Aggregator

2026年了，在AI时代下总感觉什么都有可能，但是看到Wordpress居然能有原生未授权RCE还是感觉不可思议

A vulnerability was found in GeoVision GV-IP Device Utility up to 9.0.7.0 and classified as critical. Affected is an unknown function. Executing a manipulation can lead to uncontrolled search path. This vulnerability is handled as CVE-2026-16519. It is possible to launch the attack on the local host. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in wpmanageninja Fluent Support Plugin up to 2.3.0 on WordPress and classified as problematic. This impacts an unknown function of the component Shortcode Handler. Performing a manipulation of the argument redirect-to results in cross site scripting. This vulnerability is known as CVE-2026-15665. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in meIsle Visualizer Plugin up to 4.0.5 on WordPress. This affects an unknown function. Such manipulation of the argument backend-title leads to cross site scripting. This vulnerability is traded as CVE-2026-15653. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in ThimPress WP Hotel Booking Plugin up to 2.3.2 on WordPress. The impacted element is an unknown function of the component Shortcode Handler. This manipulation of the argument widget_search causes cross site scripting. This vulnerability appears as CVE-2026-15464. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in cozythemes Cozy Blocks Plugin up to 2.2.11 on WordPress. The affected element is an unknown function. The manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-15334. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in cozythemes Cozy Blocks Plugin up to 2.2.11 on WordPress. Impacted is an unknown function. The manipulation of the argument cozyCustomFont leads to cross site scripting. This vulnerability is documented as CVE-2026-15333. The attack can be initiated remotely. There is not any exploit available.

游戏越做越漂亮。贴图、光追、动效、剧情、过场动画——每一帧都在向"电影感"靠拢。然后某天，看到熟悉的主播，屏幕角落里冒出一行字：「[√] 连接成功」还多了绿色的火柴人……

A vulnerability described as problematic has been identified in 100plugins Open User Map Plugin up to 1.4.45 on WordPress. This issue affects some unknown processing of the component Shortcode Handler. Executing a manipulation of the argument Shortcode can lead to cross site scripting. This vulnerability is registered as CVE-2026-15755. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as problematic has been reported in berocket Brands for WooCommerce Plugin up to 3.8.8 on WordPress. This vulnerability affects unknown code of the component Shortcode Handler. Performing a manipulation of the argument width results in cross site scripting. This vulnerability is cataloged as CVE-2026-15648. It is possible to initiate the attack remotely. There is no exploit available.

2026年了，在AI时代下总感觉什么都有可能，但是看到Wordpress居然能有原生未授权RCE还是感觉不可思议。Wordpress算是我曾经深度研究过的php源码之一，虽然wp架构

A vulnerability labeled as problematic has been found in Red Hat OpenShift Update Service and Quay. This affects an unknown part of the component Notification Webhook. Such manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-16910. The attack may be performed from remote. There is no available exploit.

A vulnerability identified as problematic has been detected in paymentplugins Payment Plugins for Stripe WooCommerce Plugin up to 4.0.7 on WordPress. Affected by this issue is the function payment_complete of the component Signature Verification. This manipulation of the argument order_id/gateway_id/status causes authorization bypass. This vulnerability is tracked as CVE-2026-12654. The attack is possible to be carried out remotely. No exploit exists.

Вредоносный JavaScript запускался при просмотре сообщения и выгружал данные за 90 дней

2025 年 3 月六岁女孩美美（化名）在上海新华医院接受了首例针对大脑的基因编辑手术，七天后她死于手术相关的严重免疫反应。美美在四岁时被幼儿园老师注意到存在智力发育问题，老师建议其父母去医院检查下。她之后被诊断患有罕见的 Snijders Blok-Campeau 综合征，全世界至今仅有 237 人确诊。该病是由 CHD3 基因突变引起的，碱基 C 被错误转成 T。该病的症状差异很大，中度到重度患者可能需要尽快手术，但美美的症状是轻度的，是否需要手术专家对此有疑问。她的父母则为此忧心忡忡，通过微信群听说了上海交大的仇子龙教授。仇子龙曾是联署批评贺建奎的胚胎基因编辑手术的中国科学家之一，谴责其无视医学伦理。美美的父母联络了仇教授，之后筹资近 600 万人民币资助仇团队研发针对个人的基因编辑疗法。在猕猴治疗取得突破之后，新华医院伦理委员会批准了首例人体实验。手术使用了比 CRISPR 更精确的碱基编辑技术，通过 AAV9 病毒载体将编辑工具注入脊髓液。三天后美美开始发烧，这是病毒注射后的常见反应，但她的病情没有好转，她一直没有排尿——这是肾脏受到严重损伤的信号，她的血小板也下降到了危险的水平。她的父母事后说，手术的知情同意书淡化了死亡的风险，没有明确指出这些症状会导致死亡。伦理学家称首次人体实验须始终提及死亡。美美送进了 ICU，之后医生通知其父母死亡的消息。医院伦理委员会召开紧急会议，确认死亡与手术相关。仇的团队在《自然》上发表了相关论文，删除了人体实验失败的信息。美美的父母要求仇子龙撤回论文，他们担心这会误导孩子有类似情况的家庭和研究人员。新华医院因监管问题被罚了约 2.4 万元，其他人没有受到惩罚。

2025 年 3 月六岁女孩美美（化名）在上海新华医院接受了首例针对大脑的基因编辑手术，七天后她死于手术相关的严重免疫反应。美美在四岁时被幼儿园老师注意到存在智力发育问题，老师建议其父母去

A vulnerability was found in Open5GS up to 2.7.7. It has been declared as problematic. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf-handler.c of the component sm-policies Endpoint. Such manipulation leads to denial of service. This vulnerability is listed as CVE-2026-8222. The attack may be performed from remote. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in Open5GS up to 2.7.7. It has been rated as problematic. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. Performing a manipulation results in denial of service. This vulnerability is cataloged as CVE-2026-8223. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability categorized as problematic has been discovered in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/context.c of the component PCF. Executing a manipulation of the argument SmPolicyContextData.ipv6AddressPrefix can lead to denial of service. This vulnerability is registered as CVE-2026-8224. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability identified as problematic has been detected in Open5GS up to 2.7.7. This affects the function pcf_npcf_smpolicycontrol_handle_delete of the file src/pcf/sm-sm.c of the component delete Endpoint. The manipulation leads to denial of service. This vulnerability is documented as CVE-2026-8225. The attack can be initiated remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.