CVE-2026-11870

The WP Ghost (Hide My WP Ghost) WordPress plugin versions prior to 7.0.05 is vulnerable to an IP Address Spoofing attack. The root cause is the plugin's failure to verify that client IP information originates from a trusted proxy before accepting attacker-controllable HTTP headers. This oversight...

CVE-2026-11870 Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass

The WP Ghost Hide My WP Ghost WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost Hide My WP Ghost WordPress...

CVE-2026-64310

A flaw was found in the Linux kernel's crypto: ccp component. A local user, by triggering specific SEV Secure Encrypted Virtualization input/output control ioctl operations when SEV initialization fails and Kernel-based Virtual Machine KVM is actively running virtual machines, could cause the...

PT-2026-66571

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

PT-2026-66367

Name of the Vulnerable Software and Affected Versions WP Ghost Hide My WP Ghost versions prior to 7.0.05 Description The plugin fails to verify if client IP information originates from a trusted proxy before trusting attacker-controllable HTTP headers. This allows unauthenticated attackers to spo...

CVE-2026-66756: Improper Protection of Alternate Path

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the lack of measures taken to protect the structure of web pages, allowing attackers to perform spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

CVE-2026-17659: Protection Mechanism Failure

Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-11870: Authentication Bypass by Spoofing

The WP Ghost Hide My WP Ghost WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost Hide My WP Ghost WordPress...

Important: Red Hat Security Advisory: golang security, bug fix, and enhancement update

An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-63118 MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

CVE-2026-67425 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAIAPIKEY and ANTHROPICAPIKEY from the environment and sends them in the Authorization: Bearer header to caller-controlled baseurl, allowing an attacker to receive th...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure due to the use of 0.0.0.0 instead of NXDOMAIN in block responses. An attacker can cause unintended network traffic to be sent to localhost by triggering blocked DNS queries. Remediation Upgrade...

CVE-2026-64559

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

CVE-2026-64559 s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEYVERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size...

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a...

​​Better security starts with better questions

As organizations move beyond AI experimentation, success will depend on how effectively they combine intelligence and trust. The same systems that amplify knowledge, accelerate decisions, and unlock new outcomes must also protect data, govern AI, and build resilience. In this next phase of...

CVE-2026-14354

CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially leading to compromise of managed devices, when a local privileged attacker leverages weaknesses in the handling and protection of stored...

Sweet Security Brings Autonomous Protection to the AI Enterprise with New Blocking Capabilities

Las Vegas, USA, 29th July 2026, CyberNewswire...

CVE-2026-14354

CVE-2026-14354 concerns Schneider Electric’s EcoStruxure Cybersecurity Admin Expert (CAE) software, where insufficient protection of registration data and stored credentials can enable a local privileged attacker to bypass authentication and modify credentials, potentially compromising managed de...