Aggregator

SGLang CVE-2026-7669 AI推理框架高危|Yudao-cloud CVE-2026-7678|WordPress CVE-2026-5337

Как главный инструмент анализа трафика превратился в главную мишень.

A vulnerability labeled as critical has been found in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/datasets.py of the component Data Endpoint. Executing a manipulation of the argument folder can lead to path traversal. This vulnerability is tracked as CVE-2026-7680. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as problematic has been detected in webaways NEX-Forms Plugin up to 9.1.11 on WordPress. The impacted element is the function submit_nex_form of the component POST Parameter Handler. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-5063. The attack may be initiated remotely. There is no available exploit.

A vulnerability marked as critical has been reported in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionality of the file backend/webserver/api/datasets.py of the component Dataset API. The manipulation of the argument DatasetId leads to authorization bypass. This vulnerability is listed as CVE-2026-7681. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Edimax BR-6428nC up to 1.16. It has been classified as critical. This affects an unknown function of the file /goform/setWAN of the component Web Interface. This manipulation of the argument pppUserName/pptpUserName causes command injection. This vulnerability is handled as CVE-2026-7683. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Edimax BR-6428nC up to 1.16. It has been declared as critical. This impacts an unknown function of the file /goform/setWAN. Such manipulation of the argument pptpDfGateway  leads to buffer overflow. This vulnerability is uniquely identified as CVE-2026-7684. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability marked as problematic has been reported in Frontend File Manager Plugin up to 23.6 on WordPress. This impacts the function wpfm_download of the component Download Endpoint. The manipulation of the argument file_id leads to authorization bypass. This vulnerability is referenced as CVE-2026-5337. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability categorized as critical has been discovered in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unknown functionality of the file src/prefect/runner/storage.py of the component GitRepository Pull Handler. The manipulation of the argument commit_sha/directories results in argument injection. This vulnerability is known as CVE-2026-7725. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in PrefectHQ prefect up to 3.6.28.dev1. It has been rated as critical. Affected by this vulnerability is the function validate_restricted_url of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. This vulnerability is traded as CVE-2026-7724. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Upgrading the affected component is advised.

A vulnerability was found in PrefectHQ prefect up to 3.6.13. It has been declared as critical. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. This vulnerability appears as CVE-2026-7723. The attack may be performed from remote. In addition, an exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in PrefectHQ prefect up to 3.6.21. It has been classified as critical. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. This vulnerability is reported as CVE-2026-7722. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

Submit #807356 / VDB-360901

Submit #807303 / VDB-360900

Submit #807256 / VDB-360899

Submit #807255 / VDB-360898

Для запуска нужны совместимая дисковая версия консоли, джейлбрейк и готовность мириться с ограничениями драйверов.

The cyber threat outlooks from CIOs and CISOs at the NASCIO Midyear Conference in Philadelphia ranged from the good to the bad to the ugly — with AI front and center.

The post A Tale of Two States: The 2026 Cybersecurity Paradox appeared first on Security Boulevard.