CVE-2026-109695 is a vulnerability in WPManageNinja FluentCart versions prior to 1.8.0 that allows insertion of sensitive information into sent data. This flaw enables attackers to retrieve embedded sensitive data without requiring privileges or user interaction. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-109694 is a critical vulnerability in WP ManageNinja LLC's Fluent CRM plugin that allows incorrect privilege assignment leading to privilege escalation. It affects all versions from initial releases up to and including 3.2.5. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-108497 is a critical SQL Injection vulnerability in TMS Amelia (ameliabooking) affecting versions from initial releases up to 2.4.10. The flaw allows improper neutralization of special elements in SQL commands, potentially enabling an attacker to execute unauthorized SQL queries. This vulnerability has a high CVSS score of 9.3, indicating critical impact on confidentiality and some impact on availability. No official patch or remediation information is provided in the data. No known exploits are reported in the wild.
CVE-2026-108498 is a high-severity Stored Cross-site Scripting (XSS) vulnerability in bannersky BSK PDF Manager versions up to and including 3.8.1. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 score of 7.1, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
CVE-2026-79832 is a stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop SQL/MX Executor. This flaw may lead to information disclosure or cause the process to crash. The vulnerability has a high severity rating with a CVSS score of 7.6. No affected versions or patch information are currently provided.
CVE-2026-79831 is a heap-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop Posix User Threads. This flaw may allow an attacker with local privileges to execute arbitrary code. The vulnerability has a CVSS 3.1 base score of 6.6, indicating a medium severity level. No specific affected versions or patches are currently documented. There is no evidence of known exploits in the wild at this time.
CVE-2026-79830 is a stack-based buffer overflow vulnerability in the Hewlett Packard Enterprise (HPE) NonStop Kernel Level Thread Model Library. This flaw can potentially allow an attacker with limited privileges to execute arbitrary code. The vulnerability has a medium severity rating with a CVSS score of 6.6. No specific affected versions or patches are currently documented.
Hirudo is a novel Android remote access trojan (RAT) that combines traditional banking trojan features with full remote control capabilities. It replaces legitimate Indonesian banking apps with trojanized versions that bypass app integrity checks by hooking internal security mechanisms. The malware enables live screen viewing, remote camera access, SMS collection, and credential theft. It is delivered via trojanized apps advertised on social media and currently targets eight Indonesian banking apps, with potential to target banks in other countries. Hirudo shifts the security contest from the device level to the application level by tampering inside the target app itself.
CVE-2026-17525 is an incomplete cleanup vulnerability in ABB My Control System versions 26.4 and 26.5. The vulnerability does not impact confidentiality or integrity but can cause availability issues. It has a medium severity rating with a CVSS score of 5.2. No patch or remediation information is provided.
CVE-2026-79829 is a high-severity vulnerability in the HPE NonStop HTTP WEBSERVER caused by improper input validation. This flaw can lead to memory corruption, potentially resulting in a system halt. No affected versions or patch information are provided in the available data.
CVE-2026-79828 is a heap-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop Debug Utilities. This flaw can corrupt the resume-execution address, potentially allowing an attacker to redirect the execution flow. The vulnerability has a high severity rating with a CVSS score of 7.1. No specific affected versions or patch information are provided.
CenterPoint Energy experienced a data breach compromising personal information of over 1 million Texas residents. The exposed data includes names, addresses, Social Security numbers, and driver’s license numbers. The breach was publicly disclosed after a hacker posted stolen records on a cybercrime forum. The incident did not affect the utility's operations. The total impact may extend beyond Texas to other states served by CenterPoint Energy, but details remain unclear. Notification letters to affected individuals have not been confirmed. The company reported the breach to the SEC and Texas authorities.
CVE-2026-79827 is a heap-based buffer overflow vulnerability in the Hewlett Packard Enterprise (HPE) NonStop Inspect Subsystem. This flaw could corrupt the resume-execution address, potentially allowing an attacker to redirect execution flow. The vulnerability has a high severity rating with a CVSS score of 7.1. No affected versions or patch information are currently provided.
CVE-2026-18659 is a medium severity vulnerability in Eclipse Jetty affecting multiple versions of jetty-security, jetty-eeN-security, and jetty-eeN-servlet. The issue involves bypassing Jakarta Spec constraints defined as http-method-omission by using substrings of the defined HTTP methods.
CVE-2026-18662 is a medium severity vulnerability in Eclipse Jetty affecting multiple versions of jetty-security and jetty-eeN-security. The issue arises when two or more security constraints share the same http-method-omission set and have no URL patterns, causing improper combination according to the Jakarta Servlet Specification. This leads to later http-method-omission sets overriding earlier constraints with the same set, potentially weakening security enforcement.
Eclipse Jetty's SessionAuthentication component stores authentication credentials, including plaintext passwords, in a serializable object. When sessions are persisted to a session data store, these plaintext passwords may be written to persistent storage. An attacker with sufficient privileges to read this stored session data could obtain user passwords. The vulnerability affects multiple Jetty versions from 9.4.0 through 12.1.12. The CVSS 4.0 score is 5.6, indicating a medium severity risk.
CVE-2026-19863 is a critical vulnerability in EthereumAuthenticator affecting versions 12.1.0 through 12.1.12. It allows an unauthenticated client to access certain protected resources if the request path contains the configured login path as a later segment. This occurs because the authenticator uses an unanchored substring match to identify the login page, causing it to mistakenly treat protected resource requests as login requests and bypass authentication or role checks. Explicitly forbidden routes are not affected.
CVE-2026-79826 is a heap-based buffer overflow vulnerability in Hewlett Packard Enterprise's HPE NonStop OCAX. This flaw could corrupt the program's address space and potentially redirect execution flow, leading to high impact on integrity and availability. The vulnerability has a CVSS score of 7.1, indicating high severity. No affected versions or patch information are currently provided, and no known exploits are reported in the wild.
CVE-2026-50619 is a critical path traversal vulnerability in QNAP Systems Inc.'s Qsirch product. This flaw allows remote attackers to read arbitrary files or system data outside the intended directories. The vulnerability affects Qsirch versions from 7.0.0 up to but not including 7.0.3.0. It has been fixed in version 7.0.3.0 and later.
CVE-2026-47790 is a cross-site scripting (XSS) vulnerability in QNAP Systems Inc.'s QuFTP Service. The flaw allows a remote attacker with a user account to inject malicious code. The vulnerability has been fixed in QuFTP Service versions 1.4.6 and later, 1.5.5 and later, and 1.6.5 and later.