The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.2 contains an authentication bypass vulnerability. This flaw arises when the 'Use WordPress users as customers' option is enabled, allowing attackers with Subscriber-level access to impersonate other customers by exploiting a fallback check that matches usernames to emails incorrectly. Attackers can access victim customer data and overwrite their email on next login.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images (file_info[2] = title)' parameter. This vulnerability affects all versions up to and including 2.8.190. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages.
Google Chrome and Mozilla Firefox released updates addressing a total of 114 security vulnerabilities, including multiple critical and high-severity use-after-free bugs. Mozilla also introduced Firefox Enterprise, a browser tailored for organizations with strict security and compliance needs, featuring enhanced management controls. The updates fix issues such as buffer overflows, sandbox escapes, privilege escalations, information disclosures, and other memory corruption bugs. No active exploits in the wild have been reported for these vulnerabilities. The patches are included in Chrome versions 155.0.8059.79/.80 and Firefox 158, along with related Thunderbird and Firefox ESR releases.
Koha Community's Koha software is affected by a SQL injection vulnerability in the Most-circulated items report. The vulnerability arises from unsafe concatenation of user-controlled parameters into SQL queries without proper validation or sanitization. Authenticated staff users with reports module permission can exploit this to execute arbitrary SQL commands and access sensitive database information. The issue is fixed in Koha versions 24.11.19, 25.05.14, 25.11.08, and 26.05.03.
Security updates released by Citrix, Fortinet, and Ivanti address 29 vulnerabilities across their products, including multiple critical-severity flaws. These vulnerabilities could allow attackers to bypass authentication, execute arbitrary code, leak sensitive authentication information, cause denial-of-service conditions, elevate privileges, and read arbitrary files. Notably, Ivanti patched a zero-day vulnerability exploited in the wild affecting Connect Secure VPNs. Fortinet fixed critical issues in FortiSIEM and FortiSandbox GUI that could lead to unauthenticated code execution and authentication bypass. Citrix addressed defects impacting Workspace App for Windows, XenServer versions 8.4 and 9, and UniconOS. The vulnerabilities affect a range of products but no specific affected versions are detailed in the available information.
Koha Community's Koha software contains an OS command injection vulnerability in its Task Scheduler deletion functionality. Authenticated staff users with schedule task permissions can exploit this by injecting shell metacharacters in the jobid parameter, leading to arbitrary command execution as the application user. This vulnerability is fixed in Koha versions 24.11.20, 25.05.15, 25.11.09, 26.05.04, and the 26.11 development branch.
During Q3 2026, attacks targeting poorly managed Linux SSH servers were observed, primarily using brute force and dictionary attacks. The main malware families involved were ShellBot, a Perl-based DDoS bot, and Fisieredoor, a backdoor capable of command execution and deploying SSH dictionary attack tools. Attackers used wget or curl to download malware, then installed user-mode rootkits, process masking tools (XHide), and XMRig cryptocurrency miners. The malware launcher used ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor also deployed tools for credential harvesting and lateral movement, transmitting successful authentication data to command servers.
In Q3 2026, attackers targeted Windows-based MS-SQL and MySQL database servers using brute-force, dictionary attacks, and vulnerability exploitation. They deployed cryptocurrency miners (XMRig), backdoors (GotoHTTP), SoftEther VPN infrastructure, and various web shells for persistence. Additional tools included VShell for remote command execution, HackBrowserData for credential theft, Fscan for reconnaissance, and Cloudflared for port exposure. Attackers created backdoor RDP accounts and used SoftEther VPN servers as command and control infrastructure. The attacks mainly exploited weak passwords, poor account management, and insufficient security on exposed database servers.
CVE-2026-110227 is a missing authorization vulnerability in the 10up Restricted Site Access plugin. It affects versions from initial releases up to 7.6.2. The flaw allows bypassing access control restrictions due to incorrectly configured security levels. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited impact on confidentiality and no impact on integrity or availability. No official patch or vendor advisory is provided in the data. No known exploits are reported in the wild.
CVE-2026-109901 is a high severity SQL Injection vulnerability in Codepeople CP Multi View Event Calendar affecting versions from 0 up to 1.4.41. This flaw allows an attacker with low privileges and no user interaction to cause a partial denial of service and potentially impact confidentiality by injecting malicious SQL commands. No official patch or remediation information is provided in the source data.
CVE-2026-107171 is a medium severity vulnerability in Trellix Agent version 5.8.4 involving the use of a hard-coded cryptographic key in the mfecryptc.dll component. This flaw allows regular users to decrypt the database, potentially exposing sensitive information. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a moderate impact with local attack vector and low privileges required. There is no indication of active exploitation in the wild or available patches at this time.
CVE-2026-89310 is a critical SQL injection vulnerability in JTL SW GmbH's JTL-WMS product. It arises because a parameter from the request body is directly inserted into a T-SQL statement without proper parameterization or escaping. This flaw allows a remote attacker to execute arbitrary SQL commands with the application's database privileges. The vulnerability affects multiple versions prior to 2.0.7, 2.1.3, and 2.2.1. The CVSS 4.0 score is 9.4, indicating a high severity with network attack vector and no user interaction required.
This report discusses the presence of orphaned VBA projects embedded inside AutoCAD DWG files. These VBA projects are stored within OLE files embedded in the DWG files. Some DWG files contain VBA projects that are orphaned, meaning the pointer to the embedded VBA project is zero, but the embedded OLE file with the VBA code still exists. AutoCAD does not recognize or execute these orphaned VBA projects. The report includes a method to detect and extract these embedded VBA projects using custom scripts and tools.
CVE-2026-110467 is an authorization bypass vulnerability in WisdomGarden's Tronclass product. Authenticated remote attackers can exploit an insecure direct object reference (CWE-639) by modifying a user-controlled parameter to access peer review scores of any student. The vulnerability affects versions 1.77 and 1.78. The CVSS 4.0 base score is 5.3, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
WisdomGarden's Tronclass versions 1.77 and 1.78 contain a vulnerability (CVE-2026-110466) that allows authenticated remote attackers to bypass anonymous grading restrictions and access anonymous student information. This issue is classified as a sensitive data exposure (CWE-497) with a medium severity rating and a CVSS 4.0 score of 5.3.
WisdomGarden's Tronclass versions 1.77 and 1.78 contain an insecure direct object reference vulnerability (CWE-639) that allows authenticated remote attackers with low privileges to modify a parameter and alter peer review scores of any student. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3. There is no indication of known exploits in the wild or available patches at this time.
SiteGuard Server Edition by EG Secure Solutions Inc. contains an OS command injection vulnerability. No specific affected versions or technical details are provided. There is no information about available patches or exploits in the wild.
CVE-2026-96904 is a medium severity information exposure vulnerability in the AWP Classifieds WordPress plugin before version 4.4.9. It allows unauthenticated attackers to bypass ownership checks on the ad submission page by referencing a payment transaction, enabling them to read private contact emails stored on any listing.
CVE-2026-96900 is a medium severity vulnerability in the Cart Abandonment Recovery for WooCommerce WordPress plugin before version 2.1.4. The flaw allows unauthenticated attackers who know a customer's email address to delete or modify that customer's abandoned cart data without verifying ownership of the email. This can lead to unauthorized tampering with user data stored by the plugin.
CVE-2026-94360 is a vulnerability in the Paymentfor Gateway for WooCommerce WordPress plugin before version 1.0.6. The plugin fails to verify the authenticity of inbound payment notifications, allowing unauthenticated attackers to mark orders as paid without completing any payment.