A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service (DoS) and a system reboot via a manipulated HTTP POST request directed at the endpoint ‘/js/common/do_cmd.js’ endpoint containing an excessively long parameter, which overwrites the PC and RA registers.
A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same network to gain full root access to the device via the Telnet service (port 23) using static credentials.
OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation details are provided in the input data.
Rig Security has launched an identity protection platform designed to address risks posed by autonomous AI agents that act under human identities with legitimate permissions. These AI agents can perform actions indistinguishable from their human counterparts, creating a security gap where traditional tools cannot differentiate between legitimate user activity and rogue agent behavior. Rig's platform uses a combination of an identity correlation engine and an endpoint sensor to map identity dependencies and enforce policies that block malicious AI agent actions without disrupting the legitimate user. The solution aims to enable enterprises to adopt AI technologies securely by managing AI and non-human identity risks.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have an initialization vulnerability where a resource is set with an insecure default. This flaw could allow a high privileged attacker with remote access to elevate privileges, tamper with information, bypass protection mechanisms, and gain unauthorized access. The CVSS score is 3.8, indicating a low severity risk. No patch information is provided, and no known exploits are reported in the wild.
Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.
This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.
CVE-2026-102507 is an out-of-bounds read vulnerability in BishopFox's Sliver C2 framework version 1.7.7 and earlier. It occurs in the operator gRPC handler when processing malformed or empty Download responses from compromised implants. This flaw allows an attacker controlling a hostile implant session to crash the entire teamserver by triggering an unhandled panic via zero-length or very short data payloads. The vulnerability stems from the Binject library's BinaryMagic function and results in termination of the server process, impacting all connected operators.
Apache DolphinScheduler versions before 3.4.3 contain a vulnerability in the /datasources/unauth-datasource endpoint that fails to properly enforce authorization. Authenticated users can access information about data sources they should not be authorized to view, potentially exposing sensitive configuration and metadata. This issue is fixed in version 3.4.3.
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password.
This software does implement simple protection against this type of attack, but it is easily bypassed by manipulating the referer header. All forms available in this software are potentially vulnerable.
This issue was fixed in a patch to version 6.7 published on 09.11.2026, deployments without this patch are still vulnerable
A Vietnamese individual was charged with money laundering related to a large-scale 'pig butchering' cryptocurrency scam that defrauded a victim of $16 million. The scam involved fraudulent activities targeting cryptocurrency investors.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain a vulnerability where code is downloaded without an integrity check. This flaw could allow an unauthenticated remote attacker to execute code, disclose information, tamper with data, or bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 4.7. No official patch or remediation details are provided in the available data.
CVE-2026-102497 is a denial of service vulnerability in Apache XMLSchema's xmlschema-walker component. The walker does not detect cycles in type derivation, substitution groups, model groups, or attribute groups, which can cause recursive stack overflow. This issue is fixed in Apache XMLSchema version 2.3.3. Users running versions prior to 2.3.3 are vulnerable to this denial of service attack.
Apache XMLSchema versions prior to 2.3.3 contain a vulnerability where deeply nested schema structures can cause a stack overflow during parsing, leading to denial of service. This issue is fixed in version 2.3.3.
Apache XMLSchema versions before 2.3.3 contain a vulnerability where schema imports and includes can be nested without limit, leading to stack overflow during parsing. This results in a denial of service condition. The issue is fixed in version 2.3.3.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain an improper certificate validation vulnerability (CWE-295). This flaw allows an unauthenticated attacker with adjacent network access to potentially cause information disclosure, information tampering, and bypass protection mechanisms. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity).
This report outlines four emerging cyber threats shaping the future security landscape: artificial intelligence (AI)-driven attacks, supply-chain and third-party risks, the future impact of quantum computing on encryption, and geopolitical conflicts targeting critical infrastructure. It emphasizes the need for organizations to build resilience as a continuous operational objective rather than relying on single tools or policies. The threats include AI-enabled automation of attacks and deepfakes, supply-chain compromises that exploit trusted vendor relationships, the long-term risk of quantum computers breaking current cryptography, and nation-state cyberattacks and disinformation campaigns. The report advises proactive mitigation strategies tailored to each threat area.
Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE).
This issue was fixed in version 2.3.9.