Aggregator

Currently trending CVE - Hype Score: 11 - Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Currently trending CVE - Hype Score: 8 - Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

课程感受，希望您喜欢！

Длина пальцев младенца может показать, как эстроген, вырабатываемый во время беременности, способствовал эволюции более крупного человеческого мозга.

A vulnerability described as problematic has been identified in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry_protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of sensitive information. This vulnerability was named CVE-2026-16213. The attack needs to be approached locally. There is no available exploit. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability marked as critical has been reported in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. This vulnerability is uniquely identified as CVE-2026-16212. The attack is possible to be carried out remotely. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

Submit #857944 / VDB-380029

Submit #857939 / VDB-380028

A newly disclosed a pre-authentication remote code execution (RCE) vulnerability in WordPress Core, dubbed “wp2shell,” that requires no authentication and affects stock WordPress installations with zero plugins installed. Given that WordPress powers an estimated 500 million websites globally. The flaw represents one of the most significant CMS security disclosures in recent memory. The issue stems […]

The post Critical WordPress Core Flaw Lets Anonymous Hackers Gain Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A vulnerability labeled as problematic has been found in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. This vulnerability is handled as CVE-2026-16211. The attack can only be done within the local network. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

Cloud Software Group has disclosed two security vulnerabilities affecting Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows, with one flaw allowing low-privileged attackers to gain full SYSTEM access on affected machines. The more severe issue, tracked as CVE-2026-53565, carries a CVSS v4.0 base score of 8.5 and stems from improper […]

The post Citrix Secure Access and Endpoint Client for Windows Vulnerability Enables Privilege Escalation appeared first on Cyber Security News.

Submit #857935 / VDB-380027

Submit #857934 / VDB-236497

Submit #857933 / VDB-236497

A vulnerability identified as critical has been detected in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. This vulnerability is known as CVE-2026-16210. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability categorized as critical has been discovered in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. This vulnerability is traded as CVE-2026-16209. The attack may be launched remotely. Furthermore, there is an exploit available. Applying a patch is advised to resolve this issue.

A vulnerability was found in django-tastypie up to 0.15.1. It has been rated as problematic. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. This vulnerability appears as CVE-2026-16208. The attack may be initiated remotely. There is no available exploit. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in django-tastypie up to 0.15.1. It has been declared as problematic. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. This vulnerability is reported as CVE-2026-16207. The attack can be launched remotely. No exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

Submit #857929 / VDB-380026

Submit #857926 / VDB-380025