Aggregator

A vulnerability was found in louisho5 picobot up to 0.2.0. It has been rated as critical. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. This vulnerability is documented as CVE-2026-15668. The attack can be initiated remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in phoenixframework phoenix_live_view up to 1.2.6. It has been declared as problematic. Affected is the function valid_destination!/2 of the file lib/phoenix_live_view/utils.ex of the component URL Scheme Validator. Such manipulation of the argument URL leads to cross site scripting. This vulnerability is documented as CVE-2026-58228. The attack can be executed remotely. There is not any exploit available.

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

致力于第一时间为企业级用户提供权威漏洞情报和有效解决方案。

Underground hacking forums are producing more original tutorials again, with growing attention on financial fraud, particularly the theft and fraudulent use of payment card data, known as carding, and cash-out techniques. New tutorials per month versus reposts (Source: Radware) Fraud tutorials gain momentum Radware analyzed 8,870 tutorial posts published across 24 deep- and dark-web forums between December 2022 and April 2026. After removing reposts, the dataset contained 3,034 unique hacking and fraud guides. “New tutorial … More →

The post New tutorials on underground hacking forums have roughly doubled appeared first on Help Net Security.

A vulnerability labeled as problematic has been found in WP 2FA Plugin 2.2.1/2.3.0/3.0.0 on WordPress. Impacted is an unknown function of the component 2FA Setup. Executing a manipulation of the argument email address can lead to missing authorization. This vulnerability is tracked as CVE-2026-12988. The attack can be launched remotely. No exploit exists.

A vulnerability identified as critical has been detected in AI Engine Plugin up to 3.5.4 on WordPress. This issue affects some unknown processing of the component File Download Handler. Performing a manipulation of the argument filename results in path traversal. This vulnerability is identified as CVE-2026-12511. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in Ultimate Before After Image Slider & Gallery Plugin up to 4.7.0 on WordPress. This vulnerability affects unknown code of the component BEAF Slider Widget. Such manipulation of the argument shortcode leads to cross site scripting. This vulnerability is referenced as CVE-2025-15665. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in SureForms Plugin up to 2.11.0 on WordPress. It has been rated as problematic. This affects an unknown part of the component Payment. This manipulation of the argument Amount causes improper access controls. The identification of this vulnerability is CVE-2026-11567. It is possible to initiate the attack remotely. There is no exploit available.

2026年7月14日 14:20软件资讯00.66K

A vulnerability was found in Word Count and Social Shares Plugin up to 1.0 on WordPress. It has been declared as critical. Affected by this issue is some unknown functionality of the component File Path. The manipulation of the argument file path results in file inclusion. This vulnerability was named CVE-2026-11563. The attack may be performed from remote. There is no available exploit.

有人在国际数学家大会 ICM 2026 官网日程表的前端代码中，发现了四条标记为菲尔兹奖得主的隐藏字段： 60 HIDDEN Fields Medal Lecture: Yu Deng | Yu DengI
60 HIDDEN Fields Medal Lecture: John Pardon| f8f5fa42-4309-4064-8901-bb61c18c9add|
60 HIDDEN Fields Medal Lecture: Jacob Tsimerman
60 HIDDEN Fields Medal Lecture: Hong Wang| Hong Wang 2026 年国际数学家大会将于 7 月 23 日举行，菲尔兹奖被誉为数学界的诺贝尔奖，但不同于诺贝尔奖在公布日才通知获奖者，菲尔兹奖会提前通知获奖者，因此其名单有可能会提前泄露。如果名单获得确认，这将是第二次中国数学家获得菲尔兹奖，且同时有两人入选。第一次是丘成桐。邓煜在公理化物理的希尔伯特第六问题上做出重大贡献，王虹解决了开放问题三维空间内的挂谷集合猜想，John Pardon（白杰文）解决了 Gromov 的纽结理论问题，Jacob Tsimerman 在 André-Oort 猜想等问题上做出了重大贡献。  

Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform. The way in has been the trust the organization had already extended, usually through the OAuth connections that tie Salesforce to the apps and third-party vendors around it. In 

有人在国际数学家大会 ICM 2026 官网日程表的前端代码中，发现了四条标记为菲尔兹奖得主的隐藏字段：60 HIDDEN Fields Medal Lecture: Yu Deng

Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year

A vulnerability was found in Newsletters Plugin up to 4.14 on WordPress. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component Form Handler. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2026-12583. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in Linux Kernel up to 6.12.74/6.18.15/6.19.5. It has been declared as critical. This impacts the function wave5_vpu_timer_callback of the file kernel/kthread.c. Executing a manipulation can lead to race condition. The identification of this vulnerability is CVE-2026-43293. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.19.5 and classified as critical. This issue affects some unknown processing of the component net. The manipulation results in uninitialized pointer. This vulnerability was named CVE-2026-43291. The attack needs to be approached within the local network. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.74/6.18.15/6.19.5. It has been classified as critical. This affects the function purge_vmap_node. Performing a manipulation results in infinite loop. This vulnerability was named CVE-2026-43292. The attack needs to be approached within the local network. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability has been found in Mattermost Go Module up to 0.1.21 and classified as critical. Affected is an unknown function of the file /mattermost/mattermost/server/public. The manipulation leads to path traversal. This vulnerability is listed as CVE-2026-13426. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.