The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.
CVE-2026-85531 is a critical vulnerability in the OpenCart Virtual POS Module by Sipay Electronic Money and Payment Services Inc. It involves improper verification of cryptographic signatures, allowing signature spoofing due to improper validation. This affects versions from 26.8.2 up to but not including 26.9.1.
CVE-2026-62028 is a missing authorization vulnerability in the bPlugins Before After Image Comparison plugin for WordPress, affecting versions up to and including 1.1.21. This flaw allows users with limited privileges to bypass access controls, potentially leading to unauthorized actions within the plugin. The vulnerability has a medium severity with a CVSS score of 5.4.
CVE-2026-8374 is a high-severity vulnerability in the SwitchBot Lock Series that arises from misuse and misconfiguration of Bluetooth communication. This flaw involves the generation of weak initialization vectors (IVs) in the communication protocol, allowing attackers to bypass the electronic lock and access controls. The vulnerability affects multiple versions of the product up to version 9.2.6. No official patch or remediation details are provided in the available data.
CVE-2026-105883 is a Missing Authorization vulnerability in ThemeHunk's Th Shop Mania plugin affecting versions from initial release up to 1.9.1. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. Impact includes integrity loss and high availability impact but no confidentiality loss. No official patch or vendor advisory is provided, and no known exploits are reported in the wild.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.
CVE-2026-106602 is an authentication bypass vulnerability in Automattic Jetpack that allows password recovery exploitation. It affects Jetpack versions from initial releases up to, but not including, 16.3. The vulnerability has a medium severity rating with a CVSS score of 4.8. No known exploits are reported in the wild, and no official patch or vendor advisory is provided in the available data.
CVE-2026-104392 is a high-severity vulnerability in the ExpressTech Quiz And Survey Master plugin (quiz-master-next) that allows deserialization of untrusted data leading to object injection. This affects versions from initial releases up to 11.2.7. The vulnerability can result in complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-105870 is a reflected cross-site scripting (XSS) vulnerability in Delight Star Inc.'s WP Associate Post R2 plugin. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This affects versions from initial releases up to 5.0.1 inclusive. The vulnerability has a high severity rating with a CVSS score of 7.1. No official patch or vendor advisory details are provided in the input data.
CVE-2026-105872 is a deserialization of untrusted data vulnerability in the mklacroix Product Configurator for WooCommerce plugin. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects versions from initial release up to 1.7.5 inclusive.
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
CVE-2026-105318 is a high-severity reflected cross-site scripting (XSS) vulnerability in Datasolution's AcyMailing SMTP Newsletter component. It affects versions from the initial release up to 11.1.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in the context of a user's browser session.
Envira Gallery Lite versions before 1.16.2 have a missing authorization vulnerability in a REST endpoint used for gallery conversion. This flaw allows lower-privileged authenticated users to create and publish galleries without proper permissions. The endpoint only verifies edit permissions on the source post and uses a fixed publish status, enabling unauthorized publishing. Additionally, attackers can specify arbitrary image IDs without ownership checks, potentially publishing content they do not own.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3.
This report summarizes multiple cybersecurity incidents and emerging threats including AI-assisted bank breaches in South Korea, a poem-guided botnet called PoeLLM targeting AI and open-source services, a supply chain attack on the Tensorlake npm SDK, and the sentencing of the Empire Market co-founder. The PoeLLM malware uses a novel method of hiding its command-and-control server IP address encoded in a GitHub-hosted poem. The Tensorlake npm SDK was compromised to deliver a credential-stealing worm. Nvidia's DCGM Exporter had a high-severity denial-of-service vulnerability that has been patched. The South Korean bank breaches are under investigation with AI suspected to be involved. The Empire Market co-founder received a 40-year prison sentence for running a dark web marketplace. These events highlight evolving attack techniques and ongoing law enforcement actions.
CVE-2026-62036 is a medium severity vulnerability in AREOI All Bootstrap Blocks versions up to 1.3.31 that allows unauthorized retrieval of embedded sensitive system information. The vulnerability does not require user interaction and can be exploited remotely with low complexity but requires some privileges. It impacts confidentiality but not integrity or availability.
Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.
CVE-2026-62039 is a stored cross-site scripting (XSS) vulnerability in the bPlugins Html5 Audio Player plugin. It affects versions from 0 up to and including 2.8.8. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can be stored and later executed in users' browsers.
Hackers hijacked the .gh, .sl, and .as country-code top-level domains (ccTLDs), modifying authoritative DNS records and obtaining unauthorized HTTPS certificates for several Google domains and other organizations. Google blocked these unauthorized certificates in Chrome and worked with certificate authorities to revoke them. The incident highlights risks associated with third-party ccTLD management and certificate issuance. Google recommends domain owners monitor Certificate Transparency logs and implement restrictive CAA DNS records to prevent future unauthorized certificate issuance.