CVE-2026-126662 is an access control bypass vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows filemount-restricted backend users with certain permissions to modify folders outside their authorized filemount via the file manager's Edit-Multiple operation. This can lead to publishing protected folders or excluding them from synchronization, potentially exposing files for public download.
BlueprintUE Self-Hosted Edition versions 1.0.0 through before 4.3.5 contain a resource exhaustion vulnerability. Unauthenticated attackers can repeatedly create anonymous blueprints with a 'never' expiration, bypassing automatic purges. This allows attackers to fill server storage, leading to denial of service. The vulnerability is fixed in version 4.3.5.
ByteStash versions 1.5.10 through before 1.6.2 have a vulnerability where API keys remain valid even after the associated user account is deactivated. This occurs because the validateApiKey function does not verify the account status, allowing continued access to API endpoints for snippet management and MCP tools.
Finite State, a product security firm, raised $27 million in a Series C funding round to expand its international presence and enhance its autonomous device security platform. The platform inspects compiled firmware and binaries to identify known and zero-day vulnerabilities in connected devices, helping manufacturers in sectors like automotive, medical, industrial, consumer electronics, and utilities. It also supports compliance with regulations such as the EU Cyber Resilience Act, FDA premarket cybersecurity requirements, UNECE vehicle regulations, and IEC 62443. The investment is driven by increased discovery of critical vulnerabilities and growing regulatory mandates. AI agents automate analysis, triage, testing, and regulatory reporting within the platform.
Apache DataSketches Java versions up to 9.0.0 contain an uncontrolled resource consumption vulnerability in the sketch deserialization process. Maliciously crafted serialized inputs can cause excessive memory allocation leading to OutOfMemoryError or cause infinite loops during deserialization or updates. This affects only applications deserializing sketches from untrusted sources. The issue is fixed in version 9.1.0.
A concurrency flaw in Keycloak's login-failure storage component affects multi-node deployments using MySQL or MariaDB. Simultaneous failed login attempts for the same user can cause a synchronization error that locks the user's database record, blocking legitimate login attempts and causing failures. Additionally, some failed attempts may not be recorded properly, potentially bypassing brute-force protection.
CVE-2026-125446 is a Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge affecting versions prior to 4.3.5. This flaw allows an attacker to trick authenticated users into performing unwanted actions on the affected application. The vulnerability is rated high severity with a CVSS score of 8.8. A fix is available in version 4.3.5.
CVE-2026-125445 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Infomaniak Network's VOD Infomaniak product up to version 1.5.16. The vulnerability allows an attacker to trick authenticated users into performing unwanted actions. A fix is available in version 1.5.17.
CVE-2026-125782 is a missing authorization vulnerability in Blubrry Podcasting PowerPress Podcasting affecting versions prior to 11.18.3. This flaw allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity score of 4.3 and does not affect confidentiality or availability. A fix is available in version 11.18.3.
Fortinet released 89 security advisories addressing nearly 100 vulnerabilities across multiple products, including FortiMail, FortiAuthenticator, FortiOS, FortiManager, FortiAnalyzer, FortiSASE, and FortiClient. Among these, approximately 17 are critical-severity flaws that could enable arbitrary code execution, authentication bypass, account takeover, and other serious impacts. No exploitation in the wild has been reported. The vulnerabilities were discovered using AI-enhanced security testing integrated by Fortinet.
CVE-2026-125435 is a vulnerability in IdeaBox Creations PowerPack Addons for Elementor (powerpack-lite-for-elementor) that allows insertion of sensitive information into sent data. This flaw affects versions from the initial release up to 3.1.3. The vulnerability could lead to unauthorized retrieval of embedded sensitive data. A fix is available in version 3.1.4.
CVE-2026-124411 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force's SureCart plugin affecting versions before 4.13.0. The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 4.13.0.
CVE-2026-124417 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress. It affects versions from initial release up to 2.7.2. The flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality. The issue is fixed in version 2.8.0.
CVE-2026-124269 is a missing authorization vulnerability in the Happy Addons for Elementor plugin by weDevs. The flaw allows exploitation due to incorrectly configured access control, affecting versions from initial releases up to 3.51.0. A fix is available in version 3.51.3. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-124262 is a medium severity vulnerability in the Igor Funa Ad Inserter plugin that allows improper neutralization of script-related HTML tags, leading to basic cross-site scripting (XSS). This affects versions prior to 2.8.20. The vulnerability can enable code injection via crafted input. A fix is available in version 2.8.20.
CVE-2026-124421 is a missing authorization vulnerability in BdThemes ZoloBlocks affecting versions before 2.8.4. It allows unauthorized access due to incorrectly configured access control security levels. The issue is fixed in version 2.8.4.
CVE-2026-124255 is a medium severity vulnerability in Franky Events Made Easy (versions before 3.3.6) involving improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue. This flaw allows code injection via crafted input. The vulnerability is fixed in version 3.3.6.
The UK National Cyber Security Centre (NCSC) has launched the Cyber Adversary Simulation (CyAS) scheme to help critical organisations rigorously test their cyber defences. The scheme certifies commercial providers who simulate realistic cyber attacks tailored to each organisation's environment, enabling them to assess their ability to prevent, detect, and respond to threats. This initiative supports national cyber resilience by providing trusted services that go beyond traditional penetration testing and audits. It complements existing NCSC frameworks and aids oversight bodies in evaluating sector-wide cyber resilience. The scheme is currently in a Minimum Viable Product phase to refine its approach before full deployment.
CVE-2026-124753 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress. It affects versions from initial releases up to 2.7.2. The flaw allows attackers with limited privileges to bypass access controls due to incorrectly configured security levels. The vulnerability has a medium severity rating with a CVSS score of 4.3. A fix is available in version 2.8.0.
CVE-2026-125680 is a stored cross-site scripting (XSS) vulnerability in Bold Themes' Bold Page Builder plugin. It affects versions from initial releases up to 5.9.11. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 5.9.12.