed remotely. There is not any exploit available.

Кубиты + самодиагностика = смерть. Китайские физики взломали эту формулу навсегда.

A vulnerability was found in SiteOrigin Widgets Bundle Plugin up to 1.70.4 on WordPress. It has been classified as critical. Affected by this issue is the function siteorigin_widget_preview_widget_action. This manipulation causes missing authorization. This vulnerability is registered as CVE-2026-2127. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in User Submitted Posts Plugin up to 20260113 on WordPress and classified as critical. Affected by this vulnerability is the function usp_get_submitted_category of the component POST Request Handler. The manipulation of the argument Category results in improper authentication. This vulnerability is cataloged as CVE-2026-2126. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in BeRocket Advanced AJAX Product Filters Plugin up to 3.1.9.6 on WordPress and classified as critical. Affected is the function shortcode_check of the component Shortcode Handler. The manipulation leads to deserialization. This vulnerability is listed as CVE-2026-1426. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, was found in WP All Export Plugin up to 1.4.14 on WordPress. This impacts an unknown function of the component Export Download Endpoint. Executing a manipulation of the argument magic hash can lead to information disclosure. This vulnerability is tracked as CVE-2026-1582. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as critical, has been found in WP Import Plugin up to 7.36 on WordPress. This affects an unknown function of the component Filename Handler. Performing a manipulation of the argument file_name results in sql injection. This vulnerability is identified as CVE-2026-1317. The attack can be initiated remotely. There is not any exploit available.

Enterprise security teams rely on open source across infrastructure, development pipelines, and production applications, even when they do not track it as a separate category of technology. Open source has become a default building block in many environments, and the operational risks now look like standard enterprise security problems: patch delays, version sprawl, and aging platforms that stay online longer than planned. TuxCare’s 2026 Open Source Landscape Report describes an open source footprint that continues … More →

The post Everyone uses open source, but patching still moves too slowly appeared first on Help Net Security.

A vulnerability classified as critical was found in Brevo Plugin up to 3.3.0 on WordPress. The impacted element is an unknown function of the file /wp-json/mailin/v1/mailin_disconnect of the component REST API Endpoint. Such manipulation of the argument ID leads to authorization bypass. This vulnerability is referenced as CVE-2025-14799. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as critical has been found in Lester Chan WP-DownloadManager Plugin up to 1.69 on WordPress. The affected element is an unknown function. This manipulation of the argument File causes path traversal. The identification of this vulnerability is CVE-2026-2426. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as problematic has been identified in zlib up to 1.3.1. Impacted is the function crc32_combine64/crc32_combine_gen64. The manipulation results in improper validation of specified quantity in input. This vulnerability was named CVE-2026-27171. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in Microsoft Windows Admin Center up to 2.6.3. This issue affects some unknown processing. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-26119. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Honeywell I-HIB2PI-UL 2MP IP, SMB NDAA MVO-3, PTZ WDR 2MP 32M and 25M IPC. This vulnerability affects unknown code of the component API Endpoint. Executing a manipulation can lead to missing authentication. This vulnerability is handled as CVE-2026-1670. The attack can be executed remotely. There is not any exploit available.

A vulnerability identified as problematic has been detected in Tanium Enforce Recovery Key Portal up to 1.62.4. This affects an unknown part of the component File Handler. Performing a manipulation results in incorrect permission assignment. This vulnerability is known as CVE-2026-1344. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in Pegasystems Pega Infinity up to 25.1.1. Affected by this issue is some unknown functionality of the component User Interface. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-62183. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.