Aggregator

A vulnerability was found in MicroRealEstate up to 1.0.0-alpha3. It has been rated as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to state issue. This vulnerability is uniquely identified as CVE-2026-57867. The attack is possible to be carried out remotely. No exploit exists.

美国最高法院允许德州要求移动应用验证用户年龄。德州的新法律要求应用商店在未成年人下载应用前验证用户年龄并获得家长同意。代表 Google 和苹果的行业组织 Computer & Communications Industry Association 认为该法律覆盖范围太广，会限制青少年访问各种数字内容，会对数字言论保护产生深远影响。在该法律生效前几天，联邦地区法院去年底阻止了该法律的实施。保守派的第五巡回上诉法院在今年六月搁置了该裁决，允许德州继续推行这一法律。美国最高法院维持第五巡回上诉法院的裁决，它并没有做出决定，但允许德州在诉讼期间继续执行该法律。

A vulnerability was found in uncanny-automator-pro Plugin up to 7.3.0.5. It has been declared as critical. Affected is an unknown function. Executing a manipulation can lead to backdoor. This vulnerability is handled as CVE-2026-12375. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in DoLeads DoLeads Integrator Plugin and wp2epub Plugin up to 0.65. It has been classified as critical. This impacts an unknown function of the component Plugin Installer. Performing a manipulation results in code injection. This vulnerability is known as CVE-2026-4375. Remote exploitation of the attack is possible. No exploit is available.

Microsoft передала ФБР данные GDID, которые помогли задержать хакера Scattered Spider.

A vulnerability was found in WP Travel Engine Plugin up to 6.8.0 and classified as problematic. This affects an unknown function. Such manipulation leads to file inclusion. This vulnerability is traded as CVE-2026-10834. The attack may be launched remotely. There is no exploit available.

BeyondTrust has disclosed multiple critical and high-severity vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) solutions, potentially allowing attackers to bypass access controls and gain unauthorized access to sensitive systems. The issues are tracked under Advisory ID BT26-03 and carry a maximum CVSS v4 score of 9.2, indicating a severe risk to […]

The post Critical BeyondTrust Flaws Let Attackers Bypass Access Controls and Gain Unauthorized Access appeared first on Cyber Security News.

A vulnerability has been found in Frontend File Manager Plugin up to 23.6 and classified as critical. The impacted element is an unknown function of the file wp-config.php of the component File Deletion Handler. This manipulation causes file inclusion. This vulnerability appears as CVE-2026-12277. The attack may be initiated remotely. There is no available exploit.

Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumented authentication backdoor that enables administrative access to the devices' web management interfaces, the CERT Coordination Center (CERT/CC) warned Monday. "An attacker can exploit this vulnerability, tracked as CVE-2026-11405, to bypass the password verification process

A vulnerability, which was classified as problematic, was found in getwpfunnels WPFunnels Plugin up to 3.12.7. The affected element is the function wpfnl_show_log of the component Log Handler. The manipulation of the argument postData results in injection. This vulnerability is reported as CVE-2026-14345. The attack can be launched remotely. No exploit exists.

Autonomous AI agents have started doing real security work. Language-model agents probe software for flaws, run penetration tests, and chain together attack steps that once needed a human operator. Research about security has stayed slower and more manual, built around expert scarcity and hand-designed experiments. A team at the Chinese Academy of Sciences wants to close that gap. In a recent paper, they define what they term the Cybersecurity AI Scientist. They describe a research … More →

The post Researchers make the case for a cybersecurity AI scientist appeared first on Help Net Security.

A vulnerability has been found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT and Snapdragon Mobile and classified as critical. Affected by this vulnerability is an unknown functionality. This manipulation causes memory corruption. The identification of this vulnerability is CVE-2026-21368. The attack needs to be done within the local network. There is no exploit available.

A vulnerability categorized as critical has been discovered in BeyondTrust Remote Support and Privileged Remote Access up to 25.3.2/26.2.0. The impacted element is an unknown function. The manipulation results in improper access controls. This vulnerability is reported as CVE-2026-40138. The attack can be launched remotely. No exploit exists.

A vulnerability identified as very critical has been detected in BeyondTrust Remote Support up to 25.3.2/26.2.0. This affects an unknown function of the component Authentication Request Handler. This manipulation causes improper access controls. This vulnerability appears as CVE-2026-40139. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile and Snapdragon Wearables and classified as very critical. Affected by this issue is some unknown functionality of the component Flash Command Handler. Such manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-21369. The attack can only be performed from a local environment. No exploit is available.

A vulnerability was found in Qualcomm Snapdragon Mobile. It has been classified as critical. This affects an unknown part of the component Buffer Plane Manager. Performing a manipulation results in memory corruption. This vulnerability is identified as CVE-2026-21370. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in elixir-mint mint up to 1.9.0. Affected by this issue is the function decode_body/5/add_body_to_buffer/2 of the file lib/mint/http1.ex of the component HTTP1 Module. Such manipulation leads to allocation of resources. This vulnerability is traded as CVE-2026-56810. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Swoosh up to 1.26.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component MsGraph. The manipulation of the argument from results in injection. This vulnerability is cataloged as CVE-2026-54893. The attack may be launched remotely. There is no exploit available.

The Apache Software Foundationが提供するJena Fusekiには、パストラバーサルの脆弱性が存在します。

Уязвимость Januscape ставит под удар крупнейшие вычислительные центры мира.