#cyber-security — Public Fediverse posts

GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

GodDamn ransomware represents the third iteration of ransomware developed by Hyadina, following Monster (2022) and Beast (2024). A recent attack in June 2026 demonstrates sophisticated tactics including AnyDesk for remote access, NirSoft-based credential harvesting tools, and the PoisonX kernel driver for defense evasion. PoisonX is a malicious driver signed by Microsoft that terminates security processes at the kernel level. Attackers used PsExec for lateral movement, deployed comprehensive credential theft toolkits comprising 14 different tools, and disabled endpoint defenses before encrypting files. The encrypted files were renamed with victim organization names as extensions. The four-day dwell period allowed attackers to stage payloads and conduct reconnaissance before triggering encryption across at least 10 hosts within the targeted organization.

Pulse ID: 6a4f99c77bfb2dde4f69e174
Pulse Link: https://otx.alienvault.com/pulse/6a4f99c77bfb2dde4f69e174
Pulse Author: AlienVault
Created: 2026-07-09 12:53:27

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AnyDesk #CredentialHarvesting #CyberSecurity #Encryption #Endpoint #ICS #InfoSec #Microsoft #OTX #OpenThreatExchange #PsExec #RAT #RansomWare #bot #AlienVault

GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

GodDamn ransomware represents the third iteration of ransomware developed by Hyadina, following Monster (2022) and Beast (2024). A recent attack in June 2026 demonstrates sophisticated tactics including AnyDesk for remote access, NirSoft-based credential harvesting tools, and the PoisonX kernel driver for defense evasion. PoisonX is a malicious driver signed by Microsoft that terminates security processes at the kernel level. Attackers used PsExec for lateral movement, deployed comprehensive credential theft toolkits comprising 14 different tools, and disabled endpoint defenses before encrypting files. The encrypted files were renamed with victim organization names as extensions. The four-day dwell period allowed attackers to stage payloads and conduct reconnaissance before triggering encryption across at least 10 hosts within the targeted organization.

Pulse ID: 6a4f99c77bfb2dde4f69e174
Pulse Link: https://otx.alienvault.com/pulse/6a4f99c77bfb2dde4f69e174
Pulse Author: AlienVault
Created: 2026-07-09 12:53:27

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AnyDesk #CredentialHarvesting #CyberSecurity #Encryption #Endpoint #ICS #InfoSec #Microsoft #OTX #OpenThreatExchange #PsExec #RAT #RansomWare #bot #AlienVault

Massive offensive launched on Russian businesses

In May and June 2026, the Clubfoot Wolf cluster executed a large-scale phishing campaign targeting Russian organizations across manufacturing, retail, e-commerce, agriculture, IT, transportation, healthcare, and science sectors, with primary focus on wholesale distributors of chemical products. Several Belarusian organizations were also compromised. The adversary sent phishing emails disguised as invoices or purchase requests, containing ZIP archives with decoy documents and malicious LNK files. Upon execution, a PowerShell script downloaded and installed NetSupport Manager, a legitimate remote administration tool, which was then used for malicious activities. The attackers employed URL shorteners to hide infrastructure and used multiple decoy files to build victim trust. The campaign demonstrated continuous evolution in delivery methods and infection chains.

Pulse ID: 6a4f99c8656ebbe895c7e9e5
Pulse Link: https://otx.alienvault.com/pulse/6a4f99c8656ebbe895c7e9e5
Pulse Author: AlienVault
Created: 2026-07-09 12:53:28

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Belarus #CyberSecurity #Email #Healthcare #InfoSec #LNK #Manufacturing #NetSupport #NetSupportManager #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RCE #Russia #Rust #ZIP #bot #AlienVault

Massive offensive launched on Russian businesses

In May and June 2026, the Clubfoot Wolf cluster executed a large-scale phishing campaign targeting Russian organizations across manufacturing, retail, e-commerce, agriculture, IT, transportation, healthcare, and science sectors, with primary focus on wholesale distributors of chemical products. Several Belarusian organizations were also compromised. The adversary sent phishing emails disguised as invoices or purchase requests, containing ZIP archives with decoy documents and malicious LNK files. Upon execution, a PowerShell script downloaded and installed NetSupport Manager, a legitimate remote administration tool, which was then used for malicious activities. The attackers employed URL shorteners to hide infrastructure and used multiple decoy files to build victim trust. The campaign demonstrated continuous evolution in delivery methods and infection chains.

