Aggregator

A vulnerability has been found in openises Tickets up to 3.44.1 and classified as critical. This issue affects some unknown processing of the file import_mdb.php of the component Configuration Handler. The manipulation of the argument host/username/password/database name leads to hard-coded credentials. This vulnerability is traded as CVE-2026-48242. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in openises Tickets up to 3.44.1. This vulnerability affects unknown code of the file loader.php. Executing a manipulation can lead to hard-coded credentials. This vulnerability appears as CVE-2026-48241. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in openises Tickets up to 3.44.1. This affects an unknown part of the file db_loader.php of the component POST Parameter Handler. Performing a manipulation of the argument ticketsdb/ticketshost/ticketsuser/ticketspassword results in sql injection. This vulnerability is reported as CVE-2026-48236. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in openises Tickets up to 3.44.1. Affected by this issue is some unknown functionality of the file incs/remotes.inc.php of the component Remote GPS Tracker Endpoint. Such manipulation leads to sql injection. This vulnerability is documented as CVE-2026-48235. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in Apache Fory 0.x. Affected by this vulnerability is the function unsafe. This manipulation causes deserialization. This vulnerability is registered as CVE-2026-48207. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in openises Tickets up to 3.44.1. Affected is an unknown function of the file ajax/reports.php of the component Google Maps Directions API Lookup Handler. The manipulation results in improper certificate validation. This vulnerability is cataloged as CVE-2026-48246. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in openises Tickets up to 3.44.1. This impacts an unknown function of the file tables.php of the component Google Maps API. The manipulation leads to hard-coded credentials. This vulnerability is listed as CVE-2026-48245. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in openises Tickets up to 3.44.1. This affects an unknown function of the file settings.inc.php of the component Google Maps API. Executing a manipulation can lead to hard-coded credentials. This vulnerability is tracked as CVE-2026-48244. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability described as critical has been identified in constantcontact Creative Mail Plugin up to 1.6.9 on WordPress. This affects the function has_checkout_consent. Executing a manipulation of the argument checkout_uuid can lead to sql injection. This vulnerability appears as CVE-2026-3985. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability was found in TriliumNext Trilium up to 0.102.1. It has been declared as problematic. This vulnerability affects unknown code. The manipulation results in clickjacking. This vulnerability was named CVE-2026-39309. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

The regulator, Ofcom, had required Roblox, Snapchat, Instagram, Facebook, YouTube and TikTok to answer questions about their efforts to remove harmful algorithms, check kids’ ages and protect them from sexual predators by the end of April.

Name: SamaraCTF 2026 (an SamaraCTF event.)
Date: May 15, 2026, 3 p.m. — 17 May 2026, 15:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://samara.volgactf.ru/
Rating weight: 25.00
Event organizers: SamaraCTF.ru

A vulnerability described as critical has been identified in Tobias CF7 WOW Styler Plugin up to 1.7.6 on WordPress. Affected by this issue is some unknown functionality. The manipulation results in missing authorization. This vulnerability is reported as CVE-2026-27393. The attack can be launched remotely. No exploit exists.

A vulnerability was found in Divi Engine Divi Form Builder Plugin up to 5.1.2 on WordPress. It has been classified as critical. Affected by this vulnerability is the function default_user_role of the component Setting Handler. Performing a manipulation of the argument role results in improper privilege management. This vulnerability was named CVE-2026-5118. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in AWS Amazon SageMaker Python SDK up to 2.257.1/3.7.1. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Serve Component. Executing a manipulation can lead to cleartext storage of sensitive information. This vulnerability is registered as CVE-2026-8596. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A large-scale phishing campaign is actively targeting U.S. organizations, using fake event invitations as bait to steal login credentials, intercept one-time passwords, or install remote access tools. The operation has been running since at least December 2025, with researchers tracking a growing pool of malicious domains built around the same repeatable framework. What makes this […]

The post Fake Invitation Phishing Campaign Targets U.S. Organizations With Credential Theft appeared first on Cyber Security News.

A vulnerability has been found in Splunk Enterprise and Cloud Platform and classified as problematic. Affected is an unknown function of the file coldToFrozen.sh of the component splunk_archiver App. The manipulation leads to denial of service. This vulnerability is listed as CVE-2026-20240. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability described as critical has been identified in Jsonpickle python jsonpickle 2.0.0. The affected element is the function eval. Executing a manipulation can lead to code injection. This vulnerability appears as CVE-2021-47952. The attack may be performed from remote. In addition, an exploit is available.

Under a draft executive order, the NSA, Treasury Department and other federal agencies would get 90-days to test new models for cybersecurity and national security concerns.

The post Trump postpones executive order focused on AI security  appeared first on CyberScoop.

Машина, способная решить главную загадку простых чисел, будет уже не помощником, а интеллектом другого класса.