An unprecedented surge in Iranian VPN-over-DNS activity during a military conflict generated 40 billion DNS observations, revealing a large-scale effort to bypass internet restrictions and conduct covert operations.
Source: https://gbhackers.com/feed/The WebToffee WooCommerce PDF Invoices plugin is vulnerable to an insecure direct object reference (IDOR) flaw, allowing unauthorized access to order documents via email parameters.
Source: https://cvefeed.io/rssfeed/latest.atomThe Kirki plugin for WordPress is vulnerable to arbitrary shortcode execution, allowing authenticated users to execute malicious code via the 'display_name' field.
Source: https://cvefeed.io/rssfeed/latest.atomThe WPO365 plugin for WordPress is vulnerable to an authentication bypass via OIDC nonce replay, allowing unauthenticated attackers to gain unauthorized access.
Source: https://cvefeed.io/rssfeed/latest.atomThe WP Directory Kit plugin for WordPress is vulnerable to second-order SQL injection via the 'display_name' profile field, potentially exposing sensitive data.
Source: https://cvefeed.io/rssfeed/latest.atomThe WPCOM Member plugin for WordPress is vulnerable to authentication bypass via the 'uuid' and 'code' parameters, allowing attackers to gain unauthorized access.
Source: https://cvefeed.io/rssfeed/latest.atomThe Appointment Booking Plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'booking[service_id]' parameter, potentially exposing sensitive data.
Source: https://cvefeed.io/rssfeed/latest.atomThe FunnelKit plugin for WooCommerce is vulnerable to unauthenticated stored cross-site scripting (XSS), allowing attackers to inject malicious scripts via order fields, potentially compromising user data and site integrity.
Source: https://cvefeed.io/rssfeed/latest.atomThe WP Photo Album Plus plugin for WordPress is vulnerable to unauthenticated stored XSS via session history, allowing attackers to inject malicious scripts that could compromise site visitors.
Source: https://cvefeed.io/rssfeed/latest.atomThe DarkBlinders hacking group used a fake video meeting app and GitHub repositories to deploy backdoors and steal sensitive government data in a targeted cyberespionage campaign against Israel and the Kurdistan Region of Iraq.
Source: https://gbhackers.com/feed/Two zero-day vulnerabilities in Ahsay Cloud Backup Server (AhsayCBS) are being actively exploited, allowing attackers to take over backup servers, deploy web shells, and execute commands with SYSTEM privileges.
Source: https://gbhackers.com/feed/Empire Market co-creator Raheim Hamilton was sentenced to 40 years in prison for operating a dark web marketplace responsible for $430 million in illegal trades, highlighting the scale and impact of cybercrime on global markets.
Source: https://securityaffairs.com/feedThe ZTE Z80 Ultra product has an unauthorized information disclosure vulnerability due to insufficient access control, potentially exposing sensitive data to attackers.
Source: https://cvefeed.io/rssfeed/latest.atomThe SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to an authenticated arbitrary file read vulnerability via LESS injection, potentially exposing sensitive files to attackers.
Source: https://cvefeed.io/rssfeed/latest.atomThe Post Grid Gutenberg Blocks plugin for WordPress is vulnerable to unauthenticated stored XSS via the display_name user field, potentially allowing attackers to inject malicious scripts.
Source: https://cvefeed.io/rssfeed/latest.atomHackers leveraged AI agents and the GodPotato exploit to escalate privileges on Windows systems, gaining SYSTEM-level access without deploying new malware or exploiting zero-day vulnerabilities.
Source: https://gbhackers.com/feed/The Avada (Fusion) Builder plugin for WordPress is vulnerable to an unauthenticated arbitrary action invocation, potentially allowing attackers to exploit the '{action_hook}' dynamic-data token in form fields to execute unauthorized actions.
Source: https://cvefeed.io/rssfeed/severity/high.atomThe 3D Product Configurator plugin for WooCommerce is vulnerable to unauthenticated remote code execution via the 'xpv_image' parameter, potentially allowing attackers to execute arbitrary code on affected WordPress sites.
Source: https://cvefeed.io/rssfeed/severity/high.atomPalo Alto Networks' report highlights that outdated operational technology (OT) systems and fragmented security tools are leaving critical infrastructure organizations vulnerable to cyberattacks, with 60% reporting incidents in the past year.
Source: https://industrialcyber.co/feed/The ZTE Z80 Ultra product has a vulnerability due to insufficient access control on its system interface, potentially allowing unauthorized access to sensitive information.
Source: https://cvefeed.io/rssfeed/latest.atomLoading dashboard...