Aggregator

A vulnerability classified as problematic has been found in creativewerkdesigns WPFAQBlock Plugin up to 1.1 on WordPress. The impacted element is the function wpfaqblock of the component Shortcode Handler. This manipulation causes cross site scripting. This vulnerability appears as CVE-2026-1093. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in seosbg Survey Plugin up to 1.1 on WordPress. This affects an unknown function of the component Setting Handler. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-1247. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in gbsdeveloper Multi Post Carousel by Category Plugin up to 1.4 on WordPress. This impacts the function post_slides_shortcode of the component Shortcode Handler. Performing a manipulation of the argument slides results in cross site scripting. This vulnerability is known as CVE-2026-1275. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability, which was classified as critical, was found in eagerterrier MimeTypes Link Icons Plugin up to 3.2.20 on WordPress. Affected is an unknown function. Executing a manipulation can lead to server-side request forgery. This vulnerability is handled as CVE-2026-1313. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability has been found in ketanmujumdar Mandatory Field Plugin up to 1.6.8 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Setting Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-1278. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability was found in suifengtec WP Posts Re-order Plugin up to 1.0 on WordPress and classified as problematic. Affected by this issue is the function cpt_plugin_options of the component Setting Handler. The manipulation results in cross-site request forgery. This vulnerability was named CVE-2026-1378. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability was found in OpenClaw up to 2026.2.22. It has been declared as critical. The impacted element is an unknown function. The manipulation results in reliance on untrusted inputs in a security decision. This vulnerability is known as CVE-2026-32898. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenClaw up to 2026.2.25. It has been rated as critical. This affects the function message_changed of the component Message Handler. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2026-32895. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability categorized as problematic has been discovered in OpenClaw up to 2026.2.21. This issue affects some unknown processing. The manipulation of the argument gateway.auth.token results in key management error. This vulnerability is known as CVE-2026-32897. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability identified as problematic has been detected in OpenClaw up to 2026.2.24. Impacted is an unknown function. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2026-32899. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability described as critical has been identified in OpenClaw up to 2026.2.20. Affected by this vulnerability is an unknown functionality of the component BlueBubbles Plugin. The manipulation results in missing authentication. This vulnerability was named CVE-2026-32896. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

好的，我现在需要帮用户总结一篇文章的内容，控制在100字以内。首先，我得仔细阅读用户提供的文章内容，理解其主要信息。 文章主要介绍了一个名为DVRTC的项目，旨在填补VoIP和WebRTC安全测试方面的空白。它详细描述了几个漏洞场景，比如Kamailio SIP代理的枚举、SQL注入、digest认证泄露，rtpengine的媒体泄漏和注入，coturn的硬编码凭据和宽松策略，以及Asterisk的弱密码问题。此外，还有7个练习和一个在线实例。 接下来，我需要将这些信息浓缩到100字以内。重点包括DVRTC的目的、使用的组件及其漏洞，以及提供的练习和在线实例。要确保语言简洁明了，直接描述内容，不需要使用特定的开头词。 最后，检查字数是否符合要求，并确保所有关键点都被涵盖。 DVRTC是一个专注于VoIP和WebRTC安全测试的平台，通过部署Kamailio、Asterisk、rtpengine和coturn等组件模拟漏洞场景，并提供7个实践练习和在线实例供学习使用。

The official Telnyx Python SDK on PyPI was compromised this morning as part of an escalating, weeks-long supply chain campaign orchestrated by the threat actor group TeamPCP. Malicious versions 4.87.1 and 4.87.2 of the telnyx package were uploaded to PyPI at 03:51 UTC on March 27, 2026, with the payload executing silently at import time […]

The post Telnyx PyPI Package With 742,000 downloads Compromised in TeamPCP Supply Chain Attack appeared first on Cyber Security News.

AFC Ajax, the Dutch football club from Amsterdam, disclosed that an unknown hacker gained access to parts of its IT systems and obtained the email addresses of a few hundred people. The hack exploited vulnerabilities in Ajax’s app and website, including exposed APIs and shared access keys. The club stated that names, email addresses, and dates of birth were accessed for fewer than 20 individuals subject to a stadium ban. An RTL journalist, who was … More →

The post Ajax data breach exposed season tickets, supporter bans open to tampering appeared first on Help Net Security.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an Aquasecurity Trivy flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Aquasecurity Trivy flaw, tracked as CVE-2026-33634 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. On March 19, 2026, attackers used compromised credentials to release a malicious […]

嗯，用户让我总结这篇文章的内容，控制在100字以内，而且不需要特定的开头。首先，我需要快速浏览文章内容，抓住主要信息。 文章讲的是美国CISA将Aquasecurity Trivy的一个漏洞加入已知被利用的漏洞目录。这个漏洞CVE-2026-33634，CVSS评分9.3，属于高危。攻击者在3月19日利用泄露的凭证发布了恶意版本Trivy v0.69.4，并篡改GitHub Actions，用于窃取敏感数据。这是供应链攻击的一部分，开始于2月底。虽然凭证被轮换，但没有同时进行，导致攻击者可能继续访问。 受影响的组件包括Trivy二进制文件、容器镜像和GitHub Actions。已经确定了安全版本，但运行过受损版本的系统被视为暴露。建议移除受影响的工件、轮换所有密钥，并审查日志寻找可疑活动。GitHub Actions应固定到不可变的提交哈希而不是版本标签。 根据BOD 22-01指令，联邦机构必须在4月9日前修复漏洞。专家建议私营组织也检查目录并修复基础设施中的漏洞。 总结的时候要包含CISA添加漏洞到目录、漏洞细节（CVE编号和评分）、攻击事件的时间和影响、以及修复措施和截止日期。控制在100字以内，直接描述内容。 美国网络安全与基础设施安全局（CISA）将Aquasecurity Trivy的一个高危漏洞（CVE-2026-33634，CVSS评分9.3）加入已知被利用的漏洞目录。该漏洞源于3月19日的供应链攻击事件，攻击者利用泄露凭证发布恶意Trivy版本并篡改GitHub Actions以窃取敏感数据。建议受影响组织移除受损工件、轮换密钥并审查日志。CISA要求联邦机构于4月9日前修复此漏洞以应对潜在威胁。

Неприятную правду долго «прятали под ковёр», а когда терпение лопнуло, ограничились сухой отпиской.

我们希望成为客户在安全能力建设路上长期的同路人。

A pro-Ukrainian group called Bearlyfy has been attributed to more than 70 cyber attacks targeting Russian companies since it first surfaced in the threat landscape in January 2025, with recent attacks leveraging a custom Windows ransomware strain codenamed GenieLocker. "Bearlyfy (also known as Labubu) operates as a dual-purpose group aimed at inflicting maximum damage upon Russian businesses;

嗯，用户让我总结这篇文章，控制在一百个字以内。首先，我需要快速浏览文章内容，抓住主要信息。 文章讲的是一个叫Bearlyfy的黑客组织，支持乌克兰，攻击俄罗斯公司。他们使用了GenieLocker这种定制的勒索软件。攻击手段包括利用外部服务和漏洞应用，投放工具如MeshAgent来远程访问和加密数据。此外，他们还与PhantomCore和Head Mare等其他组织合作。赎金金额高达数万美元，约五分之一的受害者支付了赎金。 现在要将这些信息浓缩到100字以内。要确保涵盖关键点：组织名称、支持立场、攻击目标、使用的工具、攻击手段、合作组织以及赎金情况。 可能的结构是：Bearlyfy支持乌克兰，攻击俄罗斯公司，使用GenieLocker勒索软件，利用漏洞和工具进行攻击，并与PhantomCore等合作，赎金高且部分支付。 检查字数是否在限制内，并确保语句通顺。 一个支持乌克兰的黑客组织Bearlyfy自2025年1月以来对俄罗斯公司发动了超过70次网络攻击，使用定制Windows勒索软件GenieLocker进行加密和破坏。该组织通过利用外部服务和漏洞应用获取初始访问权限，并使用工具如MeshAgent进行远程控制。其攻击手段还包括与PhantomCore等其他支持乌克兰的组织合作，并通过心理压力迫使受害者支付赎金。赎金金额高达数万美元，约五分之一的受害者选择支付。