Threat database

CVE-2026-84854 is a high-severity vulnerability in the WibuKey driver for Windows versions prior to 6.72. It involves an out-of-bounds write caused by insufficient validation of user input when calculating the size of a kernel buffer. This flaw can lead to system crashes and, in some cases, modification of adjacent kernel memory.

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later).

Denmark's Central Person Register (CPR) suffered a data breach impacting approximately 8.8 million individuals. Hackers exploited a Danish company's lawful access to the CPR system to steal personal information including names, addresses, and CPR numbers. The breach was discovered after abnormal system behavior was detected in September. The breach does not affect individuals who opted for name and address protection. CPR revoked the company's access, notified authorities, and is investigating the incident while planning to enhance security measures.

Japanese media giant Nikkei disclosed breaches of two employee email accounts—one Google Workspace account accessed in July and one Microsoft 365 account accessed in September. The Google account breach exposed personal information of 1,646 employees and business partners but did not include reader or interviewee data. The Microsoft 365 breach was used to send 9,000 phishing emails targeting internal staff and interviewees. Nikkei changed passwords after discovering the breaches and has contacted affected individuals. No unauthorized logins have been detected since remediation. The company has not attributed the attacks to any specific threat actor or linked the two incidents.

A report surfaced on Reddit alleging that ASOS, a UK-based retailer, experienced another data breach. The claim includes a push notification indicating compromise of their Snowflake data warehouse instance and access to push notification systems. No technical details, official confirmation, or vendor advisories are provided. The incident is currently unverified and lacks evidence of exploitation or impact scope.

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

Social engineering remains a highly effective attack vector despite widespread security awareness training, which shows little evidence of effectively preventing such attacks. Recent high-profile incidents, including breaches at Las Vegas casinos and Brinks Home, demonstrate attackers using voice phishing and help desk manipulation to bypass security controls like MFA. Human detection of social engineering is unreliable, especially with increasingly sophisticated AI deepfake techniques. Technology solutions, such as Netarx's AI-driven detection system, are emerging to identify social engineering attempts in real time by analyzing multiple digital and metadata signals during live communications. These systems provide users with real-time risk indicators rather than autonomously blocking interactions, aiming to empower human decision-making. Social engineering continues to pose a serious threat to enterprise security, bypassing traditional technical defenses when successful.

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward.

Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

CVE-2026-105059 is a missing authorization vulnerability in the 'Delete All Comments of wordpress' plugin by royalnavneet. The flaw allows actions without proper access control, potentially leading to denial of service by deleting all comments. It affects versions from 0 up to but not including 7.2. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. No official patch or remediation is currently documented.

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.