Aggregator

Currently trending CVE - Hype Score: 8 - Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Currently trending CVE - Hype Score: 2 - Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated ...

Currently trending CVE - Hype Score: 2 - A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and ...

Фотон на 300 ТэВ не должен был долететь до Земли. Возможно, виновата квантовая гравитация.

OPAQUE, a confidential computing company that runs AI workloads inside hardware-isolated environments so operators cannot inspect them, released an open standard that lets AI model builders decide when and where their weights can be decrypted once those weights leave the builder’s own servers. The standard, called Weight Custody Manifest, ships as a developer-preview specification, a Python SDK, and a public test suite covering 91 cases. The release targets a specific squeeze. Enterprises are fine-tuning open … More →

The post A new open standard locks AI weights to approved hardware appeared first on Help Net Security.

A vulnerability was found in otwthemes Sidebar Manager Light Plugin up to 1.18 on WordPress. It has been classified as problematic. Impacted is an unknown function. The manipulation of the argument sbm_description leads to cross site scripting. This vulnerability is referenced as CVE-2026-76562. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in Builderall Plugin up to 3.0.2 on WordPress and classified as problematic. This issue affects some unknown processing of the component Photo Module. Executing a manipulation of the argument attributes can lead to cross site scripting. The identification of this vulnerability is CVE-2026-15820. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Builderall Plugin up to 3.0.2 on WordPress and classified as problematic. This vulnerability affects unknown code of the component Setting Handler. Performing a manipulation of the argument bg_video_service_url results in cross site scripting. This vulnerability was named CVE-2026-15796. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, was found in Easy Google Fonts Plugin up to 2.0.4 on WordPress. This affects an unknown part. Such manipulation of the argument control_selectors leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-4657. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as problematic, has been found in vsourz1td Advanced Contact Form 7 Plugin up to 2.1.3 on WordPress. Affected by this issue is some unknown functionality. This manipulation causes improper authorization. This vulnerability is handled as CVE-2026-18594. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as problematic was found in cssimmon WP BackItUp Community Edition Plugin up to 2.1.0 on WordPress. Affected by this vulnerability is the function basename. The manipulation of the argument backup_file results in path traversal. This vulnerability is known as CVE-2026-18386. It is possible to launch the attack remotely. No exploit is available.

A vulnerability classified as critical has been found in rubenw Bulk Password Reset Plugin up to 1.3.3 on WordPress. Affected is an unknown function. The manipulation leads to weak password recovery. This vulnerability is traded as CVE-2026-14873. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as problematic has been identified in Builderall Plugin up to 3.0.2 on WordPress. This impacts the function Disable of the component AJAX Handler. Executing a manipulation of the argument post_id can lead to improper privilege management. This vulnerability appears as CVE-2026-15823. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as problematic has been reported in kamalyon Direct Download for WooCommerce Plugin up to 1.19 on WordPress. This affects the function include. Performing a manipulation results in path traversal. This vulnerability is reported as CVE-2026-15019. The attack is possible to be carried out remotely. No exploit exists.

Amazon elected Kevin Mandia to its Board of Directors on September 8. Mandia founded Mandiant and served as its CEO before Google acquired the firm in September 2022, and he has worked against cyber threats in the public and private sectors for more than 30 years. Amazon called cybersecurity “one of the most consequential risks and responsibilities organizations face today,” and pointed to advances in AI as the reason the threat landscape keeps moving. That … More →

The post Kevin Mandia joins the Amazon board with 30-plus years in cybersecurity appeared first on Help Net Security.

教师节 | 火绒安全祝全体教师 教师节快乐

Concorde гремел, X-59 должен шептать.

A vulnerability labeled as very critical has been found in Rapid7 Velociraptor up to 0.77.1. The impacted element is an unknown function of the component Notebook Backup. Such manipulation leads to permission issues. This vulnerability is documented as CVE-2026-19584. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in Rapid7 Velociraptor up to 0.77.1. The affected element is an unknown function of the component Permission Check. This manipulation causes permission issues. This vulnerability is registered as CVE-2026-19583. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.