A heap-based buffer overflow vulnerability exists in the Apache DataSketches C++ library during deserialization of HLL sketches in LIST mode. The flaw occurs because the coupon count from untrusted input is used to copy entries into a fixed-size buffer of 8 entries without proper bounds checking. This can lead to a write of up to 988 bytes beyond the buffer, corrupting heap memory and potentially causing crashes or further exploitation. The issue affects versions from 1.0.0-incubating up to 5.2.0. Upgrading to version 5.3.0 resolves the vulnerability.
The npm package '@library-wide/library-shell' version 99.9.1 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior indicates the package may be used to facilitate harmful operations. No CVSS score is available for this threat.
CVE-2026-106139 is a medium severity vulnerability in Progress Software Kendo UI for Vue where the default Chart tooltip renders formatted point values as raw HTML without encoding. This affects versions from 2.5.0 up to but not including 10.1.0. An attacker with low privileges who can control a string bound to the chart can inject HTML with event handlers that execute JavaScript when a user hovers over the data point, potentially compromising data confidentiality and integrity.
A cross-site scripting (XSS) vulnerability exists in Progress Software KendoReact versions 1.1.0 up to but not including 16.2.0. The default Chart tooltip renders formatted point values as raw HTML without encoding, allowing an attacker with low privileges who can influence chart-bound string values to inject HTML with event handlers. This can lead to JavaScript execution in the user's browser when hovering over the affected data point, potentially compromising data confidentiality and integrity.
The Traffic Light Protocol (TLP) is a standard designed to communicate information sharing boundaries, not to replace internal information classification schemes. Some organizations mistakenly use TLP labels as internal classification levels, which can cause misunderstandings because TLP labels specify sharing permissions rather than protection or handling requirements. TLP does not define encryption, storage, access control, or retention policies. Misusing TLP labels for internal classification can lead to inappropriate sharing or overly restrictive access. The official TLP 2.0 standard explicitly states it is not a formal classification scheme and should complement, not replace, internal classification systems.
CVE-2026-108506 is a medium severity vulnerability in the ZTE Z80 Ultra device involving improper privilege management. The system interfaces lack robust authentication and have inadequate access control, allowing third-party applications to invoke these interfaces via reflection and potentially retrieve sensitive information. There is no indication of a patch or fix available at this time.
ZTE Z80 Ultra contains a local information disclosure vulnerability due to improper privilege management. This flaw allows third-party applications to capture data returned by system interfaces, potentially exposing device-related information. The vulnerability has a low severity rating and does not impact integrity or availability.
The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.7.31. This vulnerability arises from insufficient input sanitization and output escaping of a custom user attribute field, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires specific plugin configuration involving text-type custom user attributes displayed inside HTML attribute contexts and enabled front-end user profiles.
PeproDev Ultimate Profile Solutions WordPress plugin versions up to and including 8.2.36 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user input in the 'button' attribute of the 'logout-url' shortcode. Authenticated users with contributor-level or higher privileges can inject malicious scripts that execute when other users view the affected pages.
The Listdom plugin for WordPress, versions up to and including 6.1.2, contains a path traversal vulnerability in the LSD_Menus_IX_CSV::import function. This flaw allows authenticated users with administrator-level privileges to delete arbitrary files on the server by exploiting insufficient file path validation. Deleting critical files such as wp-config.php could lead to remote code execution. The vulnerability has a medium severity rating with a CVSS score of 4.9.
The Divi Plus WordPress plugin versions up to and including 2.4.0 contain a path traversal vulnerability in the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This flaw allows unauthenticated attackers to read arbitrary files on the server by exploiting insufficient validation of the 'svg_image' parameter. The endpoint's permission callback returns true unconditionally, and sanitization functions used do not prevent access to filesystem paths or URLs. This vulnerability has a high severity rating with a CVSS score of 7.5.
The PyPI package media-manager5 version 0.1.0 contains malicious code that installs a persistent job on the victim's machine. This allows attackers to exfiltrate files and execute remote commands, effectively acting as a remote access trojan (RAT). The package is designed with clear malicious intent, including persistence mechanisms and limited remote command execution capabilities.
CVE-2026-93951 is a reflected cross-site scripting (XSS) vulnerability in Bracketweb Zeinet versions up to and including 1.0.0. This flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1. No patch or official fix information is currently provided. Exploitation requires user interaction and can impact confidentiality, integrity, and availability of the affected system.
The agentaix package on PyPI contains malicious code that installs a persistent job on the victim's machine. This job enables attackers to exfiltrate files and execute remote commands, likely limited to a specific set, effectively acting as a remote access trojan (RAT). The package versions 0.1.0 and 0.2.0 are affected. There is no information about an available patch or remediation. No known exploits in the wild have been reported.
This report investigates alleged cyberattacks targeting Discord communities focused on powerscaling discussions, centering on the Noblesse server linked to creator ZetaSolos. The incidents include mass bans, automated disruptions, and retaliation claims such as doxxing and extortion against moderators. Broader allegations involve coordinated raids, mass-reporting campaigns, social engineering, account compromises, harassment, and extortion. The investigation compiles available evidence but notes that not all claims are independently verified. It highlights the security risks faced by online communities from compromised accounts and inadequate security practices. The report encourages server owners and moderators to secure accounts, review permissions, and preserve evidence. No specific software vulnerability or exploit code is detailed, and no patch or remediation status is provided.
The Premium Packages – Sell Digital Products Securely WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'checkout[billing][phone]' parameter and related fields. This vulnerability exists in all versions up to and including 7.2.6 and allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages.
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress versions up to 5.0.2 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access other customers' printable order documents by supplying the order ID and the associated billing email address. The vulnerability arises because the plugin authorizes access based on a non-secret billing email rather than the WooCommerce order key. This can expose sensitive customer information including names, addresses, phone numbers, purchased products, prices, taxes, and invoice metadata.
The Avada Website Builder theme for WordPress and WooCommerce is vulnerable to a stored cross-site scripting (XSS) flaw in user profile social link fields. Authenticated users with Subscriber-level access or higher can inject malicious scripts into author pages via social contact-method fields. Exploitation requires a user to click the malicious social icon link, and the site setting 'Open Social Icons in a New Window' must be disabled. This vulnerability affects versions up to and including 7.16.1.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is vulnerable to arbitrary shortcode execution in all versions up to and including 6.3.1. This occurs because the plugin inserts a user's display_name into page markup without filtering, then processes it with do_shortcode(). Since display_name can be modified by any user on their own account, authenticated users with Subscriber-level access or higher can execute arbitrary shortcodes. If the page displays user collections, the shortcode executes for every visitor, including unauthenticated ones.