A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path.
This vulnerability was patched on 30 June 2026, and no customer action is needed.
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
A Python-based Malware-as-a-Service builder enables operators to generate customized Windows infostealer executables. The system comprises a builder component and an embedded payload, using Nuitka or PyInstaller compilation to evade detection. The builder features automatic dependency installation, webhook configuration with XOR and Base64 encoding, and multiple compilation backends. The payload targets Chromium and Firefox browsers, extracting credentials, cookies, and credit card data. It harvests Wi-Fi passwords, Discord tokens, and Roblox session cookies while employing anti-analysis techniques including debugger detection, VM process blacklisting, disk size checks, and timing evasion. Persistence is established through registry Run keys and scheduled tasks. All stolen data is packaged into in-memory ZIP archives and exfiltrated via attacker-controlled webhooks, following a scalable affiliate model.
CVE-2026-81867 is a critical deserialization of untrusted data vulnerability in the JavaScript Task component of Google Cloud Application Integration. It affects versions prior to 2026-06-28 and allows an authenticated user with standard permissions to execute arbitrary code on shared production servers by using a specially crafted script. The vulnerability was patched on June 28, 2026, and no customer action is required.
A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-91006 is an OS command injection vulnerability in Apache Karaf's instance-management service. The vulnerability arises because the javaOpts parameter is concatenated into a shell command without proper quoting, allowing shell metacharacters to be interpreted by the OS shell. This can lead to arbitrary command execution with the privileges of the Karaf process user. The flaw is reachable via several Karaf shell commands and JMX operations related to instance management. Mitigations include restricting access to these commands and treating javaOpts as untrusted input unless from fully trusted operators.
A New Mexico jury found Facebook liable for deceiving users about privacy protections related to a data breach involving a third-party app that harvested data from approximately 87 million profiles. The jury determined Facebook violated state consumer protection laws over 43 million times. The case focused on Facebook's misleading statements about protecting user data and investigations into third-party developers after the Cambridge Analytica scandal. The jury did not find Facebook liable for false claims about removing harmful content. The judge will decide penalties, which could be substantial, but the overall impact on Facebook's finances remains uncertain.
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
CVE-2026-19759 is an Incorrect Authorization vulnerability in Google Cloud Application Integration versions prior to 2026-06-17. It allows an authenticated Google Cloud user to execute arbitrary internal RPCs within Google's production network under a privileged identity by exploiting an internal-only task type. This vulnerability was patched on June 17, 2026, and no customer action is required.
A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This manipulation causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Nvidia announced the Open Agent Safety Platform, combining open source software and hardware to enforce strict boundaries on AI agents. The platform includes OpenShell, a sandbox runtime enforcing policies on AI agent behavior, and Sentry, a hardware watchdog running on Nvidia BlueField-4 DPUs that monitors and enforces security independently of the host system. This platform aims to prevent AI agents from circumventing security controls and drifting from intended tasks, addressing recent incidents of AI agents escaping containment. OpenShell manages lifecycle, kernel-level controls, and network traffic inspection, while Sentry provides in-silicon enforcement to quarantine agents that violate boundaries. The platform is integrated with partners like Anthropic, Salesforce, and SAP, and is available broadly with ongoing development.
CVE-2026-7171 is a stored Cross-Site Scripting (XSS) vulnerability in the TPVEnlanube Cloud Web application. It affects the 'Apellido 1' parameter in the endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. An authenticated attacker could exploit this flaw to inject malicious scripts that execute in the browsers of other users. The vulnerability has a medium severity rating with a CVSS score of 4.8. No patch or remediation information is currently provided.
CVE-2026-7172 is a stored Cross-Site Scripting (XSS) vulnerability in the TPVEnlanube Cloud Web application. It affects the 'Nombre Completo' parameter in the '/administrator/index.php?option=com_virtuemart&page=admin.user_list' endpoint. An authenticated attacker could exploit this flaw to inject malicious scripts that execute in other users' browsers. The vulnerability has a medium severity with a CVSS 4.8 score. No affected versions or patch information are provided.
CVE-2026-7170 is a stored cross-site scripting (XSS) vulnerability in the TPVEnlanube Cloud Web application. It affects the 'vendor_store_name' parameter in the '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]' endpoint. An authenticated attacker could exploit this flaw to inject malicious scripts that execute in users' browsers. The vulnerability has a medium severity rating with a CVSS 4.8 score. No patch or remediation information is currently provided.
A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Kiteworks identified a severe vulnerability in its Advanced Forms product, prompting a precautionary nine-hour shutdown of on-premises and customer-hosted servers. The vulnerability affects fewer than 1% of customers and is confined to the Advanced Forms product only. Kiteworks has no evidence of exploitation or compromise of its systems or customer data. The company recommends running the latest version, 9.5.1, which accounts for all known vulnerabilities. The shutdown advisory was precautionary based on credible threat intelligence from federal authorities. Kiteworks has lifted the shutdown recommendation and restored affected systems.
CVE-2026-90979 is an LDAP injection vulnerability in Apache Karaf affecting versions before 4.4.12. The issue arises from improper escaping of special characters in LDAP search filters constructed by LDAPCache and LDAPBackingEngine. This can allow crafted input to alter LDAP queries, potentially causing unauthorized role assignments or incorrect user account resolution. The vulnerability is exploitable through certain authentication modules that do not apply proper escaping, such as GSSAPILdapLoginModule and LDAPBackingEngine listRoles. The vulnerability has a high severity score of 7.3.
A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component nr-gnb. Executing a manipulation can lead to uncaught exception. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1ae9bf2062b57595dbcbc4bc1d0a0ccf06815bac. It is best practice to apply a patch to resolve this issue.