Aggregator

A vulnerability classified as problematic was found in Passeum Ticketing Plugin up to 1.0 on WordPress. The affected element is the function get_shop_url of the component Setting Handler. The manipulation of the argument shop_name results in cross site scripting. This vulnerability was named CVE-2026-7421. The attack may be performed from remote. There is no available exploit.

A vulnerability described as problematic has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. This vulnerability is registered as CVE-2026-10692. It is possible to launch the attack remotely. Furthermore, an exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. This vulnerability is cataloged as CVE-2026-10691. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. This vulnerability is listed as CVE-2026-10690. The attack may be performed from remote. In addition, an exploit is available. It is best practice to apply a patch to resolve this issue.

June 5, 2026Thank you t

Cybercriminals have devised an insidious method to infiltrate macOS environments. Specifically, they disguise malicious payloads within seemingly innocuous applications. Beneath the elegant aesthetics of podcast players and PDF readers lies a dual-threat mechanism. Consequently,...

The post Operation FlutterBridge: Sophisticated Malware Masquerades as Legitimate macOS Utilities appeared first on Information Security News.

魏哲家：台积电目前不存在失去竞争优势的风险台积电CEO表示，该公司在下一代芯片制造领域并未落后。此举驳斥了外界疑虑。外界此前担心，竞争对手已采用极昂贵设备制造尖端芯片，使台积电处于劣势。在年度股东大会

阅读： 0日前，针对Mythos Preview模型的最新公开研究表明，该模型不仅能独立发现漏洞，更能将多个低危漏洞串联成完整的攻击链，形成更为严重漏洞利用链，并自

June 5, 2026Interoperab

A fork of the original HexStrike AI project has been released as HexStrike AI v6.0, an advanced Model Context Protocol (MCP)-based cybersecurity automation framework that merges 127 professional security tools with BOAZ, a multi-layered, EDR/AV payload evasion engine built for real-world red team operations The platform enables Claude, GPT, VS Code Copilot, Cursor, and any MCP-compatible […]

The post HexStrike AI RED-TEAM With 127 Security Tools and BOAZ Red Team Integration appeared first on Cyber Security News.

Balancing Compute with Conservation In response to intense public backlash over data center resource consumption, Google expanded its water stewardship commitments. Consequently, the enterprise aims to achieve a net water-positive status by 2030. This...

The post The Aqua Nexus: Google Expands Water Stewardship Pledges Amid AI Expansion appeared first on Information Security News.

A vulnerability has been found in Apple Safari up to 15.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the component WebKit. The manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2022-32886. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability was found in Apple iOS and iPadOS up to 15.6.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component WebKit. The manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2022-32886. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in webkit2gtk. The impacted element is an unknown function. Such manipulation leads to Remote Code Execution. This vulnerability is listed as CVE-2022-32885. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in Microsoft Copilot Chat. It has been classified as critical. This vulnerability affects unknown code of the component Downstream. Performing a manipulation results in injection. This vulnerability is known as CVE-2026-47644. Remote exploitation of the attack is possible. No exploit is available. This product is a managed service, indicating that users are not permitted to maintain vulnerability countermeasures themselves.

A vulnerability identified as critical has been detected in Microsoft 365 Copilot. The impacted element is an unknown function. This manipulation causes command injection. The identification of this vulnerability is CVE-2026-45497. It is possible to initiate the attack remotely. There is no exploit available. This product is a managed service. This means that users are not able to maintain vulnerability countermeasures themselves.

A vulnerability described as critical has been identified in SourceCodester Ship Ferry Ticket Reservation System up to 1.0. This impacts an unknown function of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Username leads to sql injection. This vulnerability is documented as CVE-2026-10877. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in Microsoft Exchange Online. It has been declared as critical. This issue affects some unknown processing. Executing a manipulation can lead to improper authorization. This vulnerability is handled as CVE-2026-48579. The attack can be executed remotely. There is not any exploit available. This product is a managed service, so users do not have direct control over vulnerability countermeasures.