CVE-2026-84318 is a vulnerability in 0xJacky's nginx-ui where the MCP tool 'nginx_config_add' writes nginx configuration files without validating them, unlike the REST API which blocks dangerous directives. This allows an authenticated attacker to bypass security checks and write config files with blocked directives such as 'perl' or 'user root', leading to remote code execution on servers with certain nginx modules loaded. The vulnerability affects versions from 2.0.0-rc.6 up to but not including 2.4.1.
The npp-ml package on PyPI falsely claims to provide a Notepad++ distribution but instead delivers ADExplorer, an Active Directory analysis tool. This package is identified as malicious due to its deceptive nature and intent. The affected versions are 0.1.7, 0.1.8, and 0.1.9. There is no CVSS score available for this threat.
CVE-2026-108928 is a medium severity SQL injection vulnerability in itsourcecode Online Admission System version 1.0. The flaw exists in the /admin/sum.php file where manipulation of the ID parameter allows remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no official patch or fix information is currently available.
CVE-2026-97691 is an improper access control vulnerability in the get-convex convex-backend. Before the self-hosted image and local deployment binary published on August 10, 2026, a malicious user could, in rare cases, read deployment information without authorization. The vendor has withheld detailed technical information to protect unpatched self-hosted deployments. Convex cloud deployments were automatically patched. The issue is fixed in the self-hosted image and local binary published on August 10, 2026. No exploitation in the wild is known.
Norway's Data Protection Authority fined Microsoft-owned ad company Xandr $9.6 million for unlawfully processing and sharing sensitive data of Grindr users in Norway. The fine addresses violations of data protection laws related to user privacy and data handling.
CVE-2026-92120 is a critical authentication bypass vulnerability in Apache Allura affecting versions up to 1.21.0. It involves an OAuth1 request replay attack that allows unauthorized access. The issue is fixed in version 1.22.0, which users are strongly advised to upgrade to.
CVE-2026-92119 is a critical REST API mass assignment vulnerability in Apache Allura affecting versions up to 1.21.0. It allows improper modification of dynamically-determined object attributes. The issue is fixed in version 1.22.0.
CVE-2026-84315 is a missing authorization vulnerability in 0xJacky's nginx-ui version prior to 2.4.1. The application uses a short-lived OTP/passkey "secure session" token to enforce step-up authorization for sensitive operations for users with 2FA enabled. However, several sensitive authenticated mutation routes are not protected by this step-up middleware, allowing an attacker with a valid authenticated JWT/session but without a fresh OTP secure-session token to perform unauthorized sensitive actions.
GitHub has introduced a new feature that attaches a durable, authenticated pusher identity to every commit, separate from the author and committer metadata. This feature includes a new repository rule condition, "Committer must match pusher," which can block pushes where the committer metadata does not match a verified email address of the authenticated pusher. This enhancement improves auditability and helps detect suspicious pushes or compromised accounts. The feature is currently in limited public preview for GitHub Enterprise customers and is not enabled by default.
CVE-2026-92116 is a critical OAuth1 callback validation vulnerability in Apache Allura up to version 1.21.0. It is an open redirect issue (CWE-601) that allows redirection to untrusted sites. The vulnerability is fixed in Apache Allura version 1.22.0.
CVE-2026-108927 is a SQL injection vulnerability in itsourcecode Baptism Information Management System version 1.0. The flaw exists in the pbaptism.php file where manipulation of the b_id argument allows remote attackers to perform SQL injection. The vulnerability has a medium severity score of 5.3 and an exploit is publicly available.
CVE-2026-109425 is an input-validation vulnerability in tink-go (tink-crypto/tink-go) versions 2.0.0 through 2.8.0. The functions keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step, allowing malformed or no-secret keysets that violate Tink's keyset invariants to be accepted. This can lead to inconsistent downstream validation, potentially misleading applications that rely on handle construction as proof of keyset integrity.
CVE-2026-108926 is a medium severity SQL injection vulnerability in itsourcecode Baptism Information Management System version 1.0. The flaw exists in the ebaptism.php file where the ID parameter can be manipulated remotely to perform SQL injection. Public exploit code is available, increasing the risk of exploitation.
A cyberattack targeted French food stores by exploiting a previously known vulnerability in DanFoss refrigeration unit controllers. The same vulnerability had been exploited earlier in August against US Department of Defense commissaries. The affected stores had not applied patches or updates to the controllers, allowing attackers to disable refrigeration units.
NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 use a hard-coded AES-128-ECB cryptographic key to decrypt certain API responses. This weak encryption lacks integrity checks, allowing attackers who can intercept or originate server responses to forge valid ciphertext. Such forged responses can be accepted by the client, potentially enabling further exploitation such as accessing the os.navigateExternal bridge.
NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 have a critical TLS certificate validation vulnerability. The client fails to properly validate the server certificate chain, hostname, and does not consult the Windows certificate trust store. This allows a network-adjacent attacker to perform man-in-the-middle attacks, decrypt HTTPS traffic, capture session credentials, and modify server responses, potentially leading to account takeover and response forgery.
NetEase Cloud Music client for Windows versions 3.1.38 and 3.1.39.205426 contains a critical remote code execution vulnerability. The flaw is in the renderer-process IPC bridge os.navigateExternal, which improperly handles URLs passed to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, for example by forging an API response using a known AES key over an unvalidated TLS connection, can exploit this to execute arbitrary local binaries with the logged-in user's privileges.
CVE-2026-109575 is a critical authentication bypass vulnerability in HAProxy Data Plane API Enterprise Edition versions 2.2.0 through 3.4.3. The flaw arises from a process-global authentication logic error that disables Basic authentication on shared internal request handlers when TLS CA and numeric TLS port are configured. This causes non-mutual TLS listeners such as HTTP and UNIX domain socket endpoints to fail open, allowing unauthenticated attackers to gain full administrative API access. Exploitation enables reading or replacing HAProxy configuration data without credentials. The issue is fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and corresponding Enterprise Edition backports.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a critical privilege escalation vulnerability. An authenticated attacker can bypass authorization and input validation checks to execute malicious code and gain elevated privileges on the system. This vulnerability is identified as CWE-264 and has a CVSS 3.1 score of 9.9, indicating a severe impact on confidentiality, integrity, and availability.
CVE-2026-108924 is an authorization bypass vulnerability in the getkirby Kirby CMS affecting versions 4.9.0 through 4.9.5 and 5.5.0 through 5.5.3. The issue exists in the OptionsQuery::resolve function within the Dynamic Option Generation component. This vulnerability allows remote attackers to bypass authorization controls. Upgrading to versions 4.9.6 or 5.6.0 resolves the issue.