Aggregator

A vulnerability was found in starboardsuite Starboard Suite Reservation Calendars Plugin up to 3.1.4 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Shortcode Handler. Executing a manipulation of the argument attributes can lead to cross site scripting. This vulnerability is registered as CVE-2025-13968. It is possible to launch the attack remotely. No exploit is available.

Британский институт безопасности ИИ зафиксировал резкий рост возможностей модели Claude Mythos Preview в кибератаках.

A vulnerability was found in ThriveDesk Plugin up to 2.1.7 on WordPress. It has been classified as problematic. Affected is the function thrivedesk_clear_cache of the component Cache Management. Performing a manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-1832. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in nicu_m Simple JWT Login Plugin up to 3.6.6 on WordPress and classified as critical. This impacts an unknown function of the file /wp-json/simple-jwt-login/v1/auth of the component Login. Such manipulation of the argument payload leads to injection. This vulnerability is listed as CVE-2026-14262. The attack may be performed from remote. There is no available exploit.

A vulnerability has been found in wpovernight PDF Invoices & Packing Slips Plugin up to 5.14.0 on WordPress and classified as problematic. This affects the function generate_document_shortcode of the file includes/class-document-shortcode.php of the component Document Shortcode Handler. This manipulation of the argument key causes improper control of resource identifiers. This vulnerability is tracked as CVE-2026-13116. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as critical, was found in masaakitanaka Booking Package Plugin up to 1.7.20 on WordPress. The impacted element is an unknown function of the file /wp-json/booking-package/v1/request of the component REST API Endpoint. The manipulation of the argument email results in sql injection. This vulnerability is identified as CVE-2026-15335. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as critical, has been found in solacewp Starter Template feature up to 1.5.3 on WordPress. The affected element is the function wp_ajax_nopriv_ of the file /wp-admin/profile.php of the component Authorization. The manipulation of the argument nonce leads to authorization bypass. This vulnerability is referenced as CVE-2026-13250. Remote exploitation of the attack is possible. No exploit is available.

Forg365 is a phishing-as-a-service platform that targets Microsoft accounts, combining AI-powered phishing, session theft, and post-compromise mailbox access in a single operator panel The platform is reportedly distributed through Telegram, where criminals can access a 30-day trial, pay about per month, or choose an annual plan. This subscription model shows how phishing operations are becoming […]

The post Forg365 Phishing Platform Using AI to Attack Microsoft 365 Accounts appeared first on Cyber Security News.

Как на китайском форуме всего за $6000 слили систему тотальной слежки за Ватиканом и Россией.

2026年7月8日，安卡拉，北约峰会第二天傍晚。观察者们发现了一件不寻常的事：那架全新的波音747-8，涂着

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

德国宝马表示，中国市场销量骤降拖累了上半年的总销量，不过集团在其他市场实现了增长。这家德国汽车制造商周五表示，今年一至六月共交付约116万辆汽车，同比减少4.2%。其中，中国市场销量大跌20%，仅第二

Просто установить заплатку безопасности теперь недостаточно.

原来电动车赛车，卷的根本不是马力。

环境异常 当前环境异常，完成验证后即可继续访问。 去验证

CISA has published a candid after-action account revealing that a contractor accidentally exposed the agency’s own AWS GovCloud credentials and Infrastructure-as-Code repositories in a personal, public GitHub account, triggering an internal incident response and a rare public “lessons learned” disclosure from the federal cybersecurity agency itself. On Friday, May 15, CISA’s incident response began after […]

The post CISA Details “Lessons from a Cyber Incident” After AWS GovCloud Credentials Leak appeared first on Cyber Security News.

A vulnerability classified as problematic was found in lustmored Lockme calendars integration Plugin up to 2.11.0 on WordPress. Impacted is the function register_setting/update_option of the component Plugin Settings. Executing a manipulation of the argument client_id/client_secret/id_prefix/api_domain can lead to cross site scripting. The identification of this vulnerability is CVE-2026-3367. The attack may be launched remotely. There is no exploit available.