phpMyFAQ versions from 4.0.0 up to but not including 4.1.9 contain an incorrect authorization vulnerability. Delegated administrators without the editnews right can modify news items by exploiting a mischeck of permissions in the update API endpoint. This allows attackers with addnews and delnews rights to alter news content displayed on the public front page.
phpMyFAQ versions before 4.1.9 and between 4.2.0-alpha and 4.2.0-beta contain an account enumeration vulnerability. This flaw allows unauthenticated attackers to confirm registered display names and emails by observing distinct HTTP 409 responses when submitting guest comments. The vulnerability can be exploited to link user names to email addresses, facilitating targeted phishing attacks.
phpMyFAQ versions from 4.2.0-alpha.2 up to but not including 4.2.0-beta have a vulnerability in the removeTwofactorConfig() endpoint that lacks brute-force protection. This allows authenticated attackers with a hijacked session and CSRF token to repeatedly guess TOTP codes without limitation and disable the victim's two-factor authentication (2FA).
phpMyFAQ versions from 4.2.0-alpha up to but not including 4.2.0-beta contain an authorization vulnerability in the GroupController::deleteGroup() function. This flaw allows authenticated administrators with the GROUP_DELETE privilege, but not SuperAdmin rights, to delete higher-privileged groups by sending a crafted groupId to the /admin/api/group/delete endpoint. This results in permanent deletion of groups and removal of inherited rights from their members.
phpMyFAQ versions before 4.1.9 and between 4.2.0-alpha and 4.2.0-beta allow changing the account email without requiring the current password, relying only on session and CSRF token validation. An attacker who has hijacked a user session can change the email to their own and then use the password reset process to take over accounts that do not have two-factor authentication enabled, including superadmin accounts.
phpMyFAQ versions 3.2.0-alpha up to but not including 4.1.9, and 4.2.0-alpha up to but not including 4.2.0-beta, contain an authentication bypass vulnerability. This flaw allows users authenticated via Identity Providers (IdP) using Keycloak and Entra ID SSO callbacks to bypass TOTP two-factor authentication. Attackers with a valid or phished IdP identity linked to a 2FA-enabled account can complete the OpenID Connect (OIDC) flow and gain a fully authenticated session, including administrator privileges.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing a vulnerability in libpng identified as CVE-2026-46675. The update includes new versions of libpng packages for multiple architectures. The advisory does not specify detailed technical impact or exploitation details but categorizes the severity as medium.
The PyPI package 'tonemaptts' version 0.1.0 is part of a malicious campaign that falsely advertises itself as an audio-analysis profiles loader but actually downloads and executes remote malicious code. This package is linked to a broader coin-mining campaign and is designed to run unauthorized scripts from remote sources.
The pyrechoasr package on PyPI is a malicious package falsely advertising as an audio-analysis profiles loader. Its actual purpose is to download and execute remote malicious scripts, continuing a known coin-mining campaign. The package version 0.1.0 is affected. No CVSS score is available for this threat.
The PyPI package 'driftwavets' version 0.1.0 is part of a malicious campaign that falsely advertises itself as an audio-analysis profiles loader. Instead, it downloads and executes remote malicious code, continuing a known coin-mining campaign. This package is designed to execute remote code without embedding the URL directly in the package.
The PyPI package 'novalithtts' version 0.1.0 is part of a malicious campaign falsely advertising itself as an 'audio-analysis profiles' loader. Instead of providing legitimate functionality, it downloads and executes remote malicious scripts, likely continuing a coin-mining campaign. There is no embedded URL in the package, indicating remote code execution is triggered externally. This package poses a direct threat by executing unauthorized code on affected systems.
The PyPI package 'voltswannts' version 0.1.0 is identified as malicious software that falsely advertises itself as an 'audio-analysis profiles' loader. Its actual purpose is to download and execute a remote malicious script, continuing a known coin-mining campaign. This package poses a direct threat by executing unauthorized remote code.
The PyPI package 'glassbeakasr' version 0.1.0 is part of a malicious campaign that falsely advertises itself as an audio-analysis profiles loader. Its true purpose is to download and execute remote malicious scripts, likely continuing a previous coin-mining campaign. There is no embedded URL in the package itself, indicating remote code execution is triggered dynamically. This package is identified as malicious software with intent similar to infostealers.
The emberlytts package on PyPI is part of a malicious campaign that falsely advertises itself as an 'audio-analysis profiles' loader. Its actual purpose is to download and execute remote malicious code. This package is linked to a known coin-mining campaign and is considered to have clear malicious intent.
The quasitonnts package on PyPI falsely advertises itself as an 'audio-analysis profiles' loader but is designed to download and execute remote malicious code. This behavior is linked to a broader malicious campaign involving coin-mining activities. The package version 0.1.0 is affected. There is no CVSS score available for this threat.
CVE-2026-109701 is a high-severity reflected cross-site scripting (XSS) vulnerability in PAYCOMET for WooCommerce versions up to and including 5.45. It involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This vulnerability can lead to partial confidentiality, integrity, and availability impacts.
The ukraine69 package on PyPI contains malicious code that executes during import. This code attempts to escape sandbox environments, locate Telegram bot session files, and trigger malicious account deletions. The campaign associated with this package is identified as malicious with destructive actions and attempts to cover tracks.
Hackers exploited a supply-chain attack via ConnectWise's Cloud Backup service to gain unauthorized access to Microsoft 365 tenants. The attackers used compromised application identities (service principals) with previously granted permissions to access tenant data without triggering multi-factor authentication. ConnectWise shut down the Cloud Backup service to prevent further unauthorized access and is investigating the incident. No evidence currently indicates that backup archives were compromised, but attackers performed reconnaissance and persistence activities in some tenants.
Drupal has patched two critical remote code execution vulnerabilities affecting all supported versions of its core, specifically in the Field UI module and the contributed Entity List module. These flaws could allow attackers to execute arbitrary code remotely, with some exploitation paths requiring no authentication. Administrators are urged to update to Drupal core versions 10.6.19, 11.3.19, or 11.4.10 and Entity List module version 3.0.10. Uninstalling the Field UI module is recommended if immediate upgrade is not possible. The vulnerabilities impact all supported Drupal versions and pre-release versions of Drupal 12 before beta2. Exploits may emerge soon after disclosure, so timely patching is critical.