Aggregator

A vulnerability identified as critical has been detected in wpdevart Booking Calendar Appointment Booking System Plugin up to 3.2.17. Impacted is an unknown function of the component SQL Query Handler. The manipulation of the argument wpdevart_id leads to sql injection. This vulnerability is listed as CVE-2026-15289. The attack may be initiated remotely. There is no available exploit.

A vulnerability categorized as critical has been discovered in rtcamp rtMedia Plugin up to 4.6.18. This issue affects some unknown processing of the component Query Handler. Executing a manipulation of the argument order_by can lead to sql injection. This vulnerability is tracked as CVE-2026-15287. The attack can be launched remotely. No exploit exists.

A vulnerability was found in themeatelier ChatHelp Plugin up to 3.1.3. It has been rated as problematic. This vulnerability affects unknown code of the file /wp-json/chat-help/v1/leads of the component REST API. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-15291. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in brainstormforce SureForms Plugin up to 2.2.1. It has been declared as problematic. This affects the function create_payment_intent/create_subscription_intent of the component Payment Intent Handler. Such manipulation leads to improper input validation. This vulnerability is referenced as CVE-2026-15288. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in stellarwp Kadence Blocks Plugin up to 3.5.32. It has been classified as critical. Affected by this issue is the function get_items_permission_check of the component REST API Endpoint. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2026-15286. It is possible to initiate the attack remotely. There is no exploit available.

Две 0day-бреши сложились в сценарий, которого мобильная защита никак не ожидала.

A vulnerability was found in tenteeglobal Instant Appointment Plugin up to 1.2 and classified as critical. Affected by this vulnerability is the function insapp_upload_image_as_attachment of the component File Upload. The manipulation results in unrestricted upload. This vulnerability was named CVE-2026-15282. The attack may be performed from remote. There is no available exploit.

In this Help Net Security video, Anastasia Tikhonova, Global Threat Research Lead at Group-IB, explains how to operationalize software supply chain risk. Instead of filing an SBOM away as a compliance document, she argues teams should use it every day for vulnerability triage, vendor access reviews, identity monitoring, and incident response. Drawing on Group-IB’s High-Tech Crime Trend Report 2026, she shows how supply chain attacks now link phishing, ransomware, and data breaches through inherited trust. … More →

The post Turning software supply chain security into a daily habit appeared first on Help Net Security.

A vulnerability has been found in posimyththemes Plus Addons for Elementor Plugin up to 6.4.11 and classified as problematic. Affected is the function render of the file modules/widgets/tp_button.php of the component Button Widget. The manipulation of the argument custom_attributes leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-15285. The attack is possible to be carried out remotely. No exploit exists.

现将2025年度四川省科学技术奖拟奖人选和项目在四川省科学技术厅网站公示。

Accounts receivable teams at large companies spend hours each day matching incoming bank payments to invoices by hand. When those payments sit unmatched for days, cash flow suffers and days sales outstanding climbs. The same pattern repeats across blocked invoices, purchase order approval holds, month-end close, and intercompany reconciliations in almost every industry. Built-in ERP automation, including SAP’s three-way match, still leaves plenty of these exceptions for people to sort out. AWS has released a … More →

The post AWS gives its ERP agent deny-by-default rules and a separate identity appeared first on Help Net Security.

A CVSS score 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Bobby Gould (@bobbygould5) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-07-10, 0 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

Старый трюк с симлинками обманул шесть популярных ИИ-кодеров.

Passwords remain part of many workforce authentication flows in financial organizations, making phishing and credential theft major identity security risks, according to a new Secret Double Octopus report. Key challenges preventing universal implementation of phishing-resistant MFA (Source: Secret Double Octopus) Workforce authentication trends Banks and financial organizations use a mix of authentication methods, combining phishing-resistant technologies with methods that remain vulnerable to phishing attacks. Password plus OTP remains more common among organizations with up to … More →

The post Only 28% of financial workforce MFA is phishing-resistant appeared first on Help Net Security.

A vulnerability, which was classified as critical, was found in wpmanageninja Fluent Forms Plugin up to 6.2.1. This impacts an unknown function of the component Payment Cancellation. Executing a manipulation of the argument subscription_id can lead to improper authorization. This vulnerability is handled as CVE-2026-5069. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as very critical, has been found in OpenStack Ironic up to 29.0.5/32.0.1/35.0.1/37.0.0. This affects an unknown function of the component Authorization. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2026-44918. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as critical was found in OpenStack Ironic up to 29.0.5/32.0.1/35.0.1/37.0.0. The impacted element is the function send_raw of the component IPMI Management Interface. Such manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-54423. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic has been found in thimpress WP Hotel Booking Plugin up to 2.3.1. The affected element is an unknown function of the component Booking. This manipulation of the argument check_in_date/check_out_date causes cross site scripting. This vulnerability appears as CVE-2026-11392. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as critical has been identified in arraytics WPCafe Plugin up to 3.0.14. Impacted is an unknown function of the component Notification Flow Workflows. The manipulation results in authorization bypass. This vulnerability is reported as CVE-2026-11818. The attack can be launched remotely. No exploit exists.