Aggregator

Submit #856775 / VDB-379753

A vulnerability described as problematic has been identified in SaturdayDrive Ninja Forms Plugin up to 3.3.6 on WordPress. The affected element is the function save_filter of the component AJAX handler. Such manipulation of the argument filter leads to cross site scripting. This vulnerability is listed as CVE-2026-15161. The attack may be performed from remote. There is no available exploit.

Submit #856721 / VDB-379752

A vulnerability marked as problematic has been reported in themeatelier ChatHelp Plugin up to 3.5.1 on WordPress. Impacted is an unknown function of the component Shortcode Handler. This manipulation of the argument number/group causes cross site scripting. This vulnerability is tracked as CVE-2026-15759. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as critical has been found in Kirki Plugin up to 6.0.13 on WordPress. This issue affects some unknown processing of the component Customizer. The manipulation of the argument Family results in path traversal. This vulnerability is identified as CVE-2026-15457. The attack can be executed remotely. There is not any exploit available.

A vulnerability identified as problematic has been detected in thimpress LearnPress Plugin up to 4.4.1 on WordPress. This vulnerability affects the function check_answer of the component Quiz Answer Handler. The manipulation leads to information disclosure. This vulnerability is referenced as CVE-2026-13765. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability categorized as critical has been discovered in HCL Traveler for Microsoft Outlook up to 3.0.15. This affects an unknown part of the component DLL. Executing a manipulation can lead to uncontrolled search path. The identification of this vulnerability is CVE-2026-21770. The attack can only be executed locally. There is no exploit available.

A vulnerability was found in wedevs ERP Complete HR Accounting CRM Suite Plugin up to 1.17.6 on WordPress. It has been rated as critical. Affected by this issue is some unknown functionality of the component Company Location. Performing a manipulation results in authorization bypass. This vulnerability was named CVE-2026-15349. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in ProfilePress Plugin up to 4.16.18 on WordPress. It has been declared as critical. Affected by this vulnerability is the function allowed_mime_types of the component File Upload Handler. Such manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2026-13352. The attack can be launched remotely. No exploit exists.

A vulnerability was found in ploudapp pCloud WP Backup Plugin up to 2.0.3 on WordPress. It has been classified as problematic. Affected is the function wp2pcl_ajax_process_request_inner of the component Backup. This manipulation causes information disclosure. This vulnerability is handled as CVE-2026-14503. The attack can be initiated remotely. There is not any exploit available.

An active phishing campaign using a five-layer, fileless malware loader to evade Microsoft’s Antimalware Scan Interface (AMSI), static detection controls, and disk-based forensic analysis. The campaign delivers a Windows Script Host JScript payload inside a TAR archive disguised as a purchase order, ultimately loading a .NET assembly directly into memory. The activity was first observed […]

The post Five-Layer Fileless Malware Uses JScript and PowerShell to Evade AMSI and Load .NET Payload appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Зуб древнего буйвола побил прежний рекорд из Южной Африки сразу на 40 тысяч лет.

In this Help Net Security video, Viktor Bulanek, CTO of Penetrify, explains where security budget waste comes from. Budgets get built around vendor categories, compliance checkboxes, and last year’s headlines. Attackers work along attack paths, and that mismatch is where the money goes. He walks through the two big leaks, overlapping tools that flag the same issue three times, and shelfware that covers a third of the estate at 100% of the invoice. The license … More →

The post The five step plan that cuts security budget waste appeared first on Help Net Security.

A newly disclosed zero-day vulnerability in AnyDesk has the potential to allow a local attacker to trigger a denial-of-service condition by exploiting the remote-access software’s “Send Support Information” feature. The advisory, tracked as ZDI-26-401 and ZDI-CAN-26645, was published by Trend Micro’s Zero Day Initiative (ZDI) on July 8, 2026. The flaw has been assigned CVE-2026-15682 […]

The post AnyDesk Zero-Day Flaw Allows Local Attackers to Trigger System-Wide Denial-of-Service appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'YJK(@YJK0805) of ZUSO ART' was reported to the affected vendor on: 2026-07-17, 4 days ago. The vendor is given until 2026-11-14 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'YJK(@YJK0805) of ZUSO ART' was reported to the affected vendor on: 2026-07-17, 4 days ago. The vendor is given until 2026-11-14 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'YJK(@YJK0805) of ZUSO ART' was reported to the affected vendor on: 2026-07-17, 4 days ago. The vendor is given until 2026-11-14 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'YJK(@YJK0805) of ZUSO ART' was reported to the affected vendor on: 2026-07-17, 4 days ago. The vendor is given until 2026-11-14 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'YJK(@YJK0805) of ZUSO ART' was reported to the affected vendor on: 2026-07-17, 4 days ago. The vendor is given until 2026-11-14 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'YJK(@YJK0805) of ZUSO ART' was reported to the affected vendor on: 2026-07-17, 4 days ago. The vendor is given until 2026-11-14 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.