Aggregator

A vulnerability identified as critical has been detected in wpdevart Booking Calendar Appointment Booking System Plugin up to 3.2.17. Impacted is an unknown function of the component SQL Query Handler. The manipulation of the argument wpdevart_id leads to sql injection. This vulnerability is listed as CVE-2026-15289. The attack may be initiated remotely. There is no available exploit.

A vulnerability categorized as critical has been discovered in rtcamp rtMedia Plugin up to 4.6.18. This issue affects some unknown processing of the component Query Handler. Executing a manipulation of the argument order_by can lead to sql injection. This vulnerability is tracked as CVE-2026-15287. The attack can be launched remotely. No exploit exists.

A vulnerability was found in themeatelier ChatHelp Plugin up to 3.1.3. It has been rated as problematic. This vulnerability affects unknown code of the file /wp-json/chat-help/v1/leads of the component REST API. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-15291. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in brainstormforce SureForms Plugin up to 2.2.1. It has been declared as problematic. This affects the function create_payment_intent/create_subscription_intent of the component Payment Intent Handler. Such manipulation leads to improper input validation. This vulnerability is referenced as CVE-2026-15288. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in stellarwp Kadence Blocks Plugin up to 3.5.32. It has been classified as critical. Affected by this issue is the function get_items_permission_check of the component REST API Endpoint. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2026-15286. It is possible to initiate the attack remotely. There is no exploit available.

Две 0day-бреши сложились в сценарий, которого мобильная защита никак не ожидала.

A vulnerability was found in tenteeglobal Instant Appointment Plugin up to 1.2 and classified as critical. Affected by this vulnerability is the function insapp_upload_image_as_attachment of the component File Upload. The manipulation results in unrestricted upload. This vulnerability was named CVE-2026-15282. The attack may be performed from remote. There is no available exploit.

In this Help Net Security video, Anastasia Tikhonova, Global Threat Research Lead at Group-IB, explains how to operationalize software supply chain risk. Instead of filing an SBOM away as a compliance document, she argues teams should use it every day for vulnerability triage, vendor access reviews, identity monitoring, and incident response. Drawing on Group-IB’s High-Tech Crime Trend Report 2026, she shows how supply chain attacks now link phishing, ransomware, and data breaches through inherited trust. … More →

The post Turning software supply chain security into a daily habit appeared first on Help Net Security.

A vulnerability has been found in posimyththemes Plus Addons for Elementor Plugin up to 6.4.11 and classified as problematic. Affected is the function render of the file modules/widgets/tp_button.php of the component Button Widget. The manipulation of the argument custom_attributes leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-15285. The attack is possible to be carried out remotely. No exploit exists.

现将2025年度四川省科学技术奖拟奖人选和项目在四川省科学技术厅网站公示。

Accounts receivable teams at large companies spend hours each day matching incoming bank payments to invoices by hand. When those payments sit unmatched for days, cash flow suffers and days sales outstanding climbs. The same pattern repeats across blocked invoices, purchase order approval holds, month-end close, and intercompany reconciliations in almost every industry. Built-in ERP automation, including SAP’s three-way match, still leaves plenty of these exceptions for people to sort out. AWS has released a … More →

The post AWS gives its ERP agent deny-by-default rules and a separate identity appeared first on Help Net Security.

A CVSS score 9.3 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N severity vulnerability discovered by 'Taha Siddiqi (@_atomiz_) of TrendAI Research' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N severity vulnerability discovered by 'Minh Giang (@itscysamu) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Flydragon @ TRAPA Security' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.3 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N severity vulnerability discovered by 'Habibullo Izzatilloyev' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N severity vulnerability discovered by 'Minh Giang (@itscysamu) of TrendAI Zero Day Initiative and Taha Siddiqi (@_atomiz_) of TrendAI Research' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.3 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N severity vulnerability discovered by 'Habibullo Izzatilloyev' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.5 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Phan Vinh Khang of Viettel Cyber Security' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 6.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L severity vulnerability discovered by 'Xiaobye(@xiaobye_tw) of DEVCORE Research Team' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Bobby Gould (@bobbygould5) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-07-10, 1 days ago. The vendor is given until 2026-11-07 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.