Live Threat Intelligence Radar

A New Mexico court ordered Meta to pay $25 billion for intentionally deceiving Facebook users about privacy controls, marking the largest fine against the company. The ruling found Meta liable for over 43 million violations of New Mexico consumer protection laws related to misleading statements about user data handling. This case stems from the Cambridge Analytica scandal where Facebook data was harvested for political advertising. Meta disputes the ruling and plans to appeal. The fine significantly exceeds previous penalties, including a $5 billion FTC fine in 2019. The judgment aims to hold tech companies accountable for privacy misrepresentations.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.11.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward.

CVE-2026-105270 is a high-severity vulnerability in the arekinath esaml library affecting versions 0.1.0 and later. It involves allocation of resources without limits or throttling in the esaml_binding component, allowing unauthenticated attackers to exhaust the Erlang VM atom table and crash the node by sending crafted SAMLResponse messages. The vulnerability arises because the SAMLResponse is parsed with xmerl_scan:string/2, which interns XML element and attribute names as permanent atoms that are never reclaimed. Since the SAML consume and single-logout endpoints process these requests before signature verification, an attacker can cause a denial of service by exhausting the atom table with relatively small requests. No patch or remediation information is provided in the source data.

CVE-2026-114182 is a missing authorization vulnerability in the PowerPack Addons for Elementor plugin by IdeaBox Creations. It affects versions from initial release up to 3.1.0. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The CVSS score is 4.3, indicating a medium severity impact primarily on confidentiality. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.

CVE-2026-112843 is a missing authorization vulnerability in the WordPress plugin Strong Testimonials by WP Chill. It affects versions from initial release up to 3.3.14. The flaw allows exploitation due to incorrectly configured access control, potentially enabling unauthorized actions. The vulnerability has a medium severity with a CVSS score of 4.3. No known exploits are reported in the wild, and no official patch or vendor advisory is provided in the input data.

CVE-2026-112826 is a missing authorization vulnerability in the eLightUp Falcon – WordPress Optimizations & Tweaks plugin. This flaw allows unauthorized users to exploit incorrectly configured access control security levels. The issue affects versions from initial release up to and including 2.12.0. The vulnerability has a medium severity rating with a CVSS score of 5.3, indicating limited impact primarily on confidentiality. No official patch or remediation information is provided in the available data.

CVE-2026-114180 is a missing authorization vulnerability in the Wpmet Metform plugin affecting versions prior to 4.3.3. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity with a CVSS score of 5.3 and does not impact confidentiality or availability, only integrity. No known exploits are reported in the wild. No patch or vendor advisory is provided in the input data.