A malicious JavaScript file was found in a third-party performance monitoring integration on Polymarket. The script was designed to access authenticated trading sessions, inspect user portfolios, and transfer cryptocurrency assets to attacker-controlled addresses. It operates by reading authentication data from local storage, navigating React components to find trading functions, and creating signed messages to move assets. Polymarket has removed the compromised third-party integration. The extent of victimization and total losses are currently unknown.
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
CVE-2026-59396 is a denial-of-service vulnerability in Cloud Foundry UAA's private_key_jwt client-authentication mechanism. It arises from the handling of remote JWKS URI responses, which are cached and fully deserialized upon invalid authentication attempts. An attacker with write access to clients or a compromised endpoint can send anonymous requests that repeatedly trigger parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion, leading to service unavailability. The vulnerability affects UAA versions >=76.23.0 <79.9.0 and >=0 <60.11.0. Fixed versions are 79.9.0 and 60.11.0. The CVSS 4.0 score is 6.9 (medium severity).
CVE-2026-115456 is a low-severity vulnerability in the gcc compiler's libstdc++ library affecting Red Hat Enterprise Linux 10. It involves an out-of-bounds read triggered when std::from_chars() processes a non-null-terminated string, potentially causing application crashes or incorrect floating-point conversions. Exploitation requires an application built with libstdc++ to handle untrusted, improperly terminated input without bounds validation. There is no risk of memory corruption or code execution. Mitigation options are currently unavailable or do not meet Red Hat's criteria for deployment and stability.
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
Binance, the largest cryptocurrency exchange, suffered a record $6.3 billion crypto theft on October 29, 2026. The attack likely originated from a compromised DevOps engineer's laptop, allowing unauthorized withdrawal transactions without leaking wallet private keys. The attackers exploited multiple blockchains using valid signatures, indicating control over Binance's hot wallet signing system. Blockchain analysts attribute the attack with high confidence to North Korea's elite hacking unit, TraderTraitor. Approximately $3 billion of the stolen assets have been frozen by stablecoin issuers and security councils, while about $2.4 billion remain unfrozen. Binance is cooperating with law enforcement and has pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
A critical authorization vulnerability exists in Teltonika Networks RUTOS and TSWOS devices within specified versions. An unauthenticated user can invoke LUA functions directly, bypassing normal API validation flows, potentially leading to operating system command execution. This affects multiple device models running RUTOS versions 7.22 through 7.24.2 and TSWOS versions 1.9 through 1.10.
The npm package 'claims-acct-unlock' version 25.2.1 has been identified as malicious by the OpenSSF Package Analysis project. It is flagged because it communicates with a domain linked to malicious activity and executes commands associated with malicious behavior. This package poses a security risk to users who install or use it.
CVE-2026-115455 is a vulnerability in GCC libstdc++ affecting Red Hat Enterprise Linux 10. It involves improper stack memory allocation when extracting data into a bitset from a wide-character stream, leading to a stack-based buffer overflow. This can cause a denial of service (DoS) if an attacker supplies crafted input. The vulnerability requires a specific and uncommon application design pattern to be exploitable. Red Hat's compiler stack-hardening typically causes affected binaries to abort on stack corruption, limiting the impact to DoS.
CVE-2026-114691 is a vulnerability in the libstdc++ component of GCC used in Red Hat Enterprise Linux 10. It involves an integer wrap during memory calculations when constructing a boolean vector with an excessively large element count. This leads to an inconsistent container state causing out-of-bounds memory access, which can crash the application or cause a Denial of Service (DoS). The vulnerability requires attacker-controlled input of near-maximum integer values and has a moderate impact confined to the affected process. No patch or mitigation is currently available that meets Red Hat's criteria.
CVE-2026-114690 is an out-of-bounds write vulnerability in GCC's libstdc++ parallel search implementation caused by an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and resulting in a denial of service. The vulnerability affects only applications built with optional parallel extensions, which are not enabled by default. Standard builds using default libstdc++ configurations are not vulnerable. No fix or mitigation meeting Red Hat's criteria is currently available.
Gravity Forms plugin for WordPress versions up to and including 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of type List. This occurs because the plugin uses WordPress' maybe_unserialize() without restrictions instead of its own hardened deserialization function. An attacker can inject PHP objects into post meta, potentially leading to remote code execution if a suitable gadget chain exists in other plugins, themes, or WordPress itself.
The AI Engine – MCP Server & AI Chatbot for WordPress plugin (versions up to 3.8.6) contains a missing authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This endpoint allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the attacker's client on the OAuth consent screen, the attacker can gain administrator-level access through the MCP tools. The consent page lacks protections against clickjacking, enabling attackers to trick administrators into approving malicious clients.
The Food Store – Online Food Delivery & Pickup WordPress plugin versions up to 1.5.5 are vulnerable to stored cross-site scripting (XSS) via the 'service_time' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled and 'Enable Pickup/Delivery Service' is enabled.
Gravity Forms plugin for WordPress versions up to and including 3.1.2 is vulnerable to stored cross-site scripting (XSS) via the List Field. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the injected entry and confirms a dialog. Exploitation requires user interaction by an administrator clicking a crafted link and confirming a prompt.
Formidable Forms WordPress plugin versions up to 6.35 are vulnerable to arbitrary plugin installation via the 'file_url' parameter due to insufficient URL validation and improper permission checks. Authenticated users with subscriber-level access or higher can exploit this vulnerability if the site uses the free version of the plugin (not Formidable Pro).
Gravity Forms plugin for WordPress versions up to 3.1.1 is vulnerable to stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. The issue arises because certain fields allow raw HTML submissions and an entity-encoded payload bypasses sanitization, later decoded into executable markup by the browser.
CVE-2026-118593 is a vulnerability in Red Hat Enterprise Linux 9 kernel versions 9.6 through 9.10 caused by an incomplete backport of a previous fix. This flaw results in a local_bh imbalance in the seg6_input_core() function, where the drop path returns with bottom halves still disabled. The issue can cause softirq starvation and denial of service on systems configured with SRv6 tunnels. Upstream Linux kernels and Red Hat Enterprise Linux 10 are not affected.
The WP Visitor Statistics (Real Time Traffic) WordPress plugin versions before 8.8 contain a vulnerability where a parameter is not properly sanitized and escaped before being used in a SQL statement. This flaw allows users with high privileges, such as administrators, to perform SQL injection attacks.
The Forminator Forms plugin for WordPress versions up to and including 1.55.0.2 contains a vulnerability that allows unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory. This occurs because the plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation, which can be exploited via the previous_draft_id parameter referencing a manipulated draft.