CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler that allows authenticated users to operate task instances in projects they are not authorized to access. The vulnerability affects versions before 3.4.3 and can be exploited via specific API endpoints related to stopping task instances and saving task instance savepoints. The issue is fixed in version 3.4.3.
Nearly 20 million individuals had their personal and medical information compromised in a cyberattack on Oracle Health's legacy Cerner systems in early 2025. The breach involved unauthorized access via stolen customer credentials to a legacy server not yet migrated to Oracle Cloud. The compromised data includes names, Social Security numbers, medical records, diagnoses, medications, test results, and treatment information. The attacker demanded cryptocurrency ransom to prevent data leakage. This incident is among the largest healthcare data breaches in the US, with significant numbers of affected individuals reported across multiple states.
CVE-2026-66084 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. It allows authenticated users to modify task definitions in projects they are not authorized to access by exploiting a flaw in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint does not verify that the task definition code belongs to the specified project, enabling unauthorized modification of task definitions and their upstream dependencies. This can compromise workflow integrity and disrupt task execution in unauthorized projects. The issue is fixed in version 3.4.3.
CVE-2026-66082 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. Authenticated users with permissions in one project can perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects by exploiting improper verification of resource ownership. This allows altering workflow availability and interfering with task execution in projects they should not access. The issue is fixed in version 3.4.3.
CVE-2026-89191 is a cross-site scripting (XSS) vulnerability in SQLView KRIS's Workflow Template feature. Unsanitised input in the "template name" field is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation. This allows an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users. The vulnerability has a CVSS score of 6.8, indicating medium severity.
CVE-2026-12260 is a critical SQL injection vulnerability in the NetBoard CRM Demo Platform. It affects the 'user-name' POST parameter at the '/module/auth/recovery.php' endpoint. The flaw allows blind SQL injection attacks using Boolean, error, time-based, and UNION techniques. Exploitation can lead to unauthorized data extraction, including backend version and type, data alteration, or further system compromise.
Cylist is a newly developed free platform designed to unify multiple threat intelligence sources and streamline SOC analysts' workflows by enabling investigation, enrichment, documentation, and discussion of indicators of compromise (IOCs) in one place. It integrates data from VirusTotal, ThreatFox, AbuseIPDB, and IP Info, providing a consolidated threat score and AI-assisted case generation. Currently in beta, Cylist aims to reduce the need for multiple tools and subscriptions in security operations. There is no indication that Cylist itself presents a security vulnerability or threat.
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
The FortiBleed campaign involves attackers compromising Fortinet FortiGate firewalls and SSL VPN appliances by using stolen or brute-forced credentials. Attackers create new accounts and delete or change existing ones and passwords to lock legitimate users out of their devices. The campaign has affected over 86,000 devices globally since June 2026. The FBI and US Secret Service have issued a joint advisory warning about these attacks and recommending remediation steps.
CyclePatrol is a Bash-based Wi-Fi security assessment tool designed to run on Linux and Android (Kali NetHunter). It continuously scans nearby Wi-Fi networks while the user moves around, collecting information about access points and performing authorized security tests such as WPS, PMKID, handshake captures, and WPA2/WPA3 assessments. The tool saves detailed evidence and generates HTML reports. It requires root privileges and is intended for use only on networks where the user has permission to test. CyclePatrol orchestrates multiple standard wireless security tools and modules to provide comprehensive Wi-Fi security checks.
PINAKA CTF 2026 is a national-level Capture The Flag competition organized by the National Forensic Sciences University (NFSU), Chennai Campus. It features multiple cybersecurity challenge categories including web exploitation, digital forensics, OSINT, cryptography, reverse engineering, binary exploitation, network security, and steganography. The competition includes an online qualification round and an offline grand finale. This event is designed to test and enhance cybersecurity skills among students, professionals, and enthusiasts. There is no indication that this event represents a security threat or vulnerability.
A coordinated campaign involving 16 malicious Firefox extensions targets cryptocurrency wallet users by stealing wallet recovery phrases and private keys. These extensions impersonate legitimate wallet portals and tools, including clones of Rabby Wallet and OKX Wallet. The stolen credentials are sent to attacker-controlled Cloudflare Workers endpoints. Mozilla has removed these extensions from their store. Users who have entered their credentials into these extensions are advised to create new wallets and transfer their assets immediately.
Threat actors are distributing legitimate Remote Monitoring and Management (RMM) tools such as ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able through phishing campaigns. These campaigns use social engineering tactics with fake Adobe Acrobat updates, DocuSign viewers, and document access prompts to trick victims into installing remote access tools disguised as business documents. Delivery methods include LNK files, BAT scripts, VBS files, and PDFs. The RMM tools contain embedded configuration data linking back to attacker infrastructure, enabling remote access while evading detection.
The TensorLake npm SDK version 0.5.144 was compromised in a supply chain attack involving ChainDrop/Shai-Hulud malware. The malicious package, downloaded approximately 12,000 times weekly, contains obfuscated code that steals credentials from various sources such as npm tokens, GitHub tokens, AWS credentials, HashiCorp Vault, Kubernetes configs, SSH keys, and AI development tools. It executes via a preinstall hook, establishes persistence through scheduled tasks, and supports remote code execution. The attack uses an Ethereum contract for command-and-control and includes a dead-man switch that triggers destructive actions if stolen GitHub tokens are revoked. The malware can self-propagate by republishing compromised versions to other npm packages linked to the victim's publishing identity, spreading across the npm ecosystem.
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.
A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
During the Pwn2Own Ireland 2026 event, security researchers successfully exploited 45 unique zero-day vulnerabilities, including hacking the Samsung Galaxy S26 device three additional times. These exploits were rewarded with a total of $232,500 in cash prizes. No specific technical details or affected software versions are provided in the available information.
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
Brocade SANnav versions before 3.0.0a contain an SQL Injection vulnerability in several external API inventory query parameters. This flaw allows an authenticated attacker to inject malicious data via REST API queries. The vulnerability requires authentication and has a medium severity rating. No known exploits are reported in the wild. No patch or remediation details are currently provided.