Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.
ClickFix is a rapidly growing browser-based attack technique that uses fake AI tool installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Attackers exploit user habits around AI tool adoption, such as running terminal install commands and searching for AI apps via search engines, to deliver malicious payloads. These attacks bypass traditional defenses by leveraging legitimate domains, cloaking, and in-memory execution. ClickFix attacks accounted for up to 67% of detected browser-based attacks in mid-2026, with a significant portion delivered through compromised websites, malvertising, and SEO poisoning. Variants like InstallFix and LLMshare use cloned install pages and malicious shared AI chatbot artifacts to lure victims. Microsoft reports ClickFix as a highly effective initial access technique with over 1.1 million unique devices affected in early 2026.
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.
If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can use it to add a fake standby coordinator entry to gp_segment_configuration on a cluster that has no standby configured. Administrators then cannot add a real standby until a superuser removes the fake entry. User data is not exposed or modified.
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.
WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force the segment backends of any other session, superuser sessions included, to write their memory context details to the segment server logs, which the attacker cannot read. Those details can include query text from other users' cached plans, and the call can be repeated to generate large amounts of log output. WarehousePG 6.x is not affected.
In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.
This issue affects chi before 5.4.0.
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions.
The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.
The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.
CVE-2024-5563 is a vulnerability in WSO2 Identity Server versions 7.0.0 up to but not including 7.0.0.37 where reCaptcha is not applied to certain authentication flows despite being enabled. This allows attackers to bypass the reCaptcha protection, potentially enabling brute force attacks that could lead to unauthorized access to user accounts and sensitive information. The vulnerability has a medium severity with a CVSS score of 4.8.
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.
Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.
CVE-2026-114249 is an improper authorization vulnerability in the dhikshitha29 Insurance-Management-System affecting the Policy Holder Update Form component. The flaw involves manipulation of the Policy_no argument in the /Agent/includes/UpdatePolicyHolder-inc.php file, allowing remote attackers to bypass authorization controls. The vulnerability has a medium severity with a CVSS score of 6.9. The product uses rolling releases, so specific affected or fixed versions are not available. The vendor has been informed but has not yet responded or issued a fix. Public exploit code is available, increasing the risk of exploitation.
Asymptote Labs has raised $5.5 million in seed funding to develop Beacon, an AI agent runtime security platform. Beacon is an open source telemetry layer that standardizes activity from multiple AI agent harnesses and normalizes telemetry into a unified data model. The commercial platform enforces policy guardrails in real time to prevent unsafe or risky AI agent behavior. This initiative addresses the lack of infrastructure for monitoring and controlling autonomous AI agents accessing sensitive corporate data.
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.
A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The manipulation of the argument submit/Plan_no/Name leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Tenable developed a multilingual AI security detection model that natively supports 10 languages, overcoming limitations of English-only threat detectors. Previously, their approach translated non-English inputs into English before detection, which introduced latency, cost, operational complexity, and loss of semantic accuracy. To address this, Tenable created an agentic translation pipeline that generates high-fidelity, label-preserving multilingual training and benchmark data, ensuring the security-relevant meaning is maintained. This approach avoids reliance on costly and slow translation models in production, resulting in detection speeds 20-800 times faster and significantly reduced costs. The solution improves detection of AI threats, harmful content, and policy risks across multiple languages without degrading accuracy.
Google Chrome 156 was released with patches for 353 security vulnerabilities, primarily memory safety bugs including memory corruption, use-after-free, and out-of-bounds read issues. The update addresses six critical-severity flaws and numerous high, medium, and low severity vulnerabilities. No exploitation in the wild has been reported. Bug bounty rewards were issued for some vulnerabilities, with the highest being $10,000 for a high-severity use-after-free bug. The update is available for Windows, macOS, and Linux platforms.
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.