A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.
Operation Serengeti III was a coordinated law enforcement effort across 21 African countries that disrupted nearly 11,000 cybercriminal networks and arrested over 1,400 suspects involved in business email compromise, ransomware, online scams, and other cybercrimes. The operation recovered more than $105 million in illegal funds and identified over 65,000 victims with estimated losses exceeding $385 million. Notable actions included dismantling fraud rings in Uganda, seizing illegal cryptocurrency mining equipment in Angola, and arresting a suspect in Nigeria linked to a large-scale phishing and business email compromise campaign. Private cybersecurity firms provided critical intelligence to support the operation. This large-scale crackdown highlights ongoing efforts to combat cybercrime in Africa but does not describe a specific vulnerability or exploit.
A high-severity vulnerability (CVE-2026-111851) exists in WProyal Royal Elementor Addons up to version 1.7.1068. It involves unsafe reflection due to externally-controlled input used to select classes or code, leading to potential code injection. This vulnerability allows an attacker with low privileges and no user interaction to cause limited confidentiality and integrity impact, but high availability impact.
CVE-2026-112241 is a critical authentication bypass vulnerability in Brainstorm Force SureCart that allows attackers to spoof authentication and abuse access. It affects SureCart versions up to and including 4.9.5. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
An Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder (profile-builder) allows privilege escalation. This vulnerability affects Profile Builder versions up to and including 4.0.4. The CVSS 3.1 score is 8.8, indicating a high severity issue with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability.
Oracle released its October 2026 Critical Patch Update (CPU) addressing 1,295 vulnerabilities across multiple products. Among these, 95 are rated critical severity, with Fusion Middleware receiving the most patches, including many remotely exploitable without authentication. No active exploitation in the wild has been reported. Oracle plans further monthly security updates in November and December 2026.
A stored cross-site scripting (XSS) vulnerability exists in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) versions up to 0.5.9. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level.
A missing authorization vulnerability exists in Brainstorm Force SureDash up to version 1.12.2. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. There is no indication of known exploits in the wild or available patches at this time.
A missing authorization vulnerability exists in Brainstorm Force SureDash (up to version 1.12.2) due to incorrectly configured access control security levels. This flaw allows unauthorized network attackers to access certain functionality without proper permissions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality. No known exploits are currently reported in the wild. No patch or remediation information is provided in the available data.
A New Mexico court ordered Meta to pay $25 billion for intentionally deceiving Facebook users about privacy controls, marking the largest fine against the company. The ruling found Meta liable for over 43 million violations of New Mexico consumer protection laws related to misleading statements about user data handling. This case stems from the Cambridge Analytica scandal where Facebook data was harvested for political advertising. Meta disputes the ruling and plans to appeal. The fine significantly exceeds previous penalties, including a $5 billion FTC fine in 2019. The judgment aims to hold tech companies accountable for privacy misrepresentations.
CVE-2026-112327 is a critical SQL Injection vulnerability in the TMS Amelia ameliabooking plugin affecting versions up to 2.4.11. It allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a high CVSS score of 9.3, indicating network exploitable with no privileges or user interaction required, and impacts confidentiality and availability. No patch or remediation information is currently provided. Users should monitor vendor advisories for updates and apply fixes once available.
A stored cross-site scripting (XSS) vulnerability exists in Codepeople Contact Form Email through version 1.3.68. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be executed in the context of affected users. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with potential impacts on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.
This issue affects esaml: from 0.1.0 onward.
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages.
esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node.
This issue affects esaml: from 0.1.0 onward.
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.
esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.
This issue affects esaml: from 0.1.0 onward.
A missing authorization vulnerability exists in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) up to version 3.1.0. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The vulnerability has a medium severity with a CVSS score of 4.3.
A missing authorization vulnerability exists in WP Chill Strong Testimonials plugin versions up to 3.3.14. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized users with limited privileges to perform actions they should not be permitted to. The vulnerability has a medium severity rating with a CVSS score of 4.3.
A missing authorization vulnerability exists in the eLightUp Falcon – WordPress Optimizations & Tweaks plugin, affecting versions up to 2.12.0. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation details are currently provided.
A missing authorization vulnerability exists in Wpmet Metform up to version 4.3.2, allowing exploitation due to incorrectly configured access control security levels. This vulnerability does not require user interaction or privileges to exploit and impacts the integrity of the affected system without affecting confidentiality or availability.
A missing authorization vulnerability exists in Kings Plugins MarketKing marketplace plugin for WooCommerce, affecting versions up to 2.1.72. This flaw allows attackers with limited privileges to bypass access controls incorrectly configured in the plugin. The vulnerability has a medium severity rating with a CVSS score of 5.4.