Posts of last 24 hours

CVE-2026-5743 | gallerycreator SimpLy Gallery Plugin up to 3.3.3.1 on WordPress Block Attributes pgc_sgb_render_callback sliderMaxHeight cross site scripting
A vulnerability classified as problematic has been found in gallerycreator SimpLy Gallery Plugin up to 3.3.3.1 on WordPress. This issue affects the function pgc_sgb_render_callback of the component Block Attributes. Performing a manipulation of the argument sliderMaxHeight results in cross site scripting. This vulnerability was named CVE-2026-5743. The attack may be initiated remotely. There is no available exploit.
https://vuldb.com/vuln/377734
CVE-2026-13114 | stylemix Motors Plugin up to 1.4.112 on WordPress Comment Content cross site scripting
A vulnerability described as problematic has been identified in stylemix Motors Plugin up to 1.4.112 on WordPress. This vulnerability affects unknown code of the component Comment Content. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-13114. The attack can be launched remotely. No exploit exists.
https://vuldb.com/vuln/377733
CVE-2026-10628 | wpswings Points and Rewards for WooCommerce Plugin up to 2.10.1 on WordPress Authorization wps_wpr_generate_custom_wallet nonce authorization
A vulnerability marked as critical has been reported in wpswings Points and Rewards for WooCommerce Plugin up to 2.10.1 on WordPress. This affects the function wps_wpr_generate_custom_wallet of the component Authorization. This manipulation of the argument nonce causes authorization bypass. This vulnerability is handled as CVE-2026-10628. The attack can be initiated remotely. There is not any exploit available.
https://vuldb.com/vuln/377732
CVE-2026-7544 | 2coders Mux Video Uploader Plugin up to 1.1.4 on WordPress Settings muxvideo_enqueue_settings_script information disclosure
A vulnerability labeled as problematic has been found in 2coders Mux Video Uploader Plugin up to 1.1.4 on WordPress. Affected by this issue is the function muxvideo_enqueue_settings_script of the component Settings Handler. The manipulation results in information disclosure. This vulnerability is known as CVE-2026-7544. It is possible to launch the attack remotely. No exploit is available.
https://vuldb.com/vuln/377731
Пуэрто-Рико снова взломали. Но власти упорно делают вид, что открытый сервер — это нормально
Самое опасное в этой утечке — не сама дыра в системе, а то, что власти отказались её признавать.
https://www.securitylab.ru/news/574697.php
Disney+正在考虑推出免费流媒体套餐
流媒体平台Disney+正在考虑将其部分流媒体库内容开放供免费观看。迪士尼首席产品与技术官Adam Smith在周四的一场全体会议上讨论了提供免费层级内容的可能性。目前尚不清楚哪些节目或电影将被纳入，
https://buaq.net/go-428272.html
Dell BIOS Flaw Lets Attackers Recover Admin Passwords From SPI Flash in Milliseconds

A critical flaw in how Dell stores BIOS administrator and user passwords allows full password recovery from a flash dump in milliseconds, with no brute force required. The vulnerability, tracked as CVE-2026-40639 (DSA-2026-197), stems from a broken XOR encryption scheme rather than a proper cryptographic hash. Dell stores BIOS passwords in the DVAR (Dell Variable) […]

The post Dell BIOS Flaw Lets Attackers Recover Admin Passwords From SPI Flash in Milliseconds appeared first on Cyber Security News.

https://cybersecuritynews.com/dell-bios-flaw-admin-passwords/
16% капитализации — цена честного признания. Платежная компания Nayax поплатилась за раскрытие информации о взломе
Кто-то залез в систему Nayax, а расплатились за это акционеры.
https://www.securitylab.ru/news/574695.php
Meta从Instagram上移除备受争议的AI功能
Meta AI 本周推出图像生成功能，但其默认设置引发用户不满。该功能允许任何人以公开 Instagram 帖子作为起点生成人工智能图像，用户需要主动关闭权限才能避免内容被使用。Meta随后根据用户反
https://buaq.net/go-428273.html
281 Popular VPN Apps from the Google Play Store Leak Sensitive Data, Transfer Data Unencrypted

A new security study has found serious privacy and security issues in 281 popular Android VPN applications available on the Google Play Store. Researchers discovered that dozens of these apps transfer data without encryption, leak user traffic outside the VPN tunnel, and send device identifiers to advertising and tracking services. The research team from multiple […]

The post 281 Popular VPN Apps from the Google Play Store Leak Sensitive Data, Transfer Data Unencrypted appeared first on Cyber Security News.

https://cybersecuritynews.com/vpn-apps-from-the-google-play-leaks/

Managed ad