Aggregator

A vulnerability marked as critical has been reported in PCRE PCRE2 up to 10.47. The impacted element is the function pcre2_match of the component JIT Fallback. This manipulation causes out-of-bounds read. This vulnerability appears as CVE-2026-89156. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in PCRE PCRE2 up to 10.47. The affected element is the function pcre2_jit_match of the component JIT Match. The manipulation results in use after free. This vulnerability is reported as CVE-2026-89161. The attack requires a local approach. No exploit exists. The affected component should be upgraded.

Конвейер оказался быстрее системы, которая должна его контролировать.

Existing security and governance practices have largely focused on identities, permissions, access, configurations and controls. WithSecure’s Navigating Trust in the Modern Salesforce Ecosystem paper says Salesforce environments also require organizations to understand what information they rely on, how trust extends across connected systems, what actions are performed and what outcomes those actions produce. A Trust Relationship (Source: WithSecure) What trust means The paper describes trust as the belief that people, systems, information and connected services … More →

The post AI is changing what Salesforce security needs to govern appeared first on Help Net Security.

A vulnerability identified as problematic has been detected in cbutlerjr WP-Members Membership Plugin up to 3.5.6 on WordPress. Impacted is an unknown function. The manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-84960. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in fernandot Vigilant Plugin up to 2.10.2 on WordPress. This issue affects some unknown processing. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-81754. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in boldthemes Bold Timeline Lite Plugin up to 1.2.8 on WordPress. It has been rated as problematic. This vulnerability affects the function bold_timeline_item of the component Shortcode Handler. Performing a manipulation of the argument supertitle/subtitle results in cross site scripting. This vulnerability is cataloged as CVE-2026-7438. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Premio Floating Chat Widget Contact Chat Icons Telegram Chat Line Messenger WeChat Email SMS Call Button Plugin up to 3.5.9 on WordPress. It has been declared as problematic. This affects an unknown part. Such manipulation of the argument s leads to cross site scripting. This vulnerability is listed as CVE-2026-18964. The attack may be performed from remote. There is no available exploit.

热衷于造概念、做营销、炒培训，那么 FDE 只会是又一轮行业泡沫。

A vulnerability was found in opajaap WP Photo Album Plus Plugin up to 9.2.08.003 on WordPress. It has been classified as problematic. Affected by this issue is the function getshortcodedrenderedfenodelay of the component wp_ajax_nopriv_wppa Endpoint. This manipulation of the argument HTTP_X_FORWARDED_FOR causes cross site scripting. This vulnerability is tracked as CVE-2026-18579. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in specialk Simple Ajax Chat Plugin up to 20260811 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-81825. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in themifyme Themify Plugin up to 1.5.5 on WordPress and classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-78172. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in UniteCMS Unlimited Elements for Elementor Plugin up to 2.0.16 on WordPress. This impacts the function show_preview. Executing a manipulation of the argument data[name] can lead to cross site scripting. The identification of this vulnerability is CVE-2026-77150. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in realmag777 HUSKY – Products Filter Professional for WooCommerce Plugin up to 1.4.3 on WordPress. This affects the function wp_load_js. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-18562. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in UsersWP Plugin up to 1.2.70 on WordPress. The impacted element is the function upload_file_remove of the component AJAX Handler. Such manipulation of the argument File leads to path traversal. This vulnerability is uniquely identified as CVE-2026-19991. The attack can be launched remotely. No exploit exists.

Canonical shipped Ubuntu 24.04.5 LTS, bundling security updates and fixes for high-severity bugs into new installation media for the “Noble Numbat” release. Anyone installing fresh now gets those corrections baked in from the start, cutting the batch of updates that would normally follow setup. The point release covers more than the desktop and server editions. Nine other flavors, including Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio, and Edubuntu, also moved to version 24.04.5, each carrying its … More →

The post Ubuntu 24.04.5 LTS release patches security bugs across ten flavors appeared first on Help Net Security.

A vulnerability classified as critical has been found in gingerplugins Sticky Chat Widget Plugin up to 1.4.2 on WordPress. The affected element is the function save_form_data. This manipulation of the argument scw_form_fields causes sql injection. This vulnerability is handled as CVE-2026-15462. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as problematic has been identified in Booktics Plugin up to 1.0.23 on WordPress. Impacted is the function create_order_permission of the file /wp-json/booktics/v1/orders of the component Permission Callback. The manipulation results in improper privilege management. This vulnerability is known as CVE-2026-11446. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as critical has been reported in UniteCMS Unlimited Elements for Elementor Plugin up to 2.0.16 on WordPress. This issue affects the function getWhereString. The manipulation of the argument addontype leads to sql injection. This vulnerability is traded as CVE-2026-18561. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as critical has been found in mulika MIPL Grouped Checkout Fields for WooCommerce Plugin up to 1.2.2 on WordPress. This vulnerability affects the function mipl_wc_upload_file. Executing a manipulation can lead to unrestricted upload. This vulnerability appears as CVE-2026-8778. The attack may be performed from remote. There is no available exploit.