The Gravity Forms plugin for WordPress up to and including version 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of input type List. This occurs because the plugin uses WordPress' unrestricted maybe_unserialize() instead of its own hardened version, allowing unauthenticated attackers to inject PHP objects into post meta. While the plugin itself lacks a gadget chain, other plugins or themes may provide one, potentially enabling remote code execution. Specifically, if the custom field maps to the protected _wp_page_template meta key, WordPress functions can be leveraged to achieve remote code execution on vulnerable hosts.
The AI Engine WordPress plugin up to version 3.8.6 has a Missing Authorization vulnerability in its MCP module's OAuth 2.1 Dynamic Client Registration endpoint. This flaw allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. If an administrator approves the malicious client on the OAuth consent screen, attackers can gain administrator-level control, including user creation and option updates. The consent page lacks protections against clickjacking, increasing the risk of unauthorized approval.
The log-utils-sdk package version 0.4.1 on PyPI contains malicious code that executes upon import or use. This code downloads additional malicious scripts and runs a background process that periodically connects to a remote host to receive further commands. The package is a clone of a legitimate library and is part of a known malicious campaign involving obfuscation and remote command execution.
Dell has addressed multiple critical vulnerabilities in its PowerProtect Data Domain products, including Data Domain Virtual Edition and Data Domain Management Center. These vulnerabilities span a range of common weakness enumerations (CWEs) such as path traversal, buffer overflow, improper input validation, and authentication issues. No specific affected versions or detailed technical descriptions are provided. No known exploits in the wild have been reported at this time.
CVE-2026-97209 is an insecure temporary file vulnerability in Elixir's Mix deps.partition feature affecting versions from 1.20.0-rc.4 up to but not including 1.20.5. The vulnerability allows a local user on the same host to execute code as another user by exploiting the way partitioned dependency compilation handles configuration files in a shared temporary directory. The issue arises because the directory is created without ownership checks, enabling an attacker to replace the file before it is read by the client process. This flaw has been fixed in version 1.20.5.
CVE-2026-115274 is a vulnerability in the Elixir standard library's JSON module where improper validation of integer literal length in JSON input can lead to denial of service via CPU and memory exhaustion. The functions JSON.decode/1 and JSON.decode!/1 convert integer literals without bounding their length, allowing extremely large integers to consume excessive resources. This affects Elixir versions from 1.18.0-rc.0 before 1.18.6, from 1.19.0-rc.0 before 1.19.7, and from 1.20.0-rc.0 before 1.20.5. Fixed versions are 1.18.6, 1.19.7, and 1.20.5.
CVE-2026-109821 is a vulnerability in the Elixir standard library's URI module where improper validation of the port component in a URL can lead to denial of service via CPU exhaustion. The URI.parse/1 function converts the port string to an integer without limiting its length, allowing extremely large port numbers to be processed. Rendering such a URI back to text triggers a quadratic-time conversion in Erlang/OTP versions 27, 28, and 29.0, causing significant CPU load and delays. This affects Elixir versions from 0.5.0 up to but not including 1.18.6, from 1.19.0-rc.0 up to but not including 1.19.7, and from 1.20.0-rc.0 up to but not including 1.20.5.
CVE-2026-59387 is a broken access control vulnerability in the Cloud Foundry Cloud Controller API (CAPI). The Nginx routing configuration blocks unauthenticated access to certain internal API endpoints but omits this protection for /internal/v3/. This allows unauthenticated access to staging callback endpoints, enabling attackers with a valid build or droplet GUID to forge staging callbacks, transition droplets to STAGED state, and persist arbitrary metadata without proper authorization. The vulnerability enables privilege escalation beyond intended role boundaries because a SpaceAuditor can enumerate GUIDs without write permissions.
CVE-2026-111585 is a high-severity integer overflow vulnerability in TeamViewer's remote-control screen processing component affecting Windows, macOS, Linux, and Android clients. It allows a malicious or compromised host to send crafted screen dimension data that causes a buffer overflow in the viewer application, potentially leading to denial-of-service or arbitrary code execution on the viewer's system. Exploitation requires the viewer to establish a remote session with the attacker-controlled host. TeamViewer has released patches in version 15.83 and for multiple legacy versions to address this and related vulnerabilities.
CVE-2026-59385 is a vulnerability in Cloud Foundry's CAPI (Cloud Foundry Controller) that allows a user with SpaceDeveloper privileges to indirectly extract space-scoped broker credentials. This is achieved by modifying the URL of a space-scoped broker to redirect credentials to a broker under their control, bypassing the CF API's restriction on direct credential reading. The vulnerability affects versions prior to 1.248.0 and 60.9.0, where fixes have been applied.
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
CVE-2026-59386 is a vulnerability in Cloud Foundry Controller (CAPI) that allows a SpaceSupporter to escalate privileges improperly. By modifying an application's start command and buildpack—actions normally restricted to SpaceDeveloper roles—an attacker can retrieve service credentials without authorization. This flaw affects versions up to 60.9.0, where it has been fixed.
A malicious JavaScript file was found in a third-party performance monitoring integration on Polymarket. The script was designed to access authenticated trading sessions, inspect user portfolios, and transfer cryptocurrency assets to attacker-controlled addresses. It operates by reading authentication data from local storage, navigating React components to find trading functions, and creating signed messages to move assets. Polymarket has removed the compromised third-party integration. The extent of victimization and total losses are currently unknown.
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
CVE-2026-59396 is a denial-of-service vulnerability in Cloud Foundry UAA's private_key_jwt client-authentication mechanism. It arises from the handling of remote JWKS URI responses, which are cached and fully deserialized upon invalid authentication attempts. An attacker with write access to clients or a compromised endpoint can send anonymous requests that repeatedly trigger parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion, leading to service unavailability. The vulnerability affects UAA versions >=76.23.0 <79.9.0 and >=0 <60.11.0. Fixed versions are 79.9.0 and 60.11.0. The CVSS 4.0 score is 6.9 (medium severity).
CVE-2026-115456 is a low-severity vulnerability in the gcc compiler's libstdc++ library affecting Red Hat Enterprise Linux 10. It involves an out-of-bounds read triggered when std::from_chars() processes a non-null-terminated string, potentially causing application crashes or incorrect floating-point conversions. Exploitation requires an application built with libstdc++ to handle untrusted, improperly terminated input without bounds validation. There is no risk of memory corruption or code execution. Mitigation options are currently unavailable or do not meet Red Hat's criteria for deployment and stability.
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
Binance, the largest cryptocurrency exchange, suffered a record $6.3 billion crypto theft on October 29, 2026. The attack likely originated from a compromised DevOps engineer's laptop, allowing unauthorized withdrawal transactions without leaking wallet private keys. The attackers exploited multiple blockchains using valid signatures, indicating control over Binance's hot wallet signing system. Blockchain analysts attribute the attack with high confidence to North Korea's elite hacking unit, TraderTraitor. Approximately $3 billion of the stolen assets have been frozen by stablecoin issuers and security councils, while about $2.4 billion remain unfrozen. Binance is cooperating with law enforcement and has pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
A critical authorization vulnerability exists in Teltonika Networks RUTOS and TSWOS devices within specified versions. An unauthenticated user can invoke LUA functions directly, bypassing normal API validation flows, potentially leading to operating system command execution. This affects multiple device models running RUTOS versions 7.22 through 7.24.2 and TSWOS versions 1.9 through 1.10.
The npm package 'claims-acct-unlock' version 25.2.1 has been identified as malicious by the OpenSSF Package Analysis project. It is flagged because it communicates with a domain linked to malicious activity and executes commands associated with malicious behavior. This package poses a security risk to users who install or use it.