The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 do not verify the authenticity of payment notifications if the merchant secret is unset, which is the default configuration. This flaw allows unauthenticated attackers to forge payment confirmations and mark orders as paid without actual payment.
CVE-2026-101180 is a denial-of-service (DoS) vulnerability in a file parsing module. Exploiting this flaw can impact system availability but does not affect confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 4.3. No affected versions or patch information are currently provided.
CVE-2026-101176 is a permission control vulnerability in the event notification management module. Exploitation may impact service confidentiality. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity. No affected versions or patch information are provided.
CVE-2026-101178 is a permission control vulnerability in the autofill service module. Exploitation may lead to unauthorized disclosure of confidential service information. The vulnerability has a medium severity rating with a CVSS score of 6.6. No affected versions or patch information are provided.
A null pointer dereference vulnerability exists in the ArkWeb module. Exploitation of this flaw may cause a denial of service by affecting the availability of the affected system. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-101181 is a permission control vulnerability in the WLAN module that may lead to unauthorized disclosure of confidential information. The vulnerability does not impact integrity or availability but affects confidentiality. It has a medium severity rating with a CVSS score of 5.5. No affected versions or patches are specified in the available data.
CVE-2026-101172 is a permission control vulnerability in the graphics module. Exploiting this flaw could lead to a confidentiality breach. The vulnerability has a medium severity rating with a CVSS score of 6.2. No affected versions or patches are specified in the available data.
A code injection vulnerability exists in dayrui XunRuiCMS up to version 4.7.4 in the Mobile Site Directory component. The flaw is due to improper handling of the dirname argument in the str_replace function within /var/www/html/zzmob/index.php. This vulnerability can be exploited remotely without authentication. Public exploit code is available, and the vendor has not responded to disclosure attempts.
CVE-2026-101182 is a race condition vulnerability in the location service module. Exploitation may impact system availability. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patch information are provided.
CVE-2026-101177 is a permission control vulnerability in the Optimizer module. Exploiting this flaw may impact the confidentiality of the service. The vulnerability has a low severity rating with a CVSS score of 3.7. No affected versions or patch information are currently provided.
CVE-2025-13647 is a vulnerability in WSO2 Identity Server where improper validation of the content-type header allows attackers to craft requests that expose file paths for certificate files. This exposure could aid attackers in further compromising system confidentiality. The issue affects multiple versions of WSO2 Identity Server prior to specific fixed releases. The vulnerability has a medium severity rating and a CVSS score of 5.8.
A vulnerability in Canonical's LXD product has been addressed by Canonical. No specific technical details, impact, or affected versions are provided in the available information.
CVE-2024-7075 is a cross-site scripting (XSS) vulnerability in the user search function of the WSO2 Enterprise Integrator management console. The flaw allows attackers to inject malicious scripts that execute in the context of the console, potentially redirecting users, modifying the UI, or extracting browser information. The vulnerability does not allow session hijacking due to the httpOnly flag on session cookies. Multiple versions prior to fixed releases are affected.
Multiple heap buffer overflow vulnerabilities have been identified in libsoup3, an HTTP library used in GNOME applications. These flaws involve uninitialized length in data-URI base64 decoding and various WebSocket processing stages, including Pong signal handling, message reassembly, receive-buffer growth, client-frame masking, and permessage-deflate buffer growth. Red Hat has issued an important security update addressing these issues in Red Hat Enterprise Linux 10.0 Extended Update Support.
The FBI has attributed the $6 billion Binance cryptocurrency heist to North Korea’s state-sponsored hacking group TraderTraitor. The attackers compromised Binance’s infrastructure, including multiple breach points beyond an initially suspected compromised laptop, and rapidly emptied hot wallets across multiple blockchains. The stolen funds are being laundered primarily into Ethereum and then through decentralized finance (DeFi) and instant swap services. The FBI has identified over 600 cryptocurrency addresses linked to the theft and is coordinating with industry partners to block transactions from these addresses. Binance has pledged to cover all losses and has already replaced about 95% of the stolen funds using company resources. The laundering activity appears to be highly automated, with continuous fund movements across numerous addresses and chains.
CVE-2026-107457 is a low-severity memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. It occurs under certain MQTT 5 connection settings between client and server and may cause application crashes due to out-of-bounds writes.
Ivanti released patches for two additional zero-day vulnerabilities, CVE-2026-111357 and CVE-2026-118527, in its Connect Secure VPN product. These flaws were exploited in combination with a previously disclosed authentication bypass (CVE-2026-104935) in targeted attacks. The vulnerabilities affect versions 25.1.1.2 and earlier, and 22.8R2.5 and earlier, with fixes available in versions 25.1.1.3 and 22.8R2.6. The chained exploitation allowed attackers to achieve unauthenticated root-level code execution on fully patched ICS appliances, primarily for credential theft and data exfiltration. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch promptly.
The scdn-jquery npm package version 0.1.6 contains obfuscated malicious code in the file libs/18.2.0.js. This code loads a remote script that inserts an invisible iframe to deliver iOS-specific exploit code based on the visitor's device version. The malicious loader executes in the browser when the script is served, masquerading as jQuery. There is no evidence of malicious code execution during npm installation.
CVE-2026-18199 is a high-severity vulnerability in Zohocorp ManageEngine Password Manager Pro and PAM360 that allows authenticated users to execute arbitrary OS commands remotely. The flaw exists in versions prior to 13236 for Password Manager Pro and prior to 8601 for PAM360. This vulnerability is classified as CWE-78, indicating OS command injection. It has a CVSS v3.1 score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.
CVE-2026-101184 is a permission control vulnerability in the Bluetooth module of Huawei HarmonyOS. Exploitation of this flaw may impact system availability but does not affect confidentiality or integrity. The vulnerability affects multiple specific versions of HarmonyOS. The CVSS score is 5.5, indicating a medium severity level.