LearnPress plugin for WordPress versions up to 4.4.9.1 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with the Instructor role can inject malicious scripts via quiz question hint and explanation fields. These scripts execute in the context of students taking the quiz, potentially compromising their sessions.
A critical vulnerability (CVE-2026-86360) in Dell System Update (DSU) command-line interface allows unauthenticated attackers with remote access to exploit a path traversal weakness to execute arbitrary code with root privileges. Dell has released an update to DSU version 2.3.0.0 or later to patch this and other high-severity vulnerabilities. The flaw affects enterprise server infrastructure running Dell PowerEdge systems. No active exploitation has been reported yet, but the vulnerability could lead to complete system compromise if exploited.
CVE-2026-89039 is a path traversal vulnerability in Grafana's mcp-k6 component that allows an authenticated caller with limited privileges to read arbitrary files on the server. By invoking the convert_playwright_script prompt and passing a crafted file path, an attacker can bypass directory restrictions using symbolic links and access sensitive files such as SSH keys and cloud credentials. This vulnerability affects versions 0.3.0 through before 0.7.0 of mcp-k6.
Google has temporarily paused accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP) due to a surge in invalid automated submissions. This pause affects only product vulnerability reports and does not impact supply chain reports or pending submissions. Google encourages researchers to submit vulnerabilities through other programs such as the Cloud VRP or Patch Rewards Program. The company plans to revisit and update the OSS VRP in early 2027. This action follows similar adjustments in Google's Chrome and Android bug bounty programs in response to increased AI-assisted vulnerability discovery.
South Korea's Financial Services Commission is investigating multiple cyberattacks targeting major financial institutions, including Shinhan Bank and Kookmin Bank. These breaches resulted in the exposure of sensitive customer data, including personal details and credit card information. Authorities suspect the involvement of AI-powered attack automation tools, specifically referencing ARTEX AI, an open-source penetration-testing system, though no official confirmation links this tool to the attacks. The government has mandated financial companies to inspect IT systems, reduce information exposure, and share threat intelligence promptly. Investigations and regulatory reviews are ongoing to enhance consumer protection and prevent future incidents.
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit) for WooCommerce: from n/a through 2.2.0.
tenfold has enhanced its free Community Edition Identity Governance tool with two new features: shared content governance and real-time event auditing. These additions help organizations with fewer than 150 users better manage Microsoft 365 sharing and monitor identity-related events. The shared content governance feature provides visibility into shared files across Teams, OneDrive, and SharePoint, along with recurring access reviews to control shared access. The event auditing feature enables real-time log analysis to detect suspicious identity activities promptly. This update aims to improve security and governance for small organizations without the complexity or cost of enterprise solutions.
A Russian-speaking affiliate of the Gentlemen ransomware group, known as Azazel, compromised over two dozen organizations across six countries by exploiting CI/CD secrets from GitLab instances and conducting a deep compromise of an AI platform using SSRF, credential decryption, and continuous data exfiltration. Azazel operated an independent leak site called LEAKNED to publish stolen data and retain extortion proceeds. This campaign is notable for the first documented criminal use of AI assistant tooling via the Model Context Protocol (MCP) as a command-and-control channel. The attacker infrastructure included three nodes with over 50TB storage capacity, actively transferring approximately 6TB of victim data. Affected sectors include logistics, insurance, pharmaceutical, AI, medical devices, and government-adjacent organizations.
CVE-2026-92931 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637. This flaw allows a remote attacker to make server-side requests to attacker-controlled hosts, which could lead to exposure of sensitive information and impact confidentiality, integrity, and availability of the affected system.
The alleged developer of Ploutus malware, used in ATM jackpotting attacks across the United States, was arrested and appeared in US court. Ploutus malware enabled criminals to steal millions of dollars by compromising ATMs, with attacks occurring between February 2024 and December 2025. The malware included anti-analysis features to hinder forensic investigation and attempted to conceal its presence by deleting itself from infected ATMs. The criminal operation was linked to the Venezuelan Tren de Aragua gang, which laundered stolen funds internationally. The DOJ charged the developer with multiple offenses including bank fraud conspiracy and providing material support to terrorists. The attacks targeted financial institutions in 47 US states and several foreign countries, resulting in over $5.4 million stolen in confirmed incidents and additional attempted thefts.
ClingSTUN is a Linux backdoor malware that operates as a back-connect proxy using the STUN protocol. It sets up persistence on infected systems and exploits multiple vulnerabilities across various device vendors for initial access and self-propagation. The malware abuses legitimate public STUN servers to maintain NAT connectivity and avoid direct attacker infrastructure. It targets a wide range of vulnerabilities in devices from vendors such as Avtech, EnGenius, D-Link, and others, and supports multiple CPU architectures. ClingSTUN also kills competing malware processes and listens for specific packets to execute remote commands and propagate further.
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.
A time-of-check to time-of-use (TOCTOU) race condition exists in Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021. This vulnerability occurs during the installation of the HTTPS interception root certificate, where a temporary file is written in a user-writable location and then imported by an elevated helper application. A local low-privilege attacker can replace this temporary file before it is read by the elevated process, causing an attacker-controlled root certificate to be installed in the Local Computer Trusted Root Certification Authorities store. Exploitation requires user initiation and approval of an elevation prompt.
CVE-2026-77803 is a low-severity vulnerability in Progress® Telerik® Fiddler® Classic for Windows versions prior to 6.0.20262.10021. It involves inconsistent interpretation of HTTP requests in the proxy request forwarding component, allowing a local low-privilege user to cause a single malformed HTTP request to be split into two requests forwarded to the origin server. This can result in an additional smuggled response without requiring a vulnerable server.
CVE-2026-77802 is a medium severity vulnerability in Progress® Telerik® Fiddler® Classic for Windows prior to version 6.0.20262.10021. It involves HTTP request smuggling due to inconsistent handling of multiple conflicting Content-Length headers in the proxy request forwarding component. A local attacker with low privileges can exploit this to smuggle additional requests against non-RFC-9110-compliant origin servers that keep connections alive. This can lead to response poisoning and unauthorized access to responses intended for other users.
In July 2026, two healthcare organizations, Clover Health Investments and AngMar Management Services, suffered data breaches resulting in the theft of personally identifiable information (PII) and protected health information (PHI) of over 250,000 individuals. Clover Health's breach involved social engineering attacks compromising employee accounts, exposing names, birth dates, insurance identifiers, and account numbers. AngMar Management Services experienced a ransomware-related breach with over 700 GB of data stolen, including sensitive patient details such as Social Security numbers, medical history, and prescription information. Both companies reported the incidents to the US Department of Health and Human Services and were added to its breach portal.
CVE-2026-63270 is a vulnerability in LibreOffice version 26.2 where URLs constructed from environment variables or INI file values could lead to exposure of sensitive information. This occurs because certain document elements (XForms instance data and Calc csv and sql data providers) still allowed expansion of internal schemes in URLs, enabling potential exfiltration of sensitive data to remote servers. The issue was addressed by refusing URLs with internal schemes from documents in fixed versions.
CVE-2026-63269 is a server-side request forgery (SSRF) vulnerability in LibreOffice version 26.2. The issue arises when LibreOffice links to audio and video files, specifically on Linux where it uses GStreamer to play media. An attacker could craft an HLS playlist that causes GStreamer to read local and remote files listed in the playlist during document loading, potentially exposing their contents. The vulnerability has been addressed in fixed versions by preventing LibreOffice from following playlists that reference further resources and by placing linked media under link update control.
