CVE-2026-118871 is a SQL injection vulnerability in ZTE ElasticNet RNIA R18 NGI that allows authenticated attackers to steal database information. The vulnerability requires the attacker to be logged in and has a medium severity rating with a CVSS score of 6.5.
Polymarket experienced a supply chain attack via a compromised third-party provider, DebugBear, whose DNS records were hijacked through its domain registrar. Malicious JavaScript served from DebugBear's address was injected into Polymarket's site, targeting logged-in traders to manipulate their portfolios by dumping positions or transferring assets to attacker-controlled wallets. Approximately 726 wallets were affected, with Polymarket returning a total of $3.9 million to traders, covering stolen funds and losses from trading halts. DebugBear's internal systems were not compromised, and the attack appears to have targeted a single customer. The investigation is ongoing, and law enforcement is involved.
A security vulnerability in the perl-HTTP-Daemon package allows arbitrary code execution via OS command injection in the send_file() function. This affects the HTTP::Daemon class, which is used as an HTTP/1.1 server listening on sockets. The issue is tracked as CVE-2026-8450 and has been rated with a high severity impact by Red Hat. A security update is available for Red Hat Enterprise Linux 9.6 Extended Update Support to address this vulnerability.
CVE-2026-107457 is a memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. It occurs under certain MQTT 5 connection settings between client and server and may cause the application to crash.
A denial of service (DoS) vulnerability exists in the DSoftBus module. Exploiting this flaw could impact system availability by causing service disruption. No specific affected versions or patch information are provided.
CVE-2026-101186 is a denial-of-service (DoS) vulnerability in the window module. Exploiting this vulnerability can disrupt the availability of the affected system or service. No specific affected versions or patch information are provided.
A denial-of-service (DoS) vulnerability exists in the DSoftBus module. Exploitation of this flaw can impact system availability but does not affect confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 5.7.
Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 contain an authenticated remote code execution vulnerability. This flaw allows an authenticated user to execute arbitrary code on the affected systems without requiring user interaction. The vulnerability has a high severity score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
CVE-2026-101171 is a permission control vulnerability in the background task management module. Exploiting this flaw may impact service integrity. The vulnerability has a low severity score and does not affect confidentiality or availability. No affected versions or patches are specified.
CVE-2026-101170 is a denial-of-service (DoS) vulnerability in a file parsing module that may impact system availability if successfully exploited. The vulnerability does not affect confidentiality or integrity. It has a medium severity rating with a CVSS score of 4. No affected versions or patch information are provided.
CVE-2026-101184 is a permission control vulnerability in the Bluetooth module that may impact system availability if exploited. It has a medium severity rating with a CVSS score of 5.5. No affected versions or patch information are provided.
An out-of-bounds (OOB) read vulnerability exists in the peripheral module. Exploitation of this flaw may compromise service confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patch information are provided.
CVE-2026-101183 is a use-after-free (UAF) vulnerability in the location service module. Exploiting this flaw may impact system availability. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patch information are provided.
CVE-2026-101179 is a buffer overflow vulnerability in the file preview module. Exploitation may impact system availability. The vulnerability has a medium severity score of 4.7 and does not affect confidentiality or integrity. No affected versions or patch information are provided.
The PayHere Payment Gateway WordPress plugin versions 2.4.0 through 2.4.5 do not verify the authenticity of payment notifications if the merchant secret is unset, which is the default configuration. This flaw allows unauthenticated attackers to forge payment confirmations and mark orders as paid without actual payment.
CVE-2026-101180 is a denial-of-service (DoS) vulnerability in a file parsing module. Exploiting this flaw can impact system availability but does not affect confidentiality or integrity. The vulnerability has a medium severity rating with a CVSS score of 4.3. No affected versions or patch information are currently provided.
CVE-2026-101176 is a permission control vulnerability in the event notification management module. Exploitation may impact service confidentiality. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity. No affected versions or patch information are provided.
CVE-2026-101178 is a permission control vulnerability in the autofill service module. Exploitation may lead to unauthorized disclosure of confidential service information. The vulnerability has a medium severity rating with a CVSS score of 6.6. No affected versions or patch information are provided.