Pulse ID: 6a4f99c8656ebbe895c7e9e5
Pulse Link: https://otx.alienvault.com/pulse/6a4f99c8656ebbe895c7e9e5
Pulse Author: AlienVault
Created: 2026-07-09 12:53:28

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Belarus #CyberSecurity #Email #Healthcare #InfoSec #LNK #Manufacturing #NetSupport #NetSupportManager #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RCE #Russia #Rust #ZIP #bot #AlienVault

CitrixBleed 2 (CVE-2025-5777) 7 Steps to Dragonforce Ransomware

Between January and June 2026, multiple unrelated organizations experienced nearly identical intrusions following a standardized seven-step attack chain. The attacks exploited CitrixBleed 2 (CVE-2025-5777), a memory-overread vulnerability in NetScaler ADC and Gateway appliances. Attackers sent malformed pre-authentication login requests that leaked NetScaler memory containing valid session tokens, bypassing multi-factor authentication by hijacking active sessions. Following initial access, threat actors consistently escalated privileges to SYSTEM using a registry-symlink exploitation technique targeting the AppMgmt service, created rogue administrator accounts (CtxAppVCOMService, ctxsvc, test), and established persistence through legitimate remote access tools including ScreenConnect and Zoho Assist. The most advanced case culminated in DragonForce ransomware deployment. The highly standardized tradecraft, reused infrastructure, and consistent indicators across unrelated victims suggest a single Initial Ac...

Pulse ID: 6a4fa0227d951890d045e399
Pulse Link: https://otx.alienvault.com/pulse/6a4fa0227d951890d045e399
Pulse Author: AlienVault
Created: 2026-07-09 13:20:34

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Citrix #CyberSecurity #InfoSec #NetScaler #OTX #OpenThreatExchange #RAT #RCE #RansomWare #ScreenConnect #Vulnerability #bot #AlienVault

CitrixBleed 2 (CVE-2025-5777) 7 Steps to Dragonforce Ransomware

Between January and June 2026, multiple unrelated organizations experienced nearly identical intrusions following a standardized seven-step attack chain. The attacks exploited CitrixBleed 2 (CVE-2025-5777), a memory-overread vulnerability in NetScaler ADC and Gateway appliances. Attackers sent malformed pre-authentication login requests that leaked NetScaler memory containing valid session tokens, bypassing multi-factor authentication by hijacking active sessions. Following initial access, threat actors consistently escalated privileges to SYSTEM using a registry-symlink exploitation technique targeting the AppMgmt service, created rogue administrator accounts (CtxAppVCOMService, ctxsvc, test), and established persistence through legitimate remote access tools including ScreenConnect and Zoho Assist. The most advanced case culminated in DragonForce ransomware deployment. The highly standardized tradecraft, reused infrastructure, and consistent indicators across unrelated victims suggest a single Initial Ac...

Pulse ID: 6a4fa0227d951890d045e399
Pulse Link: https://otx.alienvault.com/pulse/6a4fa0227d951890d045e399
Pulse Author: AlienVault
Created: 2026-07-09 13:20:34

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Citrix #CyberSecurity #InfoSec #NetScaler #OTX #OpenThreatExchange #RAT #RCE #RansomWare #ScreenConnect #Vulnerability #bot #AlienVault

RedHook Returns with a Dangerous Upgrade

RedHook is an Android Remote Access Trojan that has re-emerged with significant enhancements, particularly in privilege abuse capabilities. The malware autonomously exploits Android's ADB Wireless Debugging features to obtain shell-level access, integrating the Shizuku framework to execute protected system APIs. Recent activity shows expansion beyond Vietnam to Indonesia, targeting Southeast Asian users through spoofed government and financial websites. Malicious APKs are hosted on trusted platforms like AWS S3 and GitHub repositories. The current version supports 53 distinct server-issued commands and employs sophisticated persistence mechanisms including foreground activity spoofing, silent media playback, and cross-process monitoring. Distribution relies on social engineering via phone calls and messaging applications, tricking victims into downloading malicious APKs and enabling Accessibility services under false pretenses.

Pulse ID: 6a4fa023bcc8675bb1b91cfc
Pulse Link: https://otx.alienvault.com/pulse/6a4fa023bcc8675bb1b91cfc
Pulse Author: AlienVault
Created: 2026-07-09 13:20:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APK #AWS #Android #Asia #CyberSecurity #GitHub #Government #Indonesia #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RemoteAccessTrojan #Rust #SMS #SocialEngineering #Trojan #UK #Vietnam #bot #AlienVault

RedHook Returns with a Dangerous Upgrade

RedHook is an Android Remote Access Trojan that has re-emerged with significant enhancements, particularly in privilege abuse capabilities. The malware autonomously exploits Android's ADB Wireless Debugging features to obtain shell-level access, integrating the Shizuku framework to execute protected system APIs. Recent activity shows expansion beyond Vietnam to Indonesia, targeting Southeast Asian users through spoofed government and financial websites. Malicious APKs are hosted on trusted platforms like AWS S3 and GitHub repositories. The current version supports 53 distinct server-issued commands and employs sophisticated persistence mechanisms including foreground activity spoofing, silent media playback, and cross-process monitoring. Distribution relies on social engineering via phone calls and messaging applications, tricking victims into downloading malicious APKs and enabling Accessibility services under false pretenses.

