CVE-2026-110260 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves a quadratic memory allocation issue in the MethodWriter.computeMaxStackAndLocal() and computeAllFrames() methods when using COMPUTE_MAXS or COMPUTE_FRAMES. An attacker can craft a class file with thousands of overlapping exception handlers, causing excessive memory allocation leading to an OutOfMemoryError and JVM crash.
CVE-2026-110259 is a medium severity vulnerability in OW2 ASM affecting versions 3.0 up to but not including 9.11. It involves uncontrolled recursion in the ClassWriter.replaceAsmInstructions() method triggered by crafted class files with large methods containing many long forward jumps. This leads to unbounded recursion in the toByteArray() method, causing a StackOverflowError and denial of service.
CVE-2026-110258 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves excessive memory allocation in the method Label.addSubroutineRetSuccessors() due to improper enforcement of the single-RET-per-JSR rule. An attacker can craft an invalid class file with multiple RET instructions for one JSR, causing the JVM to allocate approximately 2 GB of memory and crash.
CVE-2026-110257 is a vulnerability in OW2 ASM versions 5.0 up to but not including 9.11. It involves excessive memory allocation in the ClassReader.readBootstrapMethodsAttribute() method, where an int array is sized based on an unvalidated attribute_length. A crafted class file of about 100 bytes can trigger allocation of roughly 2 GB of memory, causing an OutOfMemoryError that crashes the JVM or consumes the thread.
Kaneo versions before 2.1.6 have a missing authorization vulnerability that allows authenticated users to access and manipulate other workspaces by supplying identifiers to API routes without proper membership checks. This can lead to unauthorized reading, modification, or deletion of projects, tasks, labels, and comments within those workspaces.
PhysicsFS versions up to 3.2.0 contain an out-of-bounds read vulnerability in the __PHYSFS_utf8codepoint() function. This flaw allows attackers to read beyond buffer boundaries by exploiting an off-by-one cursor advance on six-octet UTF-8 sequences in archive entry names. Crafted archives with such names can cause over-read and potentially crash applications using PhysicsFS.
Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 have an overly restrictive account lockout mechanism vulnerability. This flaw could allow an unauthenticated remote attacker to cause a denial of service by triggering account lockouts. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 5.3 (medium severity). No patches or vendor advisories are provided to confirm remediation status.
Harmonic Security, a cybersecurity startup focused on protecting workforce AI usage, announced a $50 million Series B funding round to expand its engineering and go-to-market teams in the US and UK. The company provides a platform that secures AI tools used by employees, covering browser-based AI, desktop AI tools, and agentic workflows. Their solution classifies AI tasks, identifies usage, and offers real-time control to mitigate risks such as personal-account use and sensitive data exposure. Harmonic leverages custom small language models to analyze AI interactions in context, enabling organizations to apply controls and gain visibility into AI use cases that improve workflows.
CVE-2026-107870 is a high-severity Cross-site Scripting (XSS) vulnerability in Crocoblock JetEngine. It involves improper neutralization of input during web page generation, leading to a DOM-based XSS issue. This affects JetEngine versions from the initial release up to 3.8.16. The vulnerability allows an attacker to execute malicious scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability.
This content discusses the limitations of AI-powered agentic penetration testing, highlighting that safety restrictions and network constraints can leave certain assets and vulnerabilities untested. It suggests that combining agentic pentesting with exposure validation and breach simulation techniques can help address these blind spots.
Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 contain an SQL Injection vulnerability (CWE-89) that allows a low privileged local attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability.
Dell Unisphere for PowerMax vApp version 9.2.4.x contains an OS Command Injection vulnerability (CWE-78) that allows a high privileged remote attacker to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 score of 6.6, indicating a medium severity level. No patch or remediation details are provided in the available data.
Dell Unisphere for PowerMax vApp version 9.2.4.x contains a path traversal vulnerability (CWE-22) that allows a low privileged remote attacker to access restricted directories, potentially leading to information disclosure. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No patch or remediation information is currently provided by the vendor.
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint. The vulnerability arises because the onGET handler calls an unguarded root() function instead of the validated root.resolve() wrapper, allowing attackers to send percent-encoded directory traversal sequences. This enables reading arbitrary files outside the configured root directory, including sensitive files like /etc/passwd or SSH private keys, which are then archived and streamed back as a downloadable tar.gz file.
Dell Unisphere for PowerMax vApp version 9.2.4.x contains a command injection vulnerability (CWE-77) that allows a high privileged remote attacker to execute arbitrary commands. This vulnerability can lead to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.6, indicating a medium severity level.
CVE-2026-108065 is a critical SQL Injection vulnerability in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce. It allows an unauthenticated remote attacker to manipulate the sUserID parameter to execute arbitrary SQL commands on the backend Microsoft SQL Server. This can lead to full compromise of the database, including reading, writing, and executing commands.
A phishing campaign distributes the AgentTesla infostealer via emails pretending to be business proposals. The attached ZIP file contains a malicious executable disguised as a café management program with Chinese-language UI. The malware uses multi-stage obfuscation and .NET payload loading to ultimately deploy AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP, and VPN applications. Stolen data is exfiltrated through FTP to a compromised server. The attack targets business users using social engineering and sophisticated loading techniques.
ONLYOFFICE DocumentServer versions from 2.5.0 up to but not including 10.0.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the /downloadfile/:docid endpoint. This flaw allows remote attackers to bypass private IP filtering when JWT verification is disabled, enabling them to make the server fetch and relay internal or cloud metadata content. The vulnerability arises due to the isInJwtToken flag being exploitable in the default configuration.
A global cybercriminal network responsible for over one billion phishing messages targeting more than 75,000 organizations across 150 countries has been disrupted by law enforcement and partners. The operation involved a Chinese-language cybercrime marketplace called YAM Store, which sold compromised Microsoft and Google accounts and infrastructure. Phishing kits such as CoGUI, Haozi, and Iron Man were used to conduct large-scale phishing campaigns, including device-code phishing to steal authentication tokens. Microsoft and allied agencies seized domains, deactivated accounts, and blocked domains to disrupt the infrastructure. The campaign targeted Microsoft 365 customers heavily and used sophisticated evasion techniques like geofencing and fake CAPTCHA gates. The takedown is ongoing with continued removal of malicious infrastructure.
CVE-2026-107417 is a missing authorization vulnerability in the Push Notification for Post and BuddyPress plugin by Muralidharan Ramasamy. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects versions from the initial release up to 3.23. The CVSS 3.1 base score is 6.5, indicating a medium severity level.