CVE-2026-14816

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

CVE-2026-14816 The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks

Recent advances in persistent personal-agent frameworks are making human-centered agent networks realistic deployment targets: each user can be served by an AI agent that acts on the user's behalf, maintains state, and communicates with other agents through social and task relations. In these...

AirKey: Multimodal Acoustic-Assisted WiFi Sensing for Zero-Training Robust PIN Inference

Contactless keystroke inference via WiFi sensing highlights severe privacy threats, yet its real-world feasibility is hindered by two fundamental physical and deployment bottlenecks: the strict requirement for network privileges to acquire stable sensing streams, and the inherent "waveform fusion...

Echoes in the Digital Abyss: Examining the Bubble Surrounding Security and Privacy Discourse in Social Networks

The dissemination of security and privacy education and guidance has been and still remains a challenge today. Social networks represent a potential avenue for sharing best practices, and experimentally they have been found to be effective at this task. While this appears promising, in the real...

CVE-2026-14816: Improper Access Control

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

PT-2026-67647

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills

Persona skills distill personal interaction histories into portable and executable artifacts for downstream agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual...

Guzzle: Noncanonical cookie domain keeps subdomain scope

Impact SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless it recognizes the Domain as an IP literal or a numeric host, and it decides that from the domain's own text, so two spellings a transport reads as an address keep subdomain scope. On 7.15, hexadecimal and...

Californians can tell data brokers to DROP their information

California has launched the Delete Request and Opt‑out Platform DROP, a state‑run portal that lets residents send deletion and opt‑out requests to all registered data brokers in one place. DROP was created under California’s Delete Act, which forces data brokers to register with the California...

bearer v2.1.0

Scan your source code against top security and privacy risks. Bearer is a static application security testing SAST tool designed to scan your source code and analyze data flows to identify, filter, and prioritize security and privacy risks. Bearer offers a free, open solution, Bearer CLI, and a...

CVE-2026-16289

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including privat...

A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...

v2ray-core v5.53.0

Project V Project V is a set of network tools that helps you to build your own computer network. It secures your network connections and thus protects your privacy. Related Links Documentation and Newcomer's Instructions Welcome to translate V2Ray documents via Transifex Packaging Status If you a...

CVE-2026-15254

The Simply Schedule Appointments WordPress plugin, in versions prior to 1.6.12.11 , contains a sensitive data disclosure vulnerability. The root cause is a missing capability check on an administrative appointment-listing shortcode, combined with per-user result scoping that fails open for non-st...

PT-2026-67062

Name of the Vulnerable Software and Affected Versions Tag, Category, and Taxonomy Manager versions prior to 3.51.0 Description This issue occurs because the plugin fails to verify if a user is authorized to access a referenced post before processing it and returning derived data. Consequently,...

PT-2026-67103

Name of the Vulnerable Software and Affected Versions Classified Listing WordPress plugin versions prior to 5.4.4 Description An AJAX action that returns post content fails to perform necessary capability or ownership checks. This allows users with contributor-level access or higher to read the...

IronFox v153.0.2

IronFox F-Droid QR Code: IronFox is a fork of Divested Computing Group's Mull Browser, based on Mozilla Firefox. Our goal is to continue the legacy of Mull by providing a free and open source, privacy and security-oriented web browser for daily use. !TIP Find a bug? Encounter an annoying problem?...

EUVD-2026-51711

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

quill-router — Updated!

TrustedRouter End-to-end encrypted LLMs. One API. Provable privacy. Stop worrying about who can see your prompts. Tell your coding agent to move your project over, pick how private you want to be, pick a model, drop in a key — done. Same API, 30+ models, one key. The gateway runs in hardware...