CVE-2026-59659 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Repasat application. It affects the 'nomZonaGeo' parameter at the '/es/geozones/update/149979' endpoint. This flaw allows attackers to inject malicious scripts that could execute in users' browsers. No patch or remediation information is currently available.
Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data.
This issue affects Advanced Ads: from n/a through 2.0.26.
The China-based hacking group known as Warlock, linked to Longlegs and Storm-2603, has been exploiting SharePoint vulnerabilities since July 2025 to target critical infrastructure, government, education, and telecom entities globally. Their attacks leverage multiple SharePoint flaws including ToolShell zero-days and recent CVEs such as CVE-2026-32201 and others. The group employs advanced techniques including webshell deployment, ASP.NET machine key exfiltration, DLL sideloading, and disabling security software to execute ransomware at scale. They also abuse Visual Studio Code's tunnel feature for covert network access and stage ransomware payloads in SYSVOL shares for domain-wide impact. These activities demonstrate that unpatched or unmitigated SharePoint vulnerabilities remain a significant attack vector for ransomware campaigns.
CVE-2026-80337 is a Missing Authorization vulnerability in HAVELSAN Inc.'s Sef - AI Chatbot Platform that allows access to functionality not properly constrained by access control lists (ACLs). This affects versions before 2.1. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts confidentiality but not integrity or availability.
An improper certificate validation vulnerability exists in HAVELSAN Inc.'s Sef - AI Chatbot Platform versions before 2.1. This flaw could allow an adversary to perform an Adversary in the Middle (AiTM) attack. The vulnerability has a high severity with a CVSS score of 7.4. No patch or remediation information is currently provided.
A Server-Side Request Forgery (SSRF) vulnerability exists in HAVELSAN Inc.'s Sef - AI Chatbot Platform versions before 2.1. This vulnerability allows an attacker with high privileges to cause the server to make unauthorized requests. The vulnerability has a medium severity with a CVSS score of 4.9.
A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.
The Events Calendar WordPress plugin versions before 6.17.5.1 contain a vulnerability where unauthenticated AJAX requests can submit data that is not properly validated or sanitized before being merged into the rendering context. This flaw allows unauthenticated users to execute arbitrary shortcodes registered on the site, potentially leading to limited confidentiality and integrity impacts.
The WP User Frontend WordPress plugin versions before 4.3.12 contain a vulnerability where the subscription-purchase requirement is not enforced in one of its post-creation handlers. This flaw allows authenticated users with subscriber-level access or higher to create and potentially publish posts via forms that are intended only for paying subscribers. The vulnerability has a medium severity score of 4.3 and does not impact confidentiality or availability but can lead to unauthorized content publication.
CVE-2026-63569 is a critical vulnerability in the DHAgreement.CalculateAgreement function of Legion of the Bouncy Castle Inc. bc-csharp before version 2.7.0. It involves improper input validation in the MTI/A0 two-pass Diffie-Hellman key agreement protocol. An attacker on the communication path can cause the local party to compute a shared secret value already known to the attacker, undermining the key authentication guarantees. Additionally, a malicious peer can extract partial information about the local static private key and potentially recover it entirely in certain group settings. This vulnerability affects only applications that invoke DHAgreement directly.
On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. [...]
WP Statistics plugin for WordPress versions up to and including 14.16.14 is vulnerable to reflected Cross-Site Scripting (XSS) via the REQUEST_URI query-parameter key. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link.
The All in One SEO – AI SEO Plugin for WordPress up to version 5.0.1.1 contains a DOM-based Cross-Site Scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of URL pathname input, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the victim to have the aioseo_manage_seo capability and to open the SEO Preview panel in the WordPress admin toolbar while visiting a crafted URL. The vulnerability has a medium severity rating with a CVSS score of 6.1.
The W3 Total Cache WordPress plugin versions up to and including 2.10.6 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper input sanitization and output escaping in the handling of comment content when the 'Remove query strings from static resources' option is enabled. An unauthenticated attacker can inject malicious scripts that execute in the context of users visiting the affected pages. The vulnerability requires a specific configuration setting to be enabled to be exploitable.
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing high severity vulnerabilities identified by CVE-2026-94603 and CVE-2026-79705 affecting podman-related packages. The main vulnerability involves Podman treating container images with checkpoint annotations as restored checkpoints, ignoring user-specified sandboxing options and potentially allowing container sandbox bypass with elevated privileges. Updated RPMs version 6.1.3-1.hum1 are available that resolve these issues. No known exploits in the wild have been reported.
CVE-2026-59671 is a Cross-Site Scripting (XSS) vulnerability in the Repasat application affecting the endpoint /es/datatables/getemployeetypesdatatable. This vulnerability allows an attacker to trick a user into executing arbitrary code in their browser. The vulnerability has a medium severity rating with a CVSS score of 4.8. No patch or official fix information is currently available.
CVE-2026-59670 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Repasat application. The vulnerability affects the 'nomListaValidacion' parameter at the endpoint '/es/validationslists/assignList/Employee/45659'. Exploitation could allow an attacker to execute arbitrary code in a victim's browser by tricking the user. The CVSS 4.0 base score is 4.8, reflecting network attack vector, low privileges required, and user interaction needed.
India's Digital Personal Data Protection Act (DPDP), enacted in 2023 with rules notified in 2025, imposes comprehensive data protection obligations on entities processing personal data of individuals in India. It applies extraterritorially to SaaS and cloud services handling Indian users' data, requiring data mapping, consent management, honoring user rights, reasonable security safeguards, breach reporting, and data retention controls. Compliance deadlines are phased, with key enforcement starting November 2026 and full compliance by May 2027. This guidance is aimed at engineering and cloud teams to implement practical controls aligned with DPDP requirements.
CVE-2026-59669 is a Cross-Site Scripting (XSS) vulnerability in the Repasat application affecting the 'name' parameter at the endpoint '/es/attachmenttypes/update/203336'. Exploitation could allow an attacker to execute arbitrary code in a victim's browser. The vulnerability has a medium severity with a CVSS 4.8 score. No patch or official remediation information is currently available.