The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. [...]
A Server-Side Request Forgery (SSRF) vulnerability exists in Next.js versions 16.0.0 through 16.3.7 in the Image Optimization feature when using images.remotePatterns. This allows attacker-controlled DNS resolution to bypass allow-list checks and fetch images from private IP addresses. Applications not using images.remotePatterns are not affected. The issue is fixed in version 16.3.8.
Next.js versions from 15.0.0 up to but not including 15.5.27, and from 16.0.0 up to but not including 16.3.8, contain a vulnerability where the response cache for statically generated or Incremental Static Regeneration pages using the Pages Router can be incorrectly keyed. This allows a request to replace one page's cached content with that of another route, causing incorrect content to be served to visitors until the cache is revalidated. Applications deployed on Vercel are not affected. The issue is fixed in versions 15.5.27 and 16.3.8.
CVE-2026-94544 is a medium severity vulnerability in Vercel's Next.js framework affecting versions >=16.3.0 and <16.3.8. It involves the use of a shared cache for pending `use cache` fills that does not distinguish between Draft Mode and regular requests. This can cause unpublished draft content to be served to unauthenticated users or published content to be served in draft previews. Additionally, if a regular request prerenders a page during this overlap, unpublished content may be persisted and served to all visitors until the page is revalidated.
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.
CVE-2026-39601 is a race condition vulnerability in the WPdevelop Booking Calendar plugin affecting versions prior to 11.9. It involves improper synchronization during concurrent execution of shared resources, which can lead to integrity issues. The vulnerability has a low CVSS score of 3.7 and does not impact confidentiality or availability, only integrity to a limited extent.
CVE-2026-39600 is an Open Redirect vulnerability in Mehul Gohil Aculect AI Companion versions before 0.8.2. This flaw allows attackers to redirect users to untrusted external sites, potentially facilitating phishing attacks. The vulnerability has a medium severity with a CVSS score of 4.7. No official patch or remediation guidance is currently available from the vendor.
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient of the file php/controller.php. Executing a manipulation of the argument img can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-32585 is a Missing Authorization vulnerability in airano Airano MCP Bridge affecting versions up to 2.11.0. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized modification of data or system state. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-104625 is a medium severity SQL injection vulnerability in CodeAstro Simple Loan Management System version 1.0. The flaw exists in an unknown function within /admin/index.php, where manipulation of the g_name argument allows SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code has been released, increasing the risk of attacks. No patch or official remediation information is currently available.
This report summarizes multiple cybersecurity developments including a set of iCloud email spoofing vulnerabilities, phishing campaigns targeting AI policy experts, a Chrome adblocker extension spying on AI chat conversations, and a large batch of vulnerabilities patched by Kiteworks. The iCloud spoofing bugs allowed attackers to send emails from arbitrary icloud.com addresses that passed SPF, DKIM, and DMARC checks due to inconsistent mail header parsing. The phishing campaigns involved a China-aligned group using fake AI advisory committee invitations to steal credentials via an adversary-in-the-middle proxy. The Poper Blocker Chrome extension was found to collect users' browsing history and AI chat conversations stealthily. Kiteworks patched over 100 vulnerabilities, including critical bugs that could lead to account takeover and code execution. Additional highlights include AI-assisted discovery of Android app flaws and a Cloudflare Containers data leakage vulnerability that was patched. No active exploits in the wild were reported for these issues.
CVE-2026-94422 is a vulnerability in xdg-dbus-proxy versions before 0.1.9 that allows attackers to bypass message filtering on the D-Bus session bus. This flaw enables a malicious or compromised Flatpak application to set a reply serial number on non-reply messages, potentially leading to arbitrary code execution outside the Flatpak sandbox. The vulnerability also affects other application frameworks using xdg-dbus-proxy, such as Firejail. It has a high CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
CVE-2026-104721 is a path-traversal vulnerability in the Logback-classic module by QOS.CH Sarl. It arises when an MDC-based discriminator value is used unsanitized in a nested FileAppender path, allowing an attacker who can influence the MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This affects Logback-classic versions from 0.9.14 through 1.6.4. The vulnerability is similar to CVE-2026-19880 but involves different attack techniques.
CVE-2026-5782 is a reflected cross-site scripting (XSS) vulnerability in the TurkHotspot product by MRV Technology Foreign Trade Ltd. Co. It results from improper neutralization of input during web page generation, enabling attackers to inject malicious scripts. The product is no longer supported by the vendor, and no patches or fixes are available. The vulnerability has a medium severity with a CVSS score of 5.2.
The dedh-devops-automation package on PyPI contains malicious code that executes during installation. It deploys a rogue AWS Lambda function designed to collect credentials from AWS Secret Manager and exfiltrate sensitive data. The package overrides the install command in setup.py to perform these malicious actions. Multiple versions of the package are affected, including 0.0.1, 5.0.0, 5.6.0, 5.6.1, 5.6.999, 5.8.0, 5.8.1, and 5.9.0. This campaign is identified as having clear malicious intent, targeting cloud tokens and credentials.
In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate.
The Divi Membership WordPress plugin versions up to 2.2.0 contain a critical privilege escalation vulnerability. An unauthenticated attacker can exploit improper privilege management in the user registration process to create a new account with administrator privileges. This is achieved by submitting a specially crafted bcrypt hash of the 'administrator' role in the form_id POST parameter. The vulnerability requires a WordPress nonce, which is publicly available on pages rendering the registration form, allowing any visitor to exploit it and gain full site control.
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.
CVE-2026-96289 is a high-severity vulnerability in Apache Thrift's PHP bindings caused by uncontrolled recursion. This flaw affects all versions before 0.25.0. The issue has been addressed in Apache Thrift version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
Apache Thrift versions before 0.25.0 contain an uncaught exception vulnerability in the Perl bindings. This flaw can lead to high-severity impacts if exploited. The issue is resolved in version 0.25.0, which users are advised to upgrade to.