Aggregator

A vulnerability was found in Johnson Controls CCure 9000 and Victor Application Server up to 3.0. It has been declared as critical. This affects an unknown function. Such manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-21653. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in forgekeep nebula-mesh up to 0.3.3. It has been classified as critical. The impacted element is an unknown function of the file internal/api/hosts.go of the component API Authorization. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-2026-47724. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability was found in cyberlord92 SAML Single Sign On Plugin up to 5.4.4 on WordPress and classified as critical. The affected element is the function mo_saml_validate_signature. The manipulation results in improper verification of cryptographic signature. This vulnerability is identified as CVE-2026-15981. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in Johnson Control victor up to 2.x and classified as very critical. Impacted is an unknown function. The manipulation leads to deserialization. This vulnerability is referenced as CVE-2026-21655. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in Progress MOVEit Transfer up to 2025.1.4/2026.0.2. This issue affects some unknown processing. Executing a manipulation can lead to session expiration. The identification of this vulnerability is CVE-2026-15967. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Progress MOVEit Transfer up to 2025.1.4/2026.0.2. This vulnerability affects unknown code. Performing a manipulation results in improper authentication. This vulnerability was named CVE-2026-10697. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in Progress MOVEit Transfer up to 2025.1.4/2026.0.2. This affects an unknown part. Such manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-15968. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in forgekeep nebula-mesh up to 0.3.0. Affected by this issue is some unknown functionality. This manipulation causes permissive cross-domain policy with untrusted domains. This vulnerability is handled as CVE-2026-47723. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in Knot DNS up to 3.4.9/3.5.3. Affected by this vulnerability is an unknown functionality of the component mod-onlinesign. The manipulation results in improper input validation. This vulnerability is known as CVE-2026-39155. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in Progress MOVEit Transfer up to 2025.1.4/2026.0.2. Affected is an unknown function. The manipulation leads to permissive cross-domain policy with untrusted domains. This vulnerability is traded as CVE-2026-15966. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in Casdoor up to 3.115.0. This impacts an unknown function. Executing a manipulation of the argument ID can lead to incorrect authorization. This vulnerability appears as CVE-2026-15630. The attack may be performed from remote. There is no available exploit.

A vulnerability identified as critical has been detected in AWS bedrock-agentcore up to 1.18.0. This affects the function install_packages of the component Python SDK. Performing a manipulation results in improper neutralization. This vulnerability is reported as CVE-2026-16796. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in WPO365 Login Plugin up to 43.2 on WordPress. The impacted element is the function Ajax_Service::verify_ajax_request/Ajax_Service::update_settings of the component Nonce Verification. Such manipulation of the argument Settings leads to cross-site request forgery. This vulnerability is documented as CVE-2026-15212. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Shopware up to 6.7.10.0. It has been rated as problematic. The affected element is an unknown function of the file /api/oauth/sso/auth of the component SSO Entry Point. This manipulation of the argument Referer causes open redirect. This vulnerability is registered as CVE-2026-48012. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Origin Energy has confirmed that an unauthorized party accessed and subsequently leaked customer data online, exposing sensitive personally identifiable information (PII), among others. [...]

The move stems from a Trump executive order as the administration continues to pursue cyber-enabled fraud and other crimes.

The post Rubio restricts visas for sextortionists, cyber scammers appeared first on CyberScoop.

A vulnerability was found in forgekeep nebula-mesh up to 0.3.1. It has been declared as very critical. Impacted is an unknown function of the file internal/configgen/generator.go/internal/web/advanced.go of the component Config Generator/Web Handler. The manipulation of the argument ListenHost/TunDevice results in code injection. This vulnerability is cataloged as CVE-2026-47722. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SharePoint and Check Point flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the KeV catalog: The first flaw added to the KeV […]

A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware. [...]

In an era dominated by cyber threats, the importance of physical security penetration testing often gets overshadowed. However, a robust security posture requires a holistic approach that addresses vulnerabilities in both the digital and physical realms. A determined attacker can bypass sophisticated cyber defenses simply by walking through an unlocked door, exploiting weak physical controls, […]

The post Top 10 Best Physical Security Penetration Testing Firms 2026 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.