Aggregator

CVE-2026-1927 | Greenshift Plugin up to 12.5.7 on WordPress AI API Key greenshift_app_pass_validation information disclosure

Vuldb Updates
1 month 1 week ago
A vulnerability was found in Greenshift Plugin up to 12.5.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function greenshift_app_pass_validation of the component AI API Key Handler. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-1927. The attack can be executed remotely. There is not any exploit available.
vuldb.com

CVE-2026-26275 | junkurihara httpsig-rs up to 0.0.22 integrity check (GHSA-7v42-g35v-xrch)

Vuldb Updates
1 month 1 week ago
A vulnerability was found in junkurihara httpsig-rs up to 0.0.22 and classified as problematic. This affects an unknown part. Executing a manipulation can lead to improper validation of integrity check value. This vulnerability appears as CVE-2026-26275. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-27199 | Pallets Werkzeug up to 3.1.5 send_from_directory windows device name (GHSA-29vq-49wr-vm6x)

Vuldb Updates
1 month 1 week ago
A vulnerability categorized as problematic has been discovered in Pallets Werkzeug up to 3.1.5. Affected by this vulnerability is the function send_from_directory. The manipulation results in improper handling of windows device names. This vulnerability is reported as CVE-2026-27199. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.
vuldb.com

CVE-2026-27198 | getformwork up to 2.3.3 Account Creation privileges management (GHSA-34p4-7w83-35g2)

Vuldb Updates
1 month 1 week ago
A vulnerability identified as critical has been detected in getformwork formwork up to 2.3.3. Affected by this issue is some unknown functionality of the component Account Creation Handler. This manipulation causes improper privilege management. This vulnerability appears as CVE-2026-27198. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.
vuldb.com

CVE-2026-3057 | a54552239 pearProjectApi up to 2.8.10 Backend Interface Task.php dateTotalForProject projectCode sql injection

Vuldb Updates
1 month 1 week ago
A vulnerability, which was classified as critical, was found in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. This vulnerability is reported as CVE-2026-3057. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-25591 | QuantumNous new-api up to 0.10.8-alpha.9 Token Search Endpoint /api/token/search keyword/token data query logic injection (GHSA-w6x6-9fp7-fqm4)

Vuldb Updates
1 month 1 week ago
A vulnerability classified as problematic has been found in QuantumNous new-api up to 0.10.8-alpha.9. Impacted is an unknown function of the file /api/token/search of the component Token Search Endpoint. Performing a manipulation of the argument keyword/token results in improper neutralization of special elements in data query logic. This vulnerability is identified as CVE-2026-25591. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-26993 | FlintSH Flare 1.7.1 SVG cross site scripting (GHSA-q8fp-w6m5-4gjm)

Vuldb Updates
1 month 1 week ago
A vulnerability was found in FlintSH Flare 1.7.1. It has been declared as problematic. This affects an unknown function of the component SVG Handler. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-26993. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-37184 | HPE EdgeConnect SD-WAN Orchestrator up to 9.4.4/9.6.0 Orchestrator Service improper authentication

Vuldb Updates
1 month 1 week ago
A vulnerability was found in HPE EdgeConnect SD-WAN Orchestrator up to 9.4.4/9.6.0. It has been classified as critical. Impacted is an unknown function of the component Orchestrator Service. Performing a manipulation results in improper authentication. This vulnerability is known as CVE-2025-37184. Remote exploitation of the attack is possible. No exploit is available.
vuldb.com

CVE-2024-0756 | Insert or Embed Articulate Content into WordPress Plugin cross site scripting

Vuldb Updates
1 month 1 week ago
A vulnerability, which was classified as problematic, has been found in Insert or Embed Articulate Content into WordPress Plugin up to 4.3000000023 on WordPress. Affected is an unknown function. This manipulation causes basic cross site scripting. The identification of this vulnerability is CVE-2024-0756. It is possible to initiate the attack remotely. There is no exploit available.
vuldb.com

Ariomex, Iran-based crypto exchange, suffers data leak

Security Affairs
1 month 1 week ago
Resecurity says Iran’s Ariomex crypto exchange suffered a data leak exposing user and transaction data from 2022 to 2025. Resecurity (USA) reports that Ariomex’s database, one of Iran’s cryptocurrency exchange platforms, suffered a data leak. The report published by the cybersecurity company presents the findings of a structured analysis of the leaked database, which contains […]
Pierluigi Paganini

SloppyLemming Espionage Campaign Uses BurrowShell Backdoor and Rust RAT to Hit Pakistan and Bangladesh Targets

Cyber Security News
1 month 1 week ago

A suspected India-aligned threat group known as SloppyLemming has been conducting a sustained espionage campaign against government agencies, defense organizations, nuclear oversight bodies, and critical infrastructure operators in Pakistan and Bangladesh. Active since 2021 and also tracked as Outrider Tiger and Fishing Elephant, the group deployed two newly documented tools between January 2025 and January […]

The post SloppyLemming Espionage Campaign Uses BurrowShell Backdoor and Rust RAT to Hit Pakistan and Bangladesh Targets appeared first on Cyber Security News.

Tushar Subhra Dutta

Malvertising Threat Actor ‘D‑Shortiez’ Abuses WebKit Back‑Button Hijack in Forced‑Redirect Browser Campaign

Cyber Security News
1 month 1 week ago

A threat actor tracked as D-Shortiez has been running a persistent malvertising campaign that turns a WebKit browser behavior into a trap, forcing iOS Safari users into scam pages with no easy way out. The campaign is not entirely new in concept — forced redirect attacks have long been a fixture of the online ad […]

The post Malvertising Threat Actor ‘D‑Shortiez’ Abuses WebKit Back‑Button Hijack in Forced‑Redirect Browser Campaign appeared first on Cyber Security News.

Tushar Subhra Dutta

Play

Dark Feed IO
1 month 1 week ago

You must login to view this content

cohenido

Play

Dark Feed IO
1 month 1 week ago

You must login to view this content

cohenido

Managed ad