Aggregator

A vulnerability, which was classified as critical, was found in masaakitanaka Booking Package Plugin up to 1.7.20 on WordPress. The impacted element is an unknown function of the file /wp-json/booking-package/v1/request of the component REST API Endpoint. The manipulation of the argument email results in sql injection. This vulnerability is identified as CVE-2026-15335. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as critical, has been found in solacewp Starter Template feature up to 1.5.3 on WordPress. The affected element is the function wp_ajax_nopriv_ of the file /wp-admin/profile.php of the component Authorization. The manipulation of the argument nonce leads to authorization bypass. This vulnerability is referenced as CVE-2026-13250. Remote exploitation of the attack is possible. No exploit is available.

Forg365 is a phishing-as-a-service platform that targets Microsoft accounts, combining AI-powered phishing, session theft, and post-compromise mailbox access in a single operator panel The platform is reportedly distributed through Telegram, where criminals can access a 30-day trial, pay about per month, or choose an annual plan. This subscription model shows how phishing operations are becoming […]

The post Forg365 Phishing Platform Using AI to Attack Microsoft 365 Accounts appeared first on Cyber Security News.

Как на китайском форуме всего за $6000 слили систему тотальной слежки за Ватиканом и Россией.

2026年7月8日，安卡拉，北约峰会第二天傍晚。观察者们发现了一件不寻常的事：那架全新的波音747-8，涂着

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

德国宝马表示，中国市场销量骤降拖累了上半年的总销量，不过集团在其他市场实现了增长。这家德国汽车制造商周五表示，今年一至六月共交付约116万辆汽车，同比减少4.2%。其中，中国市场销量大跌20%，仅第二

Просто установить заплатку безопасности теперь недостаточно.

原来电动车赛车，卷的根本不是马力。

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

CISA has published a candid after-action account revealing that a contractor accidentally exposed the agency’s own AWS GovCloud credentials and Infrastructure-as-Code repositories in a personal, public GitHub account, triggering an internal incident response and a rare public “lessons learned” disclosure from the federal cybersecurity agency itself. On Friday, May 15, CISA’s incident response began after […]

The post CISA Details “Lessons from a Cyber Incident” After AWS GovCloud Credentials Leak appeared first on Cyber Security News.

A vulnerability classified as problematic was found in lustmored Lockme calendars integration Plugin up to 2.11.0 on WordPress. Impacted is the function register_setting/update_option of the component Plugin Settings. Executing a manipulation of the argument client_id/client_secret/id_prefix/api_domain can lead to cross site scripting. The identification of this vulnerability is CVE-2026-3367. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in gallerycreator SimpLy Gallery Plugin up to 3.3.3.1 on WordPress. This issue affects the function pgc_sgb_render_callback of the component Block Attributes. Performing a manipulation of the argument sliderMaxHeight results in cross site scripting. This vulnerability was named CVE-2026-5743. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as problematic has been identified in stylemix Motors Plugin up to 1.4.112 on WordPress. This vulnerability affects unknown code of the component Comment Content. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-13114. The attack can be launched remotely. No exploit exists.

A vulnerability marked as critical has been reported in wpswings Points and Rewards for WooCommerce Plugin up to 2.10.1 on WordPress. This affects the function wps_wpr_generate_custom_wallet of the component Authorization. This manipulation of the argument nonce causes authorization bypass. This vulnerability is handled as CVE-2026-10628. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as problematic has been found in 2coders Mux Video Uploader Plugin up to 1.1.4 on WordPress. Affected by this issue is the function muxvideo_enqueue_settings_script of the component Settings Handler. The manipulation results in information disclosure. This vulnerability is known as CVE-2026-7544. It is possible to launch the attack remotely. No exploit is available.

Самое опасное в этой утечке — не сама дыра в системе, а то, что власти отказались её признавать.