Pulse ID: 6a4fa023bcc8675bb1b91cfc
Pulse Link: https://otx.alienvault.com/pulse/6a4fa023bcc8675bb1b91cfc
Pulse Author: AlienVault
Created: 2026-07-09 13:20:35

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#APK #AWS #Android #Asia #CyberSecurity #GitHub #Government #Indonesia #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RemoteAccessTrojan #Rust #SMS #SocialEngineering #Trojan #UK #Vietnam #bot #AlienVault

A proposed change to the German Intelligence Services Law (#BND-Gesetz) would--if enacted--require #cybersecurity authorities to notify any #0day to the German foreign and domestic intelligence service to that they can abuse it until it's fixed.

This means friendly hackers that find and notify such #vulnerabilities through official channels would directly contribute to their exploitation by government spies.

https://www.bmi.bund.de/SharedDocs/gesetzgebungsverfahren/DE/OESI2/nachrichtendienstrecht.html

Via @HonkHase

#privacy #DigitalRights #DigitalSecurity

A proposed change to the German Intelligence Services Law (#BND-Gesetz) would--if enacted--require #cybersecurity authorities to notify any #0day to the German foreign and domestic intelligence service to that they can abuse it until it's fixed.

This means friendly hackers that find and notify such #vulnerabilities through official channels would directly contribute to their exploitation by government spies.

https://www.bmi.bund.de/SharedDocs/gesetzgebungsverfahren/DE/OESI2/nachrichtendienstrecht.html

Via @HonkHase

#privacy #DigitalRights #DigitalSecurity

Windows-Installationen: VPN allein verhindert keine Gerätezuordnung

Habt ihr gewusst, dass ein VPN bei einer Windows-Installation zwar die öffentlich sichtbare IP-Adresse verbirgt, aber nicht automatisch andere Gerätekennungen verschleiert? Eine persistente Microsoft Global Device Identifier (GDID) kann trotz VPN-Nutzung erkennbar bleiben.

Microsoft kann eine solche Kennung anhand zeitgestempelter Zugriffsprotokolle identifizieren und entsprechende Informationen im Rahmen einer gerichtlichen Anordnung an Ermittlungsbehörden übermitteln. Microsoft-Sicherheitsforscher verfügen dabei unter anderem über Telemetriedaten wie Geräte- und Maschinen-IDs, IP-Adressen, Malware-Samples sowie weitere Informationen zu verdächtigen Aktivitäten.

Die IP-Historie einer GDID kann anschließend ausgewertet und zeitlich mit Anmeldungen bei weiteren Diensten wie Snapchat, Apple oder Facebook abgeglichen werden. Selbst wenn sich die verwendeten IP-Adressen oder Standorte ändern, können zeitlich übereinstimmende Zugriffe eine Verbindung zwischen einer Windows-Installation und verschiedenen Benutzerkonten erkennen lassen.

Solche Gerätekennungen werden unter anderem für Diagnose- und Absturzberichte, die Analyse der Funktionsnutzung, die Erkennung von Missbrauch – etwa mehrfach beanspruchte Testversionen oder Lizenzen – sowie für sicherheitsbezogene Geräte- und Konto-Korrelationen eingesetzt.

Ich finde, das zeigt ziemlich deutlich: Wechselnde IP-Adressen oder ein VPN verhindern nicht zwangsläufig, dass eine Windows-Installation anhand persistenter Gerätekennungen, Betriebssystem-Telemetrie und zeitlich korrelierter Dienstprotokolle wiedererkannt wird.

:boost_ok:

#Windows #Microsoft #VPN #Datenschutz #CyberSecurity #ITSecurity

Revive Adserver: 25 CVEs, 8 high-severity, avg CVSS 6.17. 100% unpatched. Trust Score: C. Open-source ad server, but 100% unpatched is risky. #ReviveAdserver #infosec #cybersecurity

https://www.valtersit.com/vendors/revive-adserver/

Sysdig documented JADEPUFFER, the first agentic ransomware run end-to-end by an AI agent. It breached Langflow via CVE-2025-3248 and extorted a database.

#JADEPUFFER #AgenticRansomware #AI #Ransomware #Langflow #Sysdig #CyberSecurity #InfoSec

https://securityonline.info/jadepuffer-agentic-ransomware/?utm_source=mastodon&utm_medium=jetpack_social

Sysdig documented JADEPUFFER, the first agentic ransomware run end-to-end by an AI agent. It breached Langflow via CVE-2025-3248 and extorted a database.

