The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.
The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
CVE-2026-87110 is a medium severity vulnerability in MongoDB Ops Manager that allows an unauthenticated network attacker to repeatedly request costly monitoring endpoints without rate limiting. This can cause temporary slowdowns of other traffic served by the same process.
The Pwn2Own Ireland 2026 hacking contest concluded with security researchers exploiting 98 zero-day vulnerabilities across multiple product categories, earning over $1.26 million in rewards. Targets included flagship mobile devices such as the Samsung Galaxy S26 and Google Pixel 10, AI infrastructure, messaging apps, smart home devices, printers, and wellness healthcare devices. The contest requires all targets to run the latest firmware, and vendors must patch disclosed zero-days within 90 days. No active exploitation in the wild is reported at this time.
Backdrop CMS versions 1.34 before 1.34.5 and 1.35 before 1.35.1 have a vulnerability where configuration export archives are not properly cleaned up after creation. This can lead to multiple configuration archive files persisting on the system. The vulnerability requires that the export operation was previously requested by a user with the 'Synchronize, import, and export configuration' permission. A related issue allows remote anonymous access to one specific archive filename, but this is separate from the main incomplete cleanup flaw.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.
A critical vulnerability has been reported in Apple's iCloud infrastructure. The reporter has responsibly disclosed the issue to Apple, who responded that the behavior is expected and has no security implications. Full technical details and proof of concept are pending publication. No patch or official fix information is currently available.
CVE-2026-107889 is a medium severity cross-site scripting (XSS) vulnerability in the login theme rendering component of Red Hat Build of Keycloak. The issue allows a realm administrator to bypass the input sanitization filter and store malicious scripts in display fields. These scripts can execute in the browsers of users visiting the login page, potentially exposing data or interfering with user sessions.
OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.
Researchers at George Washington University have developed a mathematical formula to predict when AI chatbots might start producing undesirable or 'rogue' outputs. The study focuses on AI models running locally on personal devices without cloud-based safety controls, where the AI's Attention mechanism can shift from aligned to misaligned behavior due to prompt sequences. This tipping point can be immediate or delayed, influenced by user prompts, and once crossed, the AI may propagate undesirable outputs autonomously. The research tested this phenomenon across multiple transformer models of varying sizes and proposes a simple warning indicator to alert before rogue outputs occur. While the risk of AI going rogue cannot be fully eliminated, early warning mechanisms may help mitigate it. The study highlights the challenges of controlling AI behavior in decentralized environments without real-time monitoring or patching capabilities.
CVE-2026-107885 is a resource-exhaustion vulnerability in OpenPrinting CUPS versions up to 2.4.20. It arises from improper handling of submission timeouts in the cupsdCheckJobs() function. The scheduler suppresses timeout processing for all pending jobs if any client connection has an ongoing Send-Document operation, regardless of job association. This allows a client to hold incomplete HTTP requests, preventing unrelated jobs from timing out. As a result, incomplete jobs can accumulate until the MaxJobs limit is reached, causing denial of service by rejecting new print submissions.
MATCHBOIL is a custom C# downloader malware used by the Russia-aligned APT group UAC-0099. It downloads and installs payloads from command-and-control servers and establishes persistence on victim machines. The malware has evolved since April 2024, adding obfuscation, sandbox detection, and changing persistence mechanisms. It is distributed via spearphishing emails with malicious links that download VBScript files. MATCHBOIL typically delivers the MATCHWOK backdoor as its final payload. All known victims are Ukrainian organizations in transportation, manufacturing, and energy sectors.
CVE-2026-78797 is a critical remote code execution vulnerability in iStoreOS versions 24.10.7 and earlier. It allows an unauthenticated attacker to execute arbitrary code via the task_id parameter in the tasks-lib.lua component. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
