The FulcrumSec extortion group claims to have stolen approximately 86 GB of data from Manchester Airports Group (MAG), which operates major UK airports including Manchester, London Stansted, and East Midlands. The compromised data includes customer information related to car park, lounge, and Fast Track bookings, as well as in-airport Wi-Fi sign-ups. MAG confirmed that email addresses, phone numbers, vehicle registrations, and postcodes were accessed, but no payment information or passenger safety data was affected. The breach was contained quickly with no operational disruption reported. MAG disclosed the incident publicly and is cooperating with authorities. FulcrumSec has threatened to leak the stolen data online.
CVE-2026-82615 is a SQL injection vulnerability in itsourcecode Online Medicine Delivery System version 1.0. It affects the Customer::find_phone function in the /passwordrecover.php file of the Password Recovery Interface component. The vulnerability allows remote attackers to manipulate the phonenumber argument to perform SQL injection. The exploit has been publicly disclosed but there is no confirmed patch or official remediation available.
A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the component Product Category Filter Interface. Executing a manipulation of the argument Category can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVE-2026-82613 is a medium severity SQL injection vulnerability in itsourcecode Online Medicine Delivery System version 1.0. It affects the loadResultList function in the Product Search Interface component, specifically in the /index.php?q=product file. The vulnerability allows remote attackers to manipulate the Search argument to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.
CVE-2026-82612 is a SQL injection vulnerability in itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the loadResultList function of the /index.php?q=single-item file on the Product Detail Page component. An attacker can remotely manipulate the ID argument to execute unauthorized SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code has been disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-82611 is a SQL injection vulnerability in the itsourcecode Online Medicine Delivery System version 1.0. It affects the Customer::cusAuthentication function in the /login.php file of the Customer Login Interface component. The vulnerability allows remote attackers to manipulate the U_USERNAME argument to perform SQL injection. Exploit code is publicly available, but no known exploits in the wild have been reported.
CVE-2026-82610 is a SQL injection vulnerability in the itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the Employee::employeeAuthentication function within the /rider/login.php file, where manipulation of the emp_email argument allows injection. The vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.
CVE-2026-77010 is a medium severity vulnerability in the HEL Online Classroom WordPress plugin version 1.0.3 and earlier. The plugin fails to perform proper authorization checks on its REST API routes and does not consistently enforce per-class access codes. This allows unauthenticated users to obtain signed meeting join links for any classroom, including those protected by access codes, and join with moderator privileges.
CVE-2026-77008 is a medium severity vulnerability in the HEL Online Classroom WordPress plugin (up to version 1.0.3). It allows unauthenticated users to overwrite plugin settings without any authorization or authentication checks. This includes the ability to redirect online classrooms and change the shared secret used to sign sessions.
The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress before version 1.6.3 contains an improper access control vulnerability. This flaw allows unauthenticated users to confirm paid appointments at a fraction of the intended price because the plugin does not verify the amount paid against the server-side price during online payment confirmation.
An incorrect access control vulnerability exists in the getOnlineClient function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. This flaw allows unauthenticated attackers to obtain online client information by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No CVSS score or detailed impact metrics are provided. There is no information on available patches or vendor advisories. No known exploits in the wild have been reported.
Tutor LMS plugin for WordPress up to version 4.0.5 contains a vulnerability allowing unauthenticated remote code execution via the tutor_course_filter_ajax AJAX action. This occurs due to missing authorization and unsanitized input passed to extract(), enabling attackers to invoke arbitrary zero-argument PHP functions. The flaw also allows creation of persistent subscriber-level accounts via WordPress core edit_user().
SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php?action=login2 endpoint. The vulnerability arises from improper handling of the 'email' parameter, allowing remote attackers to inject SQL code. This issue has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it finds on disk and in memory before we move on to relinking the truly lost inodes back into the unlinked list. However, it's still vulnerable to infinite loops that come in via the next_unlinked pointers. Fix this problem by remembering which inodes we've already seen and checking new agino pointers against that. If a bit is already set, either this is a loop or the inode has nonzero link count. We'll deal with the second case in a subsequent patch.