Aggregator

A vulnerability was found in Simply Schedule Appointments Plugin up to 1.6.12.2 on WordPress and classified as problematic. Impacted is the function wp_kses_post of the component Notification Rendering. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-13400. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Document Gallery Plugin up to 5.1.0 on WordPress and classified as problematic. This issue affects some unknown processing. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-12982. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in Printcart Web to Print Product Designer Plugin up to 2.5.2 on WordPress. This vulnerability affects unknown code. The manipulation results in server-side request forgery. This vulnerability is cataloged as CVE-2025-15662. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

2026年7月， Island发布报告披露约7600个恶意GitHub仓库、约6600个伪造开发者账号、超过 1400 万次可计量下载。而在这波行动中，一个被命名为AgentBaiting的新手法第一次让大家意识到：攻击者的社会工程学剧本，欺骗对象已经不只是人，还包括替人干活的AI代理

A vulnerability, which was classified as critical, has been found in The Events Calendar Plugin up to 6.8.2.1 on WordPress. This affects an unknown part of the component Event Aggregator Import. The manipulation leads to missing authorization. This vulnerability is listed as CVE-2026-13390. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in MemberGlut Plugin up to 1.1.4 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper privilege management. This vulnerability is tracked as CVE-2026-12394. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in MainWP Child Plugin up to 6.1.1 on WordPress. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in improper authentication. This vulnerability is identified as CVE-2026-12255. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in Advanced Ads Plugin up to 2.0.22 on WordPress. Affected is an unknown function of the component Shortcode Handler. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-10082. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in Masteriyo LMS Plugin up to 2.3.0 on WordPress. This impacts an unknown function. This manipulation causes improper authentication. The identification of this vulnerability is CVE-2026-13332. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Custom Fields Account Registration for Woocommerce Plugin up to 1.3 on WordPress. This affects an unknown function of the component Custom Fields. The manipulation results in improper privilege management. This vulnerability was named CVE-2026-13152. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Zaytech Clover Payment Gateway Plugin up to 1.3.5 on WordPress. The impacted element is an unknown function. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-12493. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

历史学教授 Jason Gibson 在一则浏览量逾千万的 Tiktok 视频中说，他的两个班级共 35 名学生有 32 名学生期中考试不及格，因为他们都用 AI 生成了全部答案。而且他们根本检查都没检查。识别作弊非常简单，试卷隐藏了一个白色的提示词，如果直接拷贝题目扔到 AI 工具里，那么 AI 会根据该提示词的指令去生成一段包含马达加斯加的无意义句子。在考试后他向学生解释是如何发现作弊的，给予学生机会申诉成绩，只有两名学生选择申诉。他在视频中分享了学生使用 AI 生成的马达加斯加句子。

75 000 способов описать мир — мы не узнаем, каких цветов, звуков и понятий больше не существует.

关键词Claude AI你以为只有你知道的对话，全世界都在搜。

关键词挖矿有人在Steam论坛发"修复教程"，复制粘贴那一刻，你的电脑就沦陷了。

关键词苹果今天早上，苹果用户集体懵了。7月27日，苹果公司系统状态页面显示，多项核心服务出现故障，大量用户受到影响。

In this interview with Help Net Security, Mary Rose Martinez, CISO at Marathon Petroleum, talks about what happens to security when automation reaches deep into refineries, pipelines, and terminals. She explains why the old idea of air-gapped operational technology has faded, how the Purdue model helps her team apply controls without stopping production, and where supply chain risk sits when vendors and their vendors hold the keys. She also covers cross-skilling the workforce and working … More →

The post Marathon Petroleum’s CISO on OT security automation, supply chain risk appeared first on Help Net Security.

A new report links 148 ransomware attacks to Italian organizations in H1 2026, with manufacturing the most targeted sector. Six months, 148 confirmed ransomware claims against Italian targets, and one sector taking the brunt of it. That’s the headline number from a new semi-annual tracker compiled by ransomNews under its RedACT project, which pulls together […]

在内存天价的时代，华为据报道与昇维旭（SwaySure）等合作建造一座 12 英寸内存芯片工厂。昇维旭被认为是一家华为关联企业，该公司生产的内存芯片不是面向消费者而是面向企业的 HBM。另外中国最大的内存芯片制造商长鑫本周一上市，立即成为中国市值最高的上市公司，其市值达到了 3.68 万亿元（约 5434.1 亿美元），超过了英特尔的 4640 亿美元。

An AI coding agent opens a terminal, reads a config file, and finds a live cloud key sitting in plaintext. It runs with the permissions of the person who launched it. Every file that person can read, the agent reads. Every credential in the environment, the agent can use. That reach is where the damage starts. A prompt injection, a mistyped command, or a hallucinated path points that access at the company’s own credentials and … More →

The post Nono: Open-source sandbox for AI agents appeared first on Help Net Security.