Aggregator

A vulnerability has been found in lenve vhr 1.0-SNAPSHOT and classified as critical. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. This vulnerability is reported as CVE-2026-90490. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as problematic, was found in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. This vulnerability is documented as CVE-2026-90489. The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. This vulnerability is registered as CVE-2026-90488. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. This vulnerability is cataloged as CVE-2026-90487. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-90486. The attack may be initiated remotely. There is no available exploit. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. It is suggested to install a patch to address this issue. This issue got fixed with a silent patch.

Максимальная оценка CVSS здесь выглядит вполне заслуженной.

China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims. Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome […]

The post China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Submit #892352 / VDB-403080

Submit #891691 / VDB-403079

Submit #888617 / VDB-403078

Submit #892506 / VDB-403077

Submit #888470 / VDB-403076

Submit #888438 / VDB-403075

Submit #888087 / VDB-403074

A vulnerability described as problematic has been identified in wproyal Royal Addons for Elementor Plugin up to 1.7.1066 on WordPress. Affected is the function wp_localize_script of the component Royal Elementor Widget. Executing a manipulation of the argument wpr_keyword can lead to information disclosure. This vulnerability is tracked as CVE-2026-17585. The attack can be launched remotely. No exploit exists.

A vulnerability marked as critical has been reported in meIsle MPG Multiple Page Generator Plugin up to 4.2.1 on WordPress. This impacts an unknown function of the component Shortcode Handler. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2026-85198. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in rtcamp rtMedia for BuddyPress and bbPress Plugin up to 4.7.11 on WordPress. This affects the function RTMediaQuery::query of the component SQL Query Construction. Such manipulation of the argument compare leads to sql injection. This vulnerability is referenced as CVE-2026-16482. It is possible to launch the attack remotely. No exploit is available.

A vulnerability identified as critical has been detected in egoi Smart Marketing SMS and Newsletters Forms Plugin up to 5.1.24 on WordPress. The impacted element is the function get_option. This manipulation of the argument Name causes sql injection. The identification of this vulnerability is CVE-2026-77161. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability categorized as problematic has been discovered in Designmes DT LMS Plugin up to 1.1 on WordPress. The affected element is the function update_option of the component AJAX Handlers. The manipulation results in improper authorization. This vulnerability was named CVE-2026-11355. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in ninjew GEO my WP Plugin up to 4.5.5.3 on WordPress. It has been rated as critical. Impacted is the function gmw_posts_locator_ajax_info_window_loader. The manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2026-85200. The attack is possible to be carried out remotely. No exploit exists.