#JADEPUFFER #AgenticRansomware #AI #Ransomware #Langflow #Sysdig #CyberSecurity #InfoSec

https://securityonline.info/jadepuffer-agentic-ransomware/?utm_source=mastodon&utm_medium=jetpack_social

Google NotebookLM zapisuje Twoje notatki do formatu wideo. Google NotebookLM (LM = Language Model) to internetowe narzędzie do badań i robienia notatek opracowane przez Google Labs, które wykorzystuje sztuczną inteligencję... https://linuxiarze.pl/google-notebooklm-zapisuje-twoje-notatki-do-formatu-wideo/ #cybersecurity #sztucznainteligencja #notatki

Google NotebookLM zapisuje Twoje notatki do formatu wideo. Google NotebookLM (LM = Language Model) to internetowe narzędzie do badań i robienia notatek opracowane przez Google Labs, które wykorzystuje sztuczną inteligencję... https://linuxiarze.pl/google-notebooklm-zapisuje-twoje-notatki-do-formatu-wideo/ #cybersecurity #sztucznainteligencja #notatki

🚨 EUVD-2026-42788

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: CowAgent, CowAgent
🏢 Vendor: zhayujie
📅 Updated: 2026-07-10

📝 A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument i...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42788

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42788

📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: CowAgent, CowAgent
🏢 Vendor: zhayujie
📅 Updated: 2026-07-10

📝 A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument i...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42788

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42790

📊 Score: 9.8/10 (CVSS v3.1)
📦 Product: Instant Appointment
🏢 Vendor: tenteeglobal
📅 Updated: 2026-07-10

📝 The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible fo...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42790

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42789

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: CowAgent, CowAgent
🏢 Vendor: zhayujie
📅 Updated: 2026-07-10

📝 A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_package of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name lea...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42789

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42790

📊 Score: 9.8/10 (CVSS v3.1)
📦 Product: Instant Appointment
🏢 Vendor: tenteeglobal
📅 Updated: 2026-07-10

📝 The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible fo...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42790

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42789

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: CowAgent, CowAgent
🏢 Vendor: zhayujie
📅 Updated: 2026-07-10

📝 A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_package of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name lea...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42789

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42791

📊 Score: 4.4/10 (CVSS v3.1)
📦 Product: WPvivid Backup for MainWP
🏢 Vendor: wpvividplugins
📅 Updated: 2026-07-10

📝 The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42791

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42791

📊 Score: 4.4/10 (CVSS v3.1)
📦 Product: WPvivid Backup for MainWP
🏢 Vendor: wpvividplugins
📅 Updated: 2026-07-10

📝 The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.9.33 due to insufficient input sanitization and output escaping. This makes it...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42791

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42792

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
🏢 Vendor: reputeinfosystems
📅 Updated: 2026-07-10

📝 The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42792

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42792

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
🏢 Vendor: reputeinfosystems
📅 Updated: 2026-07-10

📝 The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42792

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42793

📊 Score: 6.4/10 (CVSS v3.1)
📦 Product: King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder
🏢 Vendor: kingaddons
📅 Updated: 2026-07-10

📝 The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42793

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42793

📊 Score: 6.4/10 (CVSS v3.1)
📦 Product: King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder
🏢 Vendor: kingaddons
📅 Updated: 2026-07-10

📝 The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42793

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42794

📊 Score: 6.4/10 (CVSS v3.1)
📦 Product: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
🏢 Vendor: posimyththemes
📅 Updated: 2026-07-10

📝 The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42794

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42796

📊 Score: 6.5/10 (CVSS v3.1)
📦 Product: rtMedia for WordPress, BuddyPress and bbPress
🏢 Vendor: rtCamp
📅 Updated: 2026-07-10

📝 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42796

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42795

📊 Score: 4.3/10 (CVSS v3.1)
📦 Product: Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
🏢 Vendor: StellarWP
📅 Updated: 2026-07-10

📝 The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to unauthorized post publication in all versions up to, and including, 3.5.32 due to a misconfigured ca...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42795

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42796

📊 Score: 6.5/10 (CVSS v3.1)
📦 Product: rtMedia for WordPress, BuddyPress and bbPress
🏢 Vendor: rtCamp
📅 Updated: 2026-07-10

📝 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42796

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42797

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator
🏢 Vendor: brainstormforce
📅 Updated: 2026-07-10

📝 The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1....

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42797

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-42799

📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
🏢 Vendor: ultimatemember
📅 Updated: 2026-07-10

📝 The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerabl...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42799

#cybersecurity #infosec #euvd #cve #vulnerability