Aggregator

CVE-2026-6854 | joedolson My Calendar Plugin up to 3.7.8 Authentication mc_auth sql injection

VulDB Recent Entries
2 weeks 3 days ago
A vulnerability has been found in joedolson My Calendar Plugin up to 3.7.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Authentication Handler. Performing a manipulation of the argument mc_auth results in sql injection. This vulnerability is reported as CVE-2026-6854. The attack is possible to be carried out remotely. No exploit exists.
vuldb.com

Attestiv DeepScan combines AI and forensic analysis for file validation

Help Net Security
2 weeks 3 days ago

Attestiv announced the launch of DeepScan, a new platform built to help organizations automatically validate submitted files before they drive critical business decisions. DeepScan represents a major architectural shift for Attestiv and its customers: moving from detecting fake or manipulated media in isolation to validating whether submitted photos, documents, audio, and video can be inherently trusted within the specific context of a business workflow. “Deepfake detection has become a necessary part of validating customer-submitted files, … More →

The post Attestiv DeepScan combines AI and forensic analysis for file validation appeared first on Help Net Security.

Industry News

CVE-2026-14250 | themehunk Login Registration Plugin up to 1.0.2 REST endpoint /thlogin/v1/register handle_frontend_register role name resolution

VulDB Recent Entries
2 weeks 3 days ago
A vulnerability, which was classified as critical, has been found in themehunk Login Registration Plugin up to 1.0.2. This impacts the function handle_frontend_register of the file /thlogin/v1/register of the component REST endpoint. This manipulation of the argument role causes incorrectly-resolved name. This vulnerability is registered as CVE-2026-14250. Remote exploitation of the attack is possible. No exploit is available.
vuldb.com

CVE-2026-3688 | wclovers WCFM Membership Plugin up to 2.11.10 AJAX Action wcfmvm_membership_change resource injection

VulDB Recent Entries
2 weeks 3 days ago
A vulnerability classified as critical was found in wclovers WCFM Membership Plugin up to 2.11.10. This affects the function wcfmvm_membership_change of the component AJAX Action. The manipulation results in improper control of resource identifiers. This vulnerability is cataloged as CVE-2026-3688. The attack may be launched remotely. There is no exploit available.
vuldb.com

GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

The Hackers News
2 weeks 3 days ago
New research shows that a signed Git commit's hash is not the one-of-a-kind name that much of the software world assumes it to be. Given any signed commit, someone without the signing key can mint a second commit with the same files, author, and date, and a valid signature, GitHub still stamps "Verified." Everything a reviewer would check matches. The commit's hash does not. That matters
The Hacker News

Waymo 员工看到青少年乘客玩玩具枪后报警

Solidot
2 weeks 3 days ago
两名放暑假的 15 岁少年体会到了 Waymo 在时刻监视你的含义。他们在车内喝酒，用玩具枪对着其它汽车射水凝胶珠。一名 Waymo 员工当时正远程监控着这辆车，在看到车内有疑似枪支以及正在开枪之后，骗两名青少年说 Waymo 出租车出现了机械故障，需要停车，同时致电警方说有人在开枪。汽车停在了一家购物中心的停车场，当时五名警察已在那里等候搜查。搜查的结果是他们玩的是玩具枪，子弹是水凝胶珠。两名乘客被拘留后被释放交由其父母监护。检方正在审查可能的指控，包括未成年饮酒和从事威胁性行为。

The Verification Step Is the New ATO Battleground in 2026

The Hackers News
2 weeks 3 days ago
For years, account takeover (ATO) followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools, and waited for matches. Credential stuffing was cheap, scalable, and for defenders, relatively well understood. That era is ending. Not because attackers gave up, but because the front door finally got harder to kick in. Passkeys are now mainstream.
The Hacker News

Accenture acknowledges security incident following 35GB data theft claim

Help Net Security
2 weeks 3 days ago

Accenture appears to have suffered a data breach, the extent of which is currently unknown. On Monday, a threat actor going by the handle “888” posted on the cybercrime forum PwnForums, claiming to have breached the technology consulting company and stolen “just over 35gb of source codes” in July 2026. They claim to have exfiltrated source code, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files, which they are … More →

The post Accenture acknowledges security incident following 35GB data theft claim appeared first on Help Net Security.

Zeljka Zorz

Managed ad