Aggregator

New Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions

Cyber Security News
3 weeks 1 day ago

PhantomRPC, a newly identified architectural vulnerability in Windows Remote Procedure Call (RPC) that enables local privilege escalation to SYSTEM-level access, potentially affecting every version of Windows. The research was presented by Kaspersky application security specialist Haidar Kabibo at Black Hat Asia 2026 on April 24 and details five distinct exploitation paths, none of which have […]

The post New Windows RPC Vulnerability Lets Attackers Escalate Privileges Across All Windows Versions appeared first on Cyber Security News.

Guru Baran

CISA Warns of Multiple SimpleHelp Vulnerabilities Exploited in Attack

Cyber Security News
3 weeks 1 day ago

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding two actively exploited vulnerabilities in SimpleHelp remote support software. Remote access tools are highly valued targets for cybercriminals because they provide direct pathways into corporate networks. When compromised, these platforms allow threat actors to bypass traditional security perimeters and launch devastating secondary […]

The post CISA Warns of Multiple SimpleHelp Vulnerabilities Exploited in Attack appeared first on Cyber Security News.

Abinaya

CVE-2026-7045 | baomidou dynamic-datasource 2.5.0 StandardEvaluationContext/SpelExpressionParser DsSpelExpressionProcessor.java DsSpelExpressionProcessor#doDetermineDatasource injection (Issue 766)

VulDB Recent Entries
3 weeks 1 day ago
A vulnerability was found in baomidou dynamic-datasource 2.5.0. It has been classified as critical. Affected by this vulnerability is the function DsSpelExpressionProcessor#doDetermineDatasource of the file dynamic-datasource-spring/src/main/java/com/baomidou/dynamic/datasource/processor/DsSpelExpressionProcessor.java of the component StandardEvaluationContext/SpelExpressionParser. This manipulation causes injection. This vulnerability appears as CVE-2026-7045. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.
vuldb.com

CVE-2026-7044 | GreenCMS up to 2.3 index.php?m=admin&c=custom&a=themeadd unrestricted upload

VulDB Recent Entries
3 weeks 1 day ago
A vulnerability was found in GreenCMS up to 2.3 and classified as critical. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is reported as CVE-2026-7044. The attack can be launched remotely. Moreover, an exploit is present.
vuldb.com

CVE-2026-7043 | GreenCMS up to 2.3 index.php?m=admin&c=custom&a=pluginadd pluginAddLocal unrestricted upload

VulDB Recent Entries
3 weeks 1 day ago
A vulnerability has been found in GreenCMS up to 2.3 and classified as critical. This impacts the function pluginAddLocal of the file /index.php?m=admin&c=custom&a=pluginadd. The manipulation leads to unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is documented as CVE-2026-7043. The attack can be initiated remotely. Additionally, an exploit exists.
vuldb.com

INC

Dark Feed IO
3 weeks 1 day ago

You must login to view this content

cohenido

CVE-2026-7042 | 666ghj MiroFish up to 0.1.2 REST API Endpoint backend/app/__init__.py create_app missing authentication (Issue 487)

VulDB Recent Entries
3 weeks 1 day ago
A vulnerability, which was classified as critical, was found in 666ghj MiroFish up to 0.1.2. This affects the function create_app of the file backend/app/__init__.py of the component REST API Endpoint. Executing a manipulation can lead to missing authentication. This vulnerability is registered as CVE-2026-7042. It is possible to launch the attack remotely. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.
vuldb.com

CISA Hunts for Cisco Backdoor Spotted on Federal Network

BankInfoSecurity.com
3 weeks 1 day ago
'Firestarter' Backdoor Can Survive Reboots, Upgrades and Standard Fixes
The Cybersecurity and Infrastructure Security Agency issued an emergency directive warning a newly-discovered Cisco backdoor can survive routine remediation processes, forcing agencies to investigate edge devices that anchor federal firewall and VPN security.

Poor Risk Analysis Cost 4 Firms $1.7 Million in HIPAA Fines

BankInfoSecurity.com
3 weeks 1 day ago
HHS OCR Breach Investigators Again Find All-Too-Common Risk Analysis Failures
Faulty or non-existent security risk analyses cost a medical imaging provider, a women's healthcare group, a health plan and a third-party insurance administrator a collective $1.7 million in fines after federal regulators concluded they didn't do enough to prevent ransomware attacks.

Managed ad