Cybercriminals exploit the popularity of ebooks by distributing malware disguised as ebook files, using search result manipulation, phishing scams, and fake pirate library sites. These attacks can lead to malware infections such as cryptocurrency miners and infostealers, data leaks including personal and financial information, and fraudulent charges via fake bookstore sites. E-readers themselves are less commonly targeted, but vulnerabilities exist in advanced models. Users' reading histories and personal data can also be exposed through data leaks or account compromises. Safe practices include using official bookstores, keeping devices and apps updated, and avoiding unofficial firmware.
CVE-2026-119291 is a vulnerability in zuke-build's zuke automation system prior to version 1.4.0. It involves improper handling of symbolic links during setup and import operations, allowing an attacker to supply a malicious repository or template with symbolic links that cause files outside the intended directory to be overwritten with the user's permissions. This can lead to unauthorized modification of files. The issue is fixed in version 1.4.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0.
CVE-2026-104615 is an authentication bypass vulnerability in SUSE Rancher Fleet's cluster registration flow affecting multiple versions before fixed releases. The flaw allows a registration request to claim a cluster identity without proper binding to the registration token, enabling association with a different managed cluster's identity. This could lead to unauthorized actions on clusters.
Zuke-build versions prior to 1.10.0 contain a vulnerability in the @zuke/gh githubWorkflow(...) gate where it insufficiently verifies the authenticity of dispatched workflow runs. The gate relies solely on a display-title marker visible in the workflow run list, which can be spoofed by an attacker with workflow_dispatch permission in an external repository. This allows an attacker to substitute a workflow run conclusion, potentially authorizing unvalidated releases or blocking valid ones. The issue is resolved in version 1.10.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0.
CVE-2026-119287 is a missing authorization vulnerability in zuke-build's zuke prior to version 1.51.0. The vulnerability allows a registry writable by another party to specify commands and arguments that can be executed with the operator's environment and workspace access when using the mcp registry mode with the --allow-run option. This issue does not affect the local default registry or descriptors that enforce authorization. The flaw is fixed in version 1.51.0.
Python's ssl module has been updated to include a denylist of known compromised intermediate certificates. This enhancement ensures that these certificates are automatically rejected, improving security even if certificate revocation is not configured. The vulnerability affects multiple Python versions prior to their respective fixed releases.
Parse Server versions before 8.6.101 and from 9.0.0 up to but not including 9.10.4 have a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to delete the stored schema of any class by sending REST API delete requests to the internal _SCHEMA collection. Such unauthorized deletions can remove field definitions, class-level permissions, and protected fields, potentially exposing data to unauthorized reads and modifications. The issue is fixed in versions 8.6.101 and 9.10.4.
Parse Server versions before 8.6.100 and from 9.0.0 up to but not including 9.10.4 allow clients to write reserved internal field names in object writes. This vulnerability enables attackers to disrupt object reads on MongoDB by injecting reserved fields, affecting all users querying that class. Additionally, attackers can clear their own account lockout state and password history, bypassing lockout and password policies.
Parse Server versions before 8.6.102 and from 9.0.0 up to but not including 9.10.5 contain an authentication bypass vulnerability. This occurs because custom AuthAdapter subclasses do not have their validateSetUp, validateLogin, and validateUpdate methods called, causing the system to fall back to a default that accepts any authentication data. This flaw allows attackers to supply arbitrary authentication data to sign up, link identities, log in as existing users, or bypass additional authentication factors.
Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5 contain a privilege escalation vulnerability in the SMS multi-factor authentication (MFA) login process. The server saves the entire login request with master privileges when issuing an SMS MFA verification code. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and from 9.0.0 up to but not including 9.10.5 contain an information disclosure vulnerability in the LiveQuery feature. The issue arises because the subscription hash omits constraints adjacent to a $or operator, causing distinct subscriptions to be grouped incorrectly. This allows authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
RT's automatic link creation for URLs in HTML ticket content does
not HTML-escape the URL it places in the link. A URL crafted to
break out of the link's address can add a script that runs when the
ticket history is displayed, with no further action by the viewer.
Anyone who can add HTML content to a ticket can plant it. That
includes an unauthenticated sender of HTML email to any queue that
grants CreateTicket or ReplyToTicket to Everyone, which is routine
for a queue that accepts mail from the public. The script runs in
the session of any user who views the ticket, and can act in RT
with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating an incident from a
report, and they render that subject without HTML escaping. A
ticket subject containing script runs it when a user opens either
form. RTIR grants everyone the right to create Incident Reports by
default, so an unauthenticated sender of an emailed report can set
that subject. The script then runs in the session of the incident
handler who creates an incident from the report or splits it, and
can act in RT with that user's authority.
The issue was fixed in version 6.0.4. RTIR 5.0 is not
affected.
A stored cross-site scripting (XSS) vulnerability exists in the Blocksy Companion plugin for Creative Themes, affecting versions up to 2.1.60. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and requiring user interaction to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A deserialization of untrusted data vulnerability exists in the SubWorkflow task of Google Cloud Application Integration versions prior to 2026-09-11. This flaw allows an authenticated attacker to execute arbitrary code by submitting a maliciously crafted serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required.
An improper access control vulnerability in the multi-factor authentication (MFA) feature of ManageEngine SharePoint Manager Plus (SPMP) allows a low-privileged authenticated user to bypass authorization checks. This enables reading and modifying MFA settings, enabling or disabling MFA, enumerating MFA-enrolled users, and deleting MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by locking out legitimate users. The issue was fixed in build 4507; the vulnerability was demonstrated in build 4506.
Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to modify another user's AI chat history by moving messages with arbitrary content if they know the victim's chat ID. The vulnerability impacts message integrity but does not affect confidentiality or availability.
WHartTest versions 2.2.0 through 2.8.1 have a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet. Authenticated users can exploit this flaw by setting the project_pk parameter to another project's ID, enabling them to access, modify, delete, or trigger scheduled tasks and read execution logs of other projects.