Aggregator

A CVSS score 9.3 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N severity vulnerability discovered by 'Habibullo Izzatilloyev' was reported to the affected vendor on: 2026-07-10, 6 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N severity vulnerability discovered by 'Minh Giang (@itscysamu) of TrendAI Zero Day Initiative and Taha Siddiqi (@_atomiz_) of TrendAI Research' was reported to the affected vendor on: 2026-07-10, 6 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.3 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N severity vulnerability discovered by 'Habibullo Izzatilloyev' was reported to the affected vendor on: 2026-07-10, 6 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.5 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Phan Vinh Khang of Viettel Cyber Security' was reported to the affected vendor on: 2026-07-10, 6 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 6.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L severity vulnerability discovered by 'Xiaobye(@xiaobye_tw) of DEVCORE Research Team' was reported to the affected vendor on: 2026-07-10, 6 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Bobby Gould (@bobbygould5) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-07-10, 6 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

Старый трюк с симлинками обманул шесть популярных ИИ-кодеров.

Passwords remain part of many workforce authentication flows in financial organizations, making phishing and credential theft major identity security risks, according to a new Secret Double Octopus report. Key challenges preventing universal implementation of phishing-resistant MFA (Source: Secret Double Octopus) Workforce authentication trends Banks and financial organizations use a mix of authentication methods, combining phishing-resistant technologies with methods that remain vulnerable to phishing attacks. Password plus OTP remains more common among organizations with up to … More →

The post Only 28% of financial workforce MFA is phishing-resistant appeared first on Help Net Security.

A vulnerability, which was classified as critical, was found in wpmanageninja Fluent Forms Plugin up to 6.2.1. This impacts an unknown function of the component Payment Cancellation. Executing a manipulation of the argument subscription_id can lead to improper authorization. This vulnerability is handled as CVE-2026-5069. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as very critical, has been found in OpenStack Ironic up to 29.0.5/32.0.1/35.0.1/37.0.0. This affects an unknown function of the component Authorization. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2026-44918. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as critical was found in OpenStack Ironic up to 29.0.5/32.0.1/35.0.1/37.0.0. The impacted element is the function send_raw of the component IPMI Management Interface. Such manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-54423. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in thimpress WP Hotel Booking Plugin up to 2.3.1. The affected element is an unknown function of the component Booking. This manipulation of the argument check_in_date/check_out_date causes cross site scripting. This vulnerability appears as CVE-2026-11392. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as critical has been identified in arraytics WPCafe Plugin up to 3.0.14. Impacted is an unknown function of the component Notification Flow Workflows. The manipulation results in authorization bypass. This vulnerability is reported as CVE-2026-11818. The attack can be launched remotely. No exploit exists.

База данных CrowdStrike по методам взлома нейросетей превысила 200 техник.

A vulnerability marked as critical has been reported in WebRehab Super Forms Plugin up to 6.3.313. This issue affects the function submit_form of the component AJAX Handler. The manipulation leads to unrestricted upload. This vulnerability is documented as CVE-2026-14894. The attack can be initiated remotely. There is not any exploit available.

Here’s a look at the most interesting products from the past week, featuring releases from Attestiv, Automox, Codenotary, and First Recon AI. Codenotary launches AI security platform that learns from AI agent behavior Codenotary has announced AgentMon 3, the latest generation of its enterprise AI security platform, introducing adaptive runtime security policies. These continuously evolve as AI agents operate across an organization by learning from customer-specific workflows, observed behavioral patterns, and threats. Automox MCP Server … More →

The post New infosec products of the week: July 10, 2026 appeared first on Help Net Security.

还有社区伙伴购票专属优惠，速来！

A vulnerability labeled as problematic has been found in wordpresschef Salon Booking System Plugin up to 10.30.32. This vulnerability affects the function setCustomText of the file translate-constants.php of the component Admin Interface. Executing a manipulation of the argument Value can lead to cross-site request forgery. This vulnerability is registered as CVE-2026-15070. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as problematic has been detected in wpazleen Post Export Import with Media Plugin up to 1.13.1. This affects the function ajax_import_media_start of the file shell.php of the component File Upload/Validation. Performing a manipulation results in unrestricted upload. This vulnerability is cataloged as CVE-2026-13430. It is possible to initiate the attack remotely. There is no exploit available.