CVE-2026-97851 is a critical vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The issue arises from the storage status-change REST service, which allows location records still linked to DICOM instances to be changed to deletion-related states. Specifically, changing a location to TO_DELETE triggers the PurgeStorageScheduler to delete the referenced object from storage, while the corresponding instance record remains in the database.
This report summarizes multiple cybersecurity developments including the ICS-Sniper proof-of-concept attack targeting industrial control systems using cloud-hosted SCADA, an unauthenticated remote code execution vulnerability in XWorm RAT's C2 panel allowing takeover, a critical Langflow vulnerability exploited before public disclosure, and an AI-assisted Chrome exploit chain that earned a $250,000 bounty. Additional topics include Bank of America's large-scale patching effort, KGB RAT malware with harassment features, and a data breach affecting Burger King Japan's app. The ICS-Sniper attack manipulates VPN-encrypted traffic to disrupt industrial operations. The XWorm flaw allows attackers to run code on the command-and-control server without operator interaction. The Langflow flaw permits authenticated users to execute arbitrary code on the server and has been actively exploited. The Chrome exploit combined three bugs now fixed by Google. These incidents highlight ongoing threats to industrial, enterprise, and consumer environments.
CVE-2026-105664 is a medium severity vulnerability in the EseeCloud App by Guangzhou Juan IoT Technology Co., Ltd. The app's endpoint reveals different error responses when queried with valid versus nonexistent 10-digit ID values. This behavior allows an attacker with a valid access token but no further authentication to enumerate registered device IDs at scale due to the lack of effective rate limiting.
CVE-2026-97858 is a vulnerability in the EseeCloud App by Guangzhou Juan IoT Technology Co., Ltd. It allows an attacker to cause the server to unbind a target device from its current owner and rebind it to the attacker's account. This occurs regardless of whether the device is currently bound to a different account, enabling the attacker to obtain the device's full serial ID. The vulnerability is classified under CWE-915, indicating improperly controlled modification of dynamically-determined object attributes. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No patch or remediation information is provided in the available data.
CVE-2026-107617 is a critical vulnerability in the Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App involving the use of hard-coded credentials. This flaw allows an attacker to log in to EseeCloud devices without authorization by leveraging these embedded credentials. The vulnerability affects versions from 0 up to and including 4.9.6 and 4.9.86.0. It has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. There is no information about available patches or vendor advisories addressing this issue.
Employees using personal ChatGPT accounts at work can lead to exposure of sensitive company data, even if the organization provides an approved Enterprise workspace. IT administrators need to investigate unauthorized AI use and implement controls to prevent sensitive information from being shared with personal AI accounts.
CVE-2026-110805 is a server-side request forgery (SSRF) vulnerability in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier. It allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret by manipulating the PingOne configuration in a request parameter. The vulnerability has a low CVSS score of 2.6, indicating limited impact and requiring user interaction with high attack complexity.
CVE-2026-110804 is a vulnerability in Devolutions Server versions prior to 2026.3.10 that allows an authenticated user with PAM checkout access to improperly modify JIT elevation settings. This flaw can enable deletion of arbitrary Active Directory groups or retention of elevated privileges through client-supplied JIT elevation settings in a checkout update request.
CVE-2026-110806 is an incorrect authorization vulnerability in Devolutions Server versions 2026.3.8.0 and earlier. It allows an authenticated user with only View permission to access unredacted add-on passwords through add-on properties returned in connection data. This vulnerability does not require user interaction and has a medium severity rating with a CVSS score of 6.5.
CVE-2026-110287 is an improper access control vulnerability in Devolutions Server versions prior to 2026.3.10. It allows an authenticated user who has general Edit permissions but lacks Edit asset permission to modify the asset contact password by sending a crafted request to the partial-save endpoint. The vulnerability has a CVSS score of 4.3, indicating medium severity.
CVE-2026-18516 is a critical stored cross-site scripting (XSS) vulnerability in the Audit Logs component of Arcadia Technology, LLC's Crafty Controller. It allows a remote, unauthenticated attacker to inject malicious scripts via HTTP header injection due to improper output escaping. This vulnerability affects versions from 0 up to and including 4.10.8. The CVSS score is 9.6, indicating a high severity with potential for complete compromise of confidentiality, integrity, and availability.
CVE-2026-90821 is a stored cross-site scripting (XSS) vulnerability in the Webhook URL form field of Arcadia Technology, LLC's Crafty Controller. It allows a remote, authenticated attacker to inject malicious scripts via form input. The vulnerability affects versions from 4.2.0 up to but not including 4.11.0. The CVSS 3.1 base score is 5.4, indicating medium severity. There is no indication of known exploits in the wild or available patches at this time.
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. While the plugin's own listing-page templates sanitize output with wp_kses_post(), the stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds, exposing any headless client, feed reader, or third-party widget that renders comment content.
The npm package @xatancchii/natabaileys contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The npm package 'parxleys' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the system. Immediate removal of the package is recommended, but due to the potential extent of the compromise, removing the package alone may not eliminate all malicious software. All secrets and keys stored on the affected computer should be rotated from a separate, secure machine.
An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.
CVE-2026-111400 is a stored cross-site scripting (XSS) vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor). The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to inject malicious scripts. This affects versions from the initial release up to 3.1.0 inclusive. The vulnerability has a medium severity with a CVSS score of 6.5.
Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.