Posts of last 24 hours

在上海这场顶级赛车比赛，我看到《飞驰人生 3》的 AI 辅助系统走进现实
环境异常 当前环境异常，完成验证后即可继续访问。 去验证
https://buaq.net/go-428287.html
CISA Details “Lessons from a Cyber Incident” After AWS GovCloud Credentials Leak

CISA has published a candid after-action account revealing that a contractor accidentally exposed the agency’s own AWS GovCloud credentials and Infrastructure-as-Code repositories in a personal, public GitHub account, triggering an internal incident response and a rare public “lessons learned” disclosure from the federal cybersecurity agency itself. On Friday, May 15, CISA’s incident response began after […]

The post CISA Details “Lessons from a Cyber Incident” After AWS GovCloud Credentials Leak appeared first on Cyber Security News.

https://cybersecuritynews.com/cisa-details-aws-credentials-leak/
CVE-2026-3367 | lustmored Lockme calendars integration Plugin up to 2.11.0 on WordPress Plugin Settings register_setting/update_option client_id/client_secret/id_prefix/api_domain cross site scripting
A vulnerability classified as problematic was found in lustmored Lockme calendars integration Plugin up to 2.11.0 on WordPress. Impacted is the function register_setting/update_option of the component Plugin Settings. Executing a manipulation of the argument client_id/client_secret/id_prefix/api_domain can lead to cross site scripting. The identification of this vulnerability is CVE-2026-3367. The attack may be launched remotely. There is no exploit available.
https://vuldb.com/vuln/377735
CVE-2026-5743 | gallerycreator SimpLy Gallery Plugin up to 3.3.3.1 on WordPress Block Attributes pgc_sgb_render_callback sliderMaxHeight cross site scripting
A vulnerability classified as problematic has been found in gallerycreator SimpLy Gallery Plugin up to 3.3.3.1 on WordPress. This issue affects the function pgc_sgb_render_callback of the component Block Attributes. Performing a manipulation of the argument sliderMaxHeight results in cross site scripting. This vulnerability was named CVE-2026-5743. The attack may be initiated remotely. There is no available exploit.
https://vuldb.com/vuln/377734
CVE-2026-13114 | stylemix Motors Plugin up to 1.4.112 on WordPress Comment Content cross site scripting
A vulnerability described as problematic has been identified in stylemix Motors Plugin up to 1.4.112 on WordPress. This vulnerability affects unknown code of the component Comment Content. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-13114. The attack can be launched remotely. No exploit exists.
https://vuldb.com/vuln/377733
CVE-2026-10628 | wpswings Points and Rewards for WooCommerce Plugin up to 2.10.1 on WordPress Authorization wps_wpr_generate_custom_wallet nonce authorization
A vulnerability marked as critical has been reported in wpswings Points and Rewards for WooCommerce Plugin up to 2.10.1 on WordPress. This affects the function wps_wpr_generate_custom_wallet of the component Authorization. This manipulation of the argument nonce causes authorization bypass. This vulnerability is handled as CVE-2026-10628. The attack can be initiated remotely. There is not any exploit available.
https://vuldb.com/vuln/377732
CVE-2026-7544 | 2coders Mux Video Uploader Plugin up to 1.1.4 on WordPress Settings muxvideo_enqueue_settings_script information disclosure
A vulnerability labeled as problematic has been found in 2coders Mux Video Uploader Plugin up to 1.1.4 on WordPress. Affected by this issue is the function muxvideo_enqueue_settings_script of the component Settings Handler. The manipulation results in information disclosure. This vulnerability is known as CVE-2026-7544. It is possible to launch the attack remotely. No exploit is available.
https://vuldb.com/vuln/377731
Пуэрто-Рико снова взломали. Но власти упорно делают вид, что открытый сервер — это нормально
Самое опасное в этой утечке — не сама дыра в системе, а то, что власти отказались её признавать.
https://www.securitylab.ru/news/574697.php
Disney+正在考虑推出免费流媒体套餐
流媒体平台Disney+正在考虑将其部分流媒体库内容开放供免费观看。迪士尼首席产品与技术官Adam Smith在周四的一场全体会议上讨论了提供免费层级内容的可能性。目前尚不清楚哪些节目或电影将被纳入，
https://buaq.net/go-428272.html
Dell BIOS Flaw Lets Attackers Recover Admin Passwords From SPI Flash in Milliseconds

A critical flaw in how Dell stores BIOS administrator and user passwords allows full password recovery from a flash dump in milliseconds, with no brute force required. The vulnerability, tracked as CVE-2026-40639 (DSA-2026-197), stems from a broken XOR encryption scheme rather than a proper cryptographic hash. Dell stores BIOS passwords in the DVAR (Dell Variable) […]

The post Dell BIOS Flaw Lets Attackers Recover Admin Passwords From SPI Flash in Milliseconds appeared first on Cyber Security News.

https://cybersecuritynews.com/dell-bios-flaw-admin-passwords/

Managed ad