Aggregator

CVE-2026-11784 | optimole Optimole Plugin up to 4.2.6 on WordPress Link replace_file ID cross-site request forgery (EUVD-2026-37848)

VulDB Recent Entries
2 weeks ago
A vulnerability classified as problematic has been found in optimole Optimole Plugin up to 4.2.6 on WordPress. Affected by this issue is the function replace_file of the component Link Handler. This manipulation of the argument ID causes cross-site request forgery. This vulnerability is registered as CVE-2026-11784. Remote exploitation of the attack is possible. No exploit is available.
vuldb.com

CVE-2026-12093 | wpinsider-1 Simple Membership Plugin up to 4.7.5 on WordPress Setting authorization (EUVD-2026-37847)

VulDB Recent Entries
2 weeks ago
A vulnerability labeled as critical has been found in wpinsider-1 Simple Membership Plugin up to 4.7.5 on WordPress. This impacts an unknown function of the component Setting Handler. Executing a manipulation can lead to missing authorization. This vulnerability is tracked as CVE-2026-12093. The attack can be launched remotely. No exploit exists.
vuldb.com

CVE-2026-10029 | eventkoi Event Koi Lite Plugin up to 1.3.13.1 on WordPress Configuration authorization

VulDB Recent Entries
2 weeks ago
A vulnerability identified as problematic has been detected in eventkoi Event Koi Lite Plugin up to 1.3.13.1 on WordPress. This affects an unknown function of the component Configuration Handler. Performing a manipulation results in missing authorization. This vulnerability is identified as CVE-2026-10029. The attack can be initiated remotely. There is not any exploit available.
vuldb.com

CVE-2026-11776 | 10web Form Maker Plugin up to 1.15.43 on WordPress groupids sql injection (EUVD-2026-37842)

VulDB Recent Entries
2 weeks ago
A vulnerability categorized as critical has been discovered in 10web Form Maker Plugin up to 1.15.43 on WordPress. The impacted element is an unknown function. Such manipulation of the argument groupids leads to sql injection. This vulnerability is referenced as CVE-2026-11776. It is possible to launch the attack remotely. No exploit is available.
vuldb.com

CVE-2026-12120 | fireplugins FireBox Popups Plugin up to 3.1.7 on WordPress Form Submission form_id information disclosure (EUVD-2026-37839)

VulDB Recent Entries
2 weeks ago
A vulnerability was found in fireplugins FireBox Popups Plugin up to 3.1.7 on WordPress. It has been declared as problematic. Impacted is an unknown function of the component Form Submission Handler. The manipulation of the argument form_id results in information disclosure. This vulnerability was named CVE-2026-12120. The attack may be performed from remote. There is no available exploit.
vuldb.com

CVE-2026-9199 | equalizedigital Equalize Digital Accessibility Checker Plugin up to 1.42.1 on WordPress Authorization Token authorization

VulDB Recent Entries
2 weeks ago
A vulnerability was found in equalizedigital Equalize Digital Accessibility Checker Plugin up to 1.42.1 on WordPress. It has been classified as critical. This issue affects some unknown processing of the component Authorization Token Handler. The manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2026-9199. The attack is possible to be carried out remotely. No exploit exists.
vuldb.com

CVE-2026-10623 | pressprimer PressPrimer Quiz Plugin up to 2.3.0 on WordPress rule_id authorization

VulDB Recent Entries
2 weeks ago
A vulnerability was found in pressprimer PressPrimer Quiz Plugin up to 2.3.0 on WordPress and classified as critical. This vulnerability affects unknown code. Executing a manipulation of the argument rule_id can lead to authorization bypass. This vulnerability is handled as CVE-2026-10623. The attack can be executed remotely. There is not any exploit available.
vuldb.com

CVE-2026-55740 | Nur-Alam39 bus-ticket bus_info.php mysqli_query busid sql injection (EUVD-2026-37851)

VulDB Recent Entries
2 weeks ago
A vulnerability has been found in Nur-Alam39 bus-ticket and classified as critical. This affects the function mysqli_query of the file bus_info.php. Performing a manipulation of the argument busid results in sql injection. This vulnerability is known as CVE-2026-55740. Remote exploitation of the attack is possible. No exploit is available. Applying a patch is the recommended action to fix this issue.
vuldb.com

CVE-2026-11357 | stellarwp Kadence Blocks Plugin up to 3.7.5 on WordPress License Key information disclosure (EUVD-2026-37843)

VulDB Recent Entries
2 weeks ago
A vulnerability, which was classified as problematic, was found in stellarwp Kadence Blocks Plugin up to 3.7.5 on WordPress. Affected by this issue is some unknown functionality of the component License Key Handler. Such manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-11357. The attack may be launched remotely. There is no exploit available.
vuldb.com

CVE-2026-11360 | algolplus Advanced Order Export for WooCommerce Plugin up to 4.0.10 on WordPress Endpoint stripslashes_deep sort_direction sql injection (EUVD-2026-37844)

VulDB Recent Entries
2 weeks ago
A vulnerability, which was classified as critical, has been found in algolplus Advanced Order Export for WooCommerce Plugin up to 4.0.10 on WordPress. Affected by this vulnerability is the function stripslashes_deep of the component Endpoint. This manipulation of the argument sort_direction causes sql injection. This vulnerability appears as CVE-2026-11360. The attack may be initiated remotely. There is no available exploit.
vuldb.com

CVE-2026-9860 | vanyukov Offload, AI & Optimize with Cloudflare Images cf-images Plugin wp-config.php sanitize_text_field unrestricted upload (EUVD-2026-37840)

VulDB Recent Entries
2 weeks ago
A vulnerability classified as critical was found in vanyukov Offload, AI & Optimize with Cloudflare Images cf-images Plugin up to 1.10.2 on WordPress. Affected is the function sanitize_text_field of the file wp-config.php. The manipulation of the argument account-id results in unrestricted upload. This vulnerability is reported as CVE-2026-9860. The attack can be launched remotely. No exploit exists.
vuldb.com

美国暂缓将 DeepSeek 加入黑名单

Solidot
2 weeks ago
美国暂缓将 DeepSeek 和长鑫存储等公司加入贸易黑名单以免中美关系再次紧张。如果被加入贸易实体清单，美国公司未经许可不得向其出口商品、软件和技术，而许可通常不会被批准。美国自去年十月以来就没有再更新实体清单。是否将某个实体列入黑名单的决定由一个跨部门委员会做出，该委员会成员包括美国商务部、国防部、能源部、国务院，偶尔还有财政部官员。该委员会已批准将一些公司列入黑名单，但商务部尚未公布名单。

Securing digital keys when your phone unlocks the car

Help Net Security
2 weeks ago

In this interview with Help Net Security, Alysia Johnson, President of the Car Connectivity Consortium (CCC), explains how the CCC Digital Key has grown from a single-brand feature into a standard meant to work across phones, automakers, and suppliers. She talks through what changed with Version 4, why the team focused on interoperability and testing instead of one new threat, and how NFC fallback access stays protected. She also covers fast credential revocation when a … More →

The post Securing digital keys when your phone unlocks the car appeared first on Help Net Security.

Mirko Zorz

Google’s open standard for AI agents to discover and verify tools

Help Net Security
2 weeks ago

AI agents depend on tools, skills, and other agents spread across many teams, organizations, and platforms. These capabilities live in separate systems with their own registries, and an agent working in one environment has limited means to locate and connect to a resource hosted somewhere else. Google addressed this gap with Agentic Resource Discovery, an open specification for publishing, discovering, and verifying AI capabilities across the web. It allows tools and services to be shared … More →

The post Google’s open standard for AI agents to discover and verify tools appeared first on Help Net Security.

Anamarija Pogorelec

Managed ad