The ShinyHunters extortion group claims to have breached the Florida Department of Motor Vehicles' online platform known as "DAVID," stealing over 200,000 driver records. This breach involves unauthorized access to sensitive personal information of Florida drivers. No specific technical details about the vulnerability or attack vector are provided. There is no information on whether the breach has been officially confirmed or if remediation steps have been taken. No patch or fix details are available. The incident affects Florida residents whose data is stored in the DAVID DMV database. The severity is assessed as high due to the exposure of a large volume of sensitive personal data.
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.
Mathspace, an online mathematics platform, suffered a data breach impacting over 1 million individuals due to exploitation of a critical SQL injection vulnerability (CVE-2026-72898) in its self-hosted Metabase instance. The breach involved unauthorized access and data exfiltration of personal information including names, user IDs, usernames, email addresses, and related metadata of students, teachers, staff, and parents/guardians primarily from Australia and New Zealand. No sensitive academic records, passwords, or authentication credentials were exposed. The incident was discovered weeks after exploitation began, and remediation was delayed beyond the patch release date. Mathspace has taken steps to secure the environment and is investigating the incident while notifying affected individuals.
Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. [...]
A zero-day vulnerability named StyleSmuggler in Adobe Commerce and Magento e-commerce platforms allows attackers to execute remote code and deploy a stealthy backdoor. The flaw affects Magento versions 2.4.7, 2.4.8, and 2.4.9, including installations with July and August 2026 patches. Attackers inject PHP code via Magento's template system using the 'styles' properties and trigger execution through failed payment email notifications without user interaction. The backdoor, written in Rust, disguises itself as system processes and communicates with a command-and-control server using covert channels. Adobe is expected to release a fix on September 8, 2026, but the exact patch addressing this zero-day is not yet confirmed.
CVE-2026-86290 is a medium severity SQL injection vulnerability in SourceCodester Online Voting System version 1.0. It affects the /voting/ajax.php?action=save_category endpoint by allowing remote attackers to manipulate the Category parameter to execute SQL injection. The vulnerability is publicly known with exploit code available, but no official patch or remediation has been confirmed.
CVE-2026-86238 is a cross-site scripting (XSS) vulnerability in projectworlds Online Examination System version 1.0. The vulnerability exists in an unknown function within the feedback.php file of the Feedback Form component. It allows remote attackers to manipulate the Name or Subject parameters to execute malicious scripts. The vulnerability has been publicly disclosed, but no official patch or fix information is provided.
CVE-2026-86226 is a cross-site scripting (XSS) vulnerability in Projectwolds Online Attendance System version 1.0. The flaw exists in the profile.php file where the email argument can be manipulated to execute malicious scripts. This vulnerability can be exploited remotely and requires low privileges with user interaction. The CVSS 4.0 base score is 5.1, indicating a medium severity level. No official patch or remediation information is provided.
CVE-2026-86162 is a medium severity SQL injection vulnerability in SourceCodester Online Voting System version 1.0. It affects the /ajax.php?action=login endpoint by allowing remote attackers to manipulate the Username parameter to execute SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently provided.
A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2026-86160 is a SQL injection vulnerability in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=delete_voting endpoint where manipulation of the ID parameter allows injection of SQL commands. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.
CVE-2026-86159 is a SQL injection vulnerability in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=save_user endpoint, where manipulation of the ID parameter allows injection of malicious SQL code. This vulnerability can be exploited remotely without authentication. The exploit code has been published publicly. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
This report describes an online ticket purchase scam where the seller provided apparently legitimate tickets but later canceled them. The scammer used a ProtonMail email, a now-closed TikTok account, and a phone number that is no longer active. The victim is seeking assistance to track down the scammer and has shared identifying details including a name, nationality, phone number, email, and bank account number. No technical vulnerability or exploit is detailed.
CVE-2026-85643 is a medium severity SQL injection vulnerability in code-projects Online Shopping System version 1.0. The flaw exists in the admin/adduser.php file within the mysqli_query function, where manipulation of the 'mobile' argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. An exploit has been published, but there are no known exploits in the wild. No patch or remediation information is currently provided.
In the Linux kernel, the following vulnerability has been resolved: xfs: don't livelock in scrub on a circular unlinked list LOLLM points out that online fsck can livelock if an unlinked inode list contains a loop. Use a bitmap to detect cycles.
Microsoft Exchange Online experienced an outage causing delays in sending and receiving emails from external domains, accompanied by intermittent 'Server busy' errors. The issue affected multiple mailboxes and was aggravated by anti-spam protections. Microsoft acknowledged the incident, identified contributing factors, and resolved the issue for new emails, with ongoing monitoring to confirm full resolution. No specific affected regions or user counts were disclosed.
A SQL injection vulnerability exists in the addwishlist function of the Wishlist component in itsourcecode Online Medicine Delivery System 1.0. The vulnerability is triggered by manipulation of the proid argument in the /customer/controller.php?action=addwish file. This flaw allows remote attackers with low privileges to potentially impact confidentiality, integrity, and availability of the system. The vulnerability has a CVSS 3.1 base score of 6.3, indicating medium severity.
