Aggregator

It echoes earlier alerts from the Netherlands and Germany, and is the latest to warn about targeting of Signal users and others.

The post FBI, CISA issue PSA on Russian intelligence campaign to target messaging apps appeared first on CyberScoop.

Attackers can execute arbitrary code without authentication if Oracle's Identity or Web Services Managers are exposed to the Web.

A vulnerability was found in asbplayer 1.13.0 and classified as critical. Impacted is an unknown function of the component Subtitle File Handler. Such manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2025-69771. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as critical, has been found in siteboon claude-code-ui. Affected by this issue is some unknown functionality of the component Websocket Handler. The manipulation leads to os command injection. This vulnerability is documented as CVE-2026-31975. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability categorized as critical has been discovered in qhkm zeptoclaw up to 0.7.5. The impacted element is an unknown function of the file /webhook. Executing a manipulation of the argument sender/chat_id can lead to missing authentication. The identification of this vulnerability is CVE-2026-32231. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability labeled as problematic has been found in xtemos WoodMart Plugin up to 8.3.9 on WordPress. The affected element is an unknown function. Such manipulation leads to exposure of sensitive system information to an unauthorized control sphere. This vulnerability is documented as CVE-2026-32405. The attack can be executed remotely. There is not any exploit available.

A vulnerability marked as critical has been reported in Bogdan Bendziukov Squeeze Plugin up to 1.7.7 on WordPress. This affects an unknown function. The manipulation leads to path traversal: '.../...//'. This vulnerability is listed as CVE-2026-32415. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in IBM Sterling B2B Integrator up to 6.1.2.7_2/6.2.0.5_1/6.2.1.1_1/6.2.2.0. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in insertion of sensitive information into sent data. This vulnerability is known as CVE-2025-14483. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability marked as problematic has been reported in hexpm hex.pm. This vulnerability affects unknown code. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2026-23940. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability identified as problematic has been detected in tolgee tolgee-platform up to 3.166.2. Affected by this vulnerability is an unknown functionality of the component XML Parser. This manipulation causes xml external entity reference. The identification of this vulnerability is CVE-2026-32251. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability was found in BoldGrid Client Invoicing by Sprout Invoices Plugin up to 20.8.9 on WordPress and classified as critical. Affected is an unknown function. The manipulation results in improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability is cataloged as CVE-2026-32401. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in gVectors wpDiscuz up to 7.6.46. Affected by this issue is some unknown functionality of the component CSS Setting Handler. The manipulation of the argument customCss leads to cross site scripting. This vulnerability is listed as CVE-2026-22209. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability marked as critical has been reported in Linksys E4200, E3200, E3000, E2500, E2100L, E2000, E1550, E1500, E1200, E1000 and E900. This affects an unknown function of the file /tmUnblock.cgi of the component Service Port 8080. Performing a manipulation of the argument ttcp_ip results in os command injection. This vulnerability is known as CVE-2025-34037. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Foster City warned that it is possible the hackers obtained public information, urging anyone that has done business with the city to change personal passwords and take measures to protect personal data.

A vulnerability categorized as critical has been discovered in TP-Link AX53. This impacts an unknown function. Executing a manipulation can lead to command injection. This vulnerability appears as CVE-2025-15607. The attacker needs to be present on the local network. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in TP-Link AX53. It has been classified as critical. The affected element is an unknown function. This manipulation causes stack-based buffer overflow. This vulnerability is registered as CVE-2025-15608. The attack requires access to the local network. No exploit is available. Upgrading the affected component is recommended.

Navia Benefit Solutions data breach exposed 2.7M people after attackers accessed systems from December 2025 to January 2026. Navia Benefit Solutions disclosed a data breach affecting 2,697,540 individuals. The company detected suspicious activity on January 23, 2026 and quickly launched an investigation to assess the incident. Navia Benefit Solutions is a U.S.-based company that provides […]