A new JavaScript obfuscation technique has been demonstrated where formatting changes to a script can transform it into a completely different program. This technique leverages 186 different methods to alter script behavior through formatting, which can be tested via provided online tools and demos. The technique is primarily a research and development insight into JavaScript code manipulation rather than a direct vulnerability or exploit in existing software.
NetBreak is a TCP/UDP port scanner tool released on GitHub by the 5evenTeam, designed for authorized network reconnaissance. It features multiple front ends (terminal UI, desktop app, and CLI) and supports service/version detection and OS guessing heuristics. The tool is intended for legitimate scanning purposes and does not represent a vulnerability or active threat by itself. No security vulnerabilities or exploits are reported in the provided information.
CVE-2026-110889 is a vulnerability in the Gantry 5 Framework that allows generation of error messages containing sensitive information. This issue affects versions from the initial release up to and including 5.6.4. The vulnerability can lead to the exposure of embedded sensitive data through error messages.
Discover-Tech, an Israeli advertising company, operated as a covert channel for Candiru spyware, enabling zero-click infections via malicious ads. These ads allowed threat actors to fingerprint, track, and de-anonymize millions of devices worldwide, including targeted attacks on Al Jazeera. The operation, named AdFection, exploited the online advertising ecosystem to deliver spyware without user interaction. Major platforms like Google and IAB Europe have removed Discover-Tech from their ad vendor registries and blocked its access to ad exchanges. Citizen Lab recommends blocking targeted ads at the gateway as the primary defense until industry-wide mitigations are effective.
Ozentime Antivirus is a newly released free antivirus software offering two editions: a lightweight 1.5 Pro version and a 2.0 flagship version with an AI engine and VPN. Both editions perform user-mode heuristic scanning without kernel or rootkit defense. The VPN included in version 2.0 is not encrypted. The software supports Windows 7 through 11 and aims to be lightweight and easy to use. There is no indication of vulnerabilities or security threats associated with this product in the provided information.
The weForms WordPress plugin up to version 1.6.28 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary media files on the server. This occurs due to insufficient file path validation in the weforms_delete_entry_attachments function. Exploitation requires an administrator to permanently delete a specially crafted form entry, which an attacker can induce via social engineering. The vulnerability has a medium severity rating with a CVSS score of 5.4.
The European VAT Compliance Assistant for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the CF-IPCountry header in all versions up to and including 1.36.10. This vulnerability allows unauthenticated attackers to inject malicious scripts that are stored in order post-meta during guest checkouts and executed when users access the affected pages.
The YMC Filter WordPress plugin up to version 3.12.19 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'post_title' parameter. Authenticated users with author-level access or higher can inject malicious scripts that execute when any user accesses the affected page. The vulnerability is exacerbated by an autocomplete REST endpoint that allows unauthenticated users to trigger the injected payload simply by interacting with the search box.
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'mmdwqzpoxadd' parameter. This affects all versions up to and including 2.8.61. The vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the affected invoice's Payment Form Details metabox. The nonce required for form submission is publicly exposed, enabling exploitation without authentication.
CVE-2026-110384 is a reflected cross-site scripting (XSS) vulnerability in the Fancy Comments WordPress plugin by Heateor Support. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers. This affects Fancy Comments WordPress versions from 0 up to and including 1.2.21. The vulnerability has a high severity with a CVSS score of 7.1.
CVE-2026-97314 is a medium severity information exposure vulnerability in the ThirstyAffiliates WordPress plugin before version 3.12.1. The plugin's link redirect tracking handler does not verify the status or type of the requested object, allowing unauthenticated attackers to disclose destination URLs of unpublished affiliate links and to submit fabricated click statistics.
CVE-2026-81344 is a deserialization vulnerability in the ACF Frontend Admin by DynamiApps WordPress plugin up to version 3.29.13. It allows high-privilege users, such as administrators, to inject PHP objects during deserialization of stored post content rendered on public pages. This can potentially lead to remote code execution if a suitable gadget chain exists in the plugin or WordPress core.
The ACF Frontend Admin WordPress plugin by DynamiApps up to version 3.29.13 contains a missing authorization vulnerability. This flaw allows unauthenticated users to submit a public form that overwrites site-wide Advanced Custom Fields (ACF) options without proper capability checks. The vulnerability has a medium severity score of 5.3 and impacts the integrity of site configuration data.
A vulnerability in the WP User Manager WordPress plugin before version 2.9.20 allows unauthenticated users to create functional accounts without completing payment. This occurs because the plugin does not roll back the WordPress account created during payment-gated registration if the payment step fails.
A Server-Side Request Forgery (SSRF) vulnerability exists in the WP Data Access WordPress plugin before version 5.5.88. The flaw arises because one of the plugin's actions lacks authorization and CSRF protections, allowing any authenticated user, including low-privileged roles like subscribers, to make the server connect to arbitrary hosts and ports and read the response.
A vulnerability in the PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin before version 1.120.70 allows unauthenticated users to retrieve the secret key of any paid order. This occurs because the plugin does not perform capability or ownership checks before returning the order's secret key. The exposed key can be used to view sensitive customer information including name, email, postal address, and order contents. The vulnerability has a medium severity with a CVSS score of 5.3.
The Ukr-To-Lat WordPress plugin versions up to and including 1.3.5 contain a SQL injection vulnerability. This flaw arises because the plugin does not properly sanitize and escape a term name before including it in a SQL query. Users with Contributor-level access or higher can exploit this vulnerability to perform SQL injection attacks. The vulnerability has a CVSS score of 6.8, indicating medium severity. There is no information about available patches or fixes at this time.
The Patreon WordPress plugin versions before 1.10.0 contain an open redirect vulnerability. This flaw allows unauthenticated attackers to craft URLs that redirect users to arbitrary external sites without validation. Such behavior can be exploited for phishing attacks by misleading users into visiting malicious websites.
CVE-2026-92431 is a low severity vulnerability in the Patreon WordPress plugin versions before 1.10.0. It involves missing authorization checks on certain plugin functionality, allowing unauthenticated users to enumerate taxonomy term names, including those of non-public taxonomies not normally exposed on the front end.