Spotweb versions up to 1.5.8 contain an OS command injection vulnerability in the runcommand NZB handler. This flaw allows remote attackers to execute arbitrary commands by crafting malicious spot titles with shell metacharacters. When a user downloads such a spot, the malicious title is passed unescaped to the exec() function, executing commands with the privileges of the Spotweb PHP process.
OpenRefine versions through 3.10.1 contain a cross-site request forgery (CSRF) vulnerability in the get-rows command. This vulnerability allows remote attackers to execute Jython facet expressions by tricking a user into visiting a malicious page that issues a crafted cross-origin GET request. Successful exploitation can lead to execution of operating system commands with the privileges of the OpenRefine user.
A Canadian cybersecurity executive, Edward Dubrovsky, was arrested in Pennsylvania linked to alleged extortion activities associated with the FBI's crackdown on the ShinyHunters hacking group. The arrest is part of law enforcement efforts targeting this criminal hacking organization.
PairDrop versions up to 1.11.2 have an IP spoofing vulnerability in the Peer._setIP function. This flaw allows remote attackers to join discovery rooms of other networks by forging the cf-connecting-ip header. Attackers who know a victim's public IP can impersonate a local device on self-hosted PairDrop instances that are not behind Cloudflare, enabling unauthorized file send or receive actions.
openapi-typescript-codegen versions up to and including 0.31.0 contain a critical code injection vulnerability. This flaw allows attackers who can control an OpenAPI document to inject arbitrary JavaScript code by supplying unescaped values that are interpolated into single-quoted string literals. The injection points include path keys, parameter names, servers[0].url, and info.version fields. Exploitation occurs when generated clients are imported or service methods are called, leading to arbitrary code execution.
SkillHub versions before 0.2.22 have an incorrect authorization vulnerability in the AccountMergeService and AccountMergeController. Authenticated attackers can abuse the merge flow to take over other user accounts by initiating a merge with a target username or OAuth identity, obtaining the verification token directly, and confirming the merge. This allows attackers to inherit the victim's API tokens, roles, and namespace ownership.
CVE-2026-108549 is a critical vulnerability in chenhg5 cc-connect up to version 1.5.0. It involves missing authentication in the MAX platform adapter webhook mode, allowing unauthenticated remote attackers to send forged updates to the webhook listener on port 8080. This can enable attackers to execute privileged commands such as /shell on the host system.
AstronRPA versions up to 1.1.6 have an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua component. This flaw allows unauthenticated attackers to send arbitrary Bearer tokens without validation to specific API routes, enabling them to spoof user identity headers and act as any user. The vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-108547 is a high-severity vulnerability in iflytek AstronRPA versions up to 1.1.6. It involves a missing tenant authorization check in the robot-service component, allowing authenticated users to access shared variables belonging to other tenants via the get-batch-shared-var endpoint. Attackers can enumerate shared variable IDs and decrypt variables re-encrypted with their own tenant key, exposing other tenants' credentials in plaintext.
A Chinese-speaking hacker used the ARTEX AI penetration testing suite and Claude agents to conduct cyberattacks on multiple South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The attacks exposed clients' personal data and credit card information and caused system outages. The attacker’s infrastructure and activities were analyzed by CrowdStrike, linking the attacks to previously reported financial-sector breaches. The ARTEX AI project has been made closed-source and discontinued by its developer following confirmation of its use in real-world attacks, but derivatives remain available. The attacker’s identity is uncertain but partially exposed through leaked resume data.
Kortix Suna versions from 0.10.7 up to but not including 0.13.52 contain a server-side request forgery (SSRF) vulnerability. This flaw allows project managers with write permissions on project connectors to bypass IP address restrictions by using IPv6 6to4 or Teredo addresses that embed private IPv4 addresses. Exploiting this, attackers can set connector URLs to access internal services and cloud metadata endpoints, potentially reading sensitive responses. The vulnerability has a low CVSS 4.0 score of 2.3, indicating limited impact and exploitability.
CVE-2026-66435 is a vulnerability in the WP Rollback plugin by Devin Walker that allows insertion of sensitive information into sent data. This issue affects versions from the initial release up to 3.1.2. The vulnerability can lead to the retrieval of embedded sensitive data without requiring privileges or user interaction. The CVSS score is 5.9, indicating a medium severity level.
CVE-2026-97264 is a reflected cross-site scripting (XSS) vulnerability in the WPAdverts plugin by Greg Winiarski. It affects versions from initial release up to and including 2.3.4. This vulnerability allows an attacker to inject malicious scripts into web pages generated by the plugin, potentially impacting confidentiality, integrity, and availability. The CVSS score is 7.1, indicating a high severity level.
CVE-2026-97263 is a stored cross-site scripting (XSS) vulnerability in the WPAdverts plugin by Greg Winiarski. It affects versions from the initial release up to 2.3.4. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-94676 is a deserialization of untrusted data vulnerability in Tainacan Community's Tainacan product. It allows object injection and affects versions from initial releases up to 1.3.0. The vulnerability has a high severity score of 7.2 and can lead to full confidentiality, integrity, and availability compromise. No official patch or remediation details are provided in the available data.
A deserialization of untrusted data vulnerability exists in 10Web Slider by 10Web slider-wd, allowing object injection. This affects versions up to and including 1.2.62. The vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to high impact on confidentiality, integrity, and availability.
