CVE-2026-107157 is an out-of-bounds read vulnerability in the Qt Framework's QCborValue::fromCbor() function. It affects multiple versions of Qt from 5.12.0 through 6.8.8 and from 6.9.0 through 6.11.2. The vulnerability has a low CVSS score of 2.0, indicating limited impact and exploitability. There are no known exploits in the wild, and no official patch information is provided in the available data.
An Open Redirect vulnerability (CWE-601) exists in Mautic's public form submission endpoint (/form/submit). After submitting a form, the application redirects users to a return URL supplied in the submission without verifying if it points to a trusted host. This allows unauthenticated attackers to redirect visitors from a legitimate Mautic domain to arbitrary external sites, potentially phishing or malware sites. The vulnerability affects Mautic versions >=1.0.0-beta <5.2.12, >=6.0.0 <6.0.10, and >=7.0.0 <7.2.2. Fixed versions are 5.2.12, 6.0.10, and 7.2.2.
CVE-2026-115195 is a broken access control vulnerability in the Mautic Stats API endpoint (/api/stats/{table}) that allows any authenticated API user to read data from internal tables without proper authorization. This includes sensitive information such as application audit logs, user actions, contact personal data, visitor IP addresses with geolocation, and tracked redirect URLs. The flaw exists because administrator-only restrictions were never enforced and tables without explicit permission mappings were readable by default. The vulnerability affects multiple Mautic core versions and has been fixed in versions 5.2.12, 6.0.10, and 7.2.2.
CVE-2026-115194 is a path traversal vulnerability in the Mautic Asset API that allows an authenticated user with asset creation permissions to register and publish arbitrary files readable by the web server. This results in unauthorized disclosure of sensitive files, including configuration files containing database and SMTP credentials, via a public URL without authentication.
A long-running malware campaign has infