Aggregator

Microsoft 365 helps keep services running, but protecting and recovering business data remains your responsibility. Acronis breaks down five gaps organizations should consider when evaluating Microsoft 365 data protection. [...]

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure. According to findings from Broadcom-owned Symantec and Carbon Black, the backdoor was deployed against a major U.S. services firm. The name of the company was

International law enforcement agencies cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish botnet and the Evil Corp Russian cybercrime group. [...]

В Беларуси поймали хитрого криптопредпринимателя.

Currently trending CVE - Hype Score: 7 - Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores ...

Currently trending CVE - Hype Score: 7 - Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join ...

Currently trending CVE - Hype Score: 1 - A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does ...

Currently trending CVE - Hype Score: 1 - LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.

Currently trending CVE - Hype Score: 3 - A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS ...

A vulnerability has been found in Bricksable for Bricks Builder Plugin up to 1.6.83 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-56009. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, was found in OceanWP Ocean Product Sharing Plugin up to 2.2.2 on WordPress. Affected is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-56007. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as very critical, has been found in iba PDA and DatCoordinator up to 8.13.x. This impacts an unknown function. This manipulation causes deserialization. This vulnerability is registered as CVE-2026-8024. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in ANSSI DFIR-ORC up to 10.2.7/10.2.x. This affects an unknown function of the component DLL Handler. The manipulation results in uncontrolled search path. This vulnerability is cataloged as CVE-2026-11958. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in SUSE libzypp up to 16.22.18/17.38.12. The impacted element is an unknown function. The manipulation leads to path traversal: '../filedir'. This vulnerability is listed as CVE-2026-44942. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in SEPPmail Secure Email Gateway up to 15.0.4. The affected element is an unknown function of the component Attachment File Handler. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2026-8811. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in dijitul Fancy Testimonials Plugin up to 1.0 on WordPress. Impacted is an unknown function of the component Shortcode Handler. Performing a manipulation of the argument Author results in cross site scripting. This vulnerability is identified as CVE-2026-8039. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as problematic has been found in contrid Slideshow Gallery LITE Plugin up to 1.8.5 on WordPress. This issue affects some unknown processing of the component Shortcode Handler. Such manipulation of the argument alwaysauto leads to cross site scripting. This vulnerability is referenced as CVE-2026-2021. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as critical has been detected in Chilek LAN Management System. This vulnerability affects the function exec of the component System Command Handler. This manipulation causes os command injection. The identification of this vulnerability is CVE-2026-40456. The attack needs to be done within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability categorized as critical has been discovered in Google MCP Toolbox for Databases 1.3.0. This affects an unknown part. The manipulation results in missing authorization. This vulnerability was named CVE-2026-11719. The attack may be performed from remote. There is no available exploit.