Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS).
This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.
CVE-2026-100377 is a medium-severity vulnerability in the Wikimedia Foundation's Mediawiki WikiLambda Extension version 1.47.0-alpha. It involves exposure of sensitive information to unauthorized actors. The issue has been fixed in the master branch of the codebase. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network-exploitable flaw with low complexity and no required privileges or user interaction.
CVE-2026-100208 is an integer overflow or wraparound vulnerability in Microsoft Office Outlook, part of Microsoft 365 Apps for Enterprise version 16.0.1. This flaw allows an unauthorized attacker to remotely execute code over a network. The vulnerability has a high severity with a CVSS score of 7.5. An official fix is available from Microsoft. There are no known exploits in the wild at this time.
Anthropic now allows you to run Claude Code via cloud sessions without signing up for the research preview, and it's offering up to $250 in free usage credits, so more users can give it a try. [...]
Node DOMPurify versions before 3.4.13 contain a cross-site scripting (XSS) vulnerability related to IN_PLACE sanitization where element-removal hooks fail to neutralize malicious input. Red Hat has issued an advisory updating the grafana13.2 package to address this and other vulnerabilities. The update is available for specific versions on aarch64 and x86_64 architectures. The vulnerability is classified as medium severity.
This report summarizes malware trends observed in the first half of 2026, highlighting shifts in attacker focus and techniques. Infostealers increasingly target session tokens, cookies, recovery codes, and cryptowallet data rather than traditional passwords. Malicious shortcut files (LNK) remain a common infection vector. There is a notable rise in abuse of legitimate platforms through SEO poisoning, malvertising, fraudulent code signing, and compromises of software repositories such as npm, PyPI, and Crates.io. Supply chain attacks targeting software delivery channels and CI/CD pipelines are growing. Remote Management and Monitoring (RMM) tools are frequently abused due to their signed status and low detection rates. Legitimate websites are increasingly compromised to host malicious code via administrator account takeover or unpatched vulnerabilities. Popular exfiltration channels include Discord, Telegram, and GoFile, used for data theft and evasion. Dead drop resolvers and blockchain infrastructure abuse are also prevalent. The report does not describe a specific vulnerability or exploit but provides an overview of evolving malware tactics.
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery.
This issue affects Elementor Website Builder: from n/a through 4.3.1.
WordPress Core has a remote file inclusion vulnerability that allows unauthenticated attackers to include a chosen readable local PHP file outside the active theme directories. This can lead to remote code execution. The vulnerability has a high severity score of 8.1 and has been exploited in the wild. No specific affected versions or patch information is provided.
RemotePanel and BoundSiphon are two .NET malware components delivered together via malicious NuGet packages impersonating Chinese UI libraries. RemotePanel is a persistent remote access tool masquerading as the Windows Time service, providing extensive control over infected systems. BoundSiphon is an in-memory stealer targeting browser credentials, cryptocurrency wallets, password managers, and sensitive documents. The malware uses a blockchain-based mechanism to dynamically resolve its command and control servers, enabling infrastructure rotation without redeployment. The campaign involves typosquatting private or internal Chinese .NET libraries, affecting developer workstations and CI/CD environments. The malware ecosystem is modular, separating persistence from data theft, allowing operators to maintain capabilities while swapping components. Tens of thousands of downloads have been recorded, and the packages remain available on NuGet at the time of reporting. Blackpoint Cyber has detections for key behaviors in the infection chain, aiding defense despite evolving payloads and infrastructure.
An out-of-bounds read vulnerability exists in the XQueryDeviceState() function of libXi versions before 1.8.4. This flaw can cause client applications to crash when interacting with a malicious X server, resulting in a denial of service (DoS). A security update from Red Hat addresses this issue by providing patched versions of libXi and libXi-devel RPMs. No mitigations meeting Red Hat's criteria are currently available aside from applying the update.
Red Hat has released a critical security advisory for the Red Hat Hardened Images RPMs, specifically updating the openshell, openshell-gateway, and python3-openshell packages to version 0.0.116-0.2.hum1 on aarch64 and x86_64 architectures. The advisory addresses multiple CVEs including CVE-2026-65083, CVE-2026-65093, and CVE-2026-93599, but does not provide detailed vulnerability descriptions or CVSS scores. The update is intended as a bug fix and enhancement to improve security.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.
We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later