Aggregator

CIOs Face Growing Pressure on Risk, Data and Board Reporting
As AI moves deeper into enterprise operations, CIOs are being pushed to turn governance principles into practical controls, board reporting and risk oversight, according to a survey by The Conference Board's Governance and Sustainability Center.

Governments Have Long Warned About Kremlin Social Engineering Hacks
Signal is defending the security of its systems following a series of phishing attacks that took place on the encrypted messaging platform, and that reportedly compromised members of the German government including the president of the country's parliament.

Exclusion of OT From AI-Powered Vulnerability Discovery Poses Risks to National Security
Hyperscalers and IT behemoths are on the list, while OT companies are not. The list in question includes the companies that have special access to powerful new models from the two major U.S. frontier AI labs to identify vulnerabilities before hackers get access to similar technology.

Шпионы HeartlessSoul тайно картографируют критическую инфраструктуру России изнутри.

A dangerous infostealer malware called LofyStealer is actively targeting Minecraft players by disguising itself as a game cheat tool named “Slinky.” The malware runs a two-stage attack that quietly steals sensitive data from popular web browsers while staying largely hidden from standard security software installed on the victim machine. The campaign is notably more sophisticated […]

The post Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection appeared first on Cyber Security News.

AI时代，这些笔记已毫无意义，只是习惯性折腾过就记一笔而已。

Video hosting platform Vimeo has confirmed a data breach resulting in unauthorized access to its user database. The security incident stems from a compromise at Anodot, a third-party analytics vendor utilized by Vimeo and several other major organizations. This event highlights the escalating threat of supply chain attacks within the software-as-a-service (SaaS) ecosystem. The breach […]

The post Vimeo Confirms Data Breach – Hackers Accessed Users Database appeared first on Cyber Security News.

A vulnerability labeled as problematic has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the component Registration. The manipulation of the argument student_id/full_name/section/username results in cross site scripting. This vulnerability is reported as CVE-2026-7401. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability identified as problematic has been detected in wpeverest User Registration Plugin up to 5.1.5 on WordPress. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-42652. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in StellarWP Image Widget Plugin up to 4.4.11 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-42643. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in Dmitry V. Barcode Scanner with Inventory & Order Manager Plugin up to 1.11.0 on WordPress. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in cross-site request forgery. This vulnerability is cataloged as CVE-2026-42645. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in ILLID Share This Image Plugin up to 2.14 on WordPress. It has been declared as critical. Affected is an unknown function. Such manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-42641. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in Steve Burge TaxoPress Plugin up to 3.44.0 on WordPress. It has been classified as critical. This impacts an unknown function. This manipulation causes sql injection. This vulnerability is tracked as CVE-2026-42646. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in StellarWP GiveWP Plugin up to 4.14.5 on WordPress and classified as problematic. This affects an unknown function. The manipulation results in missing authorization. This vulnerability is identified as CVE-2026-42642. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in WPDeveloper BetterDocs Plugin up to 4.3.10 on WordPress and classified as critical. The impacted element is an unknown function. The manipulation leads to exposure of sensitive system information to an unauthorized control sphere. This vulnerability is referenced as CVE-2026-42644. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in Vmware Spring Framework up to 5.3.47/6.1.26/6.2.17/7.0.6. The affected element is an unknown function of the component Multipart Request Handler. Executing a manipulation can lead to resource consumption. The identification of this vulnerability is CVE-2026-22740. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Brainstorm Force Spectra Plugin up to 2.19.22 on WordPress. Impacted is an unknown function. Performing a manipulation results in missing authorization. This vulnerability was named CVE-2026-42648. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as critical was found in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is_path_allowed of the file server.py of the component read_file_tool/write_file_tool. Such manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2026-7400. The attack can be launched remotely. Moreover, an exploit is present. Upgrading the affected component is advised.

Submit #803525 / VDB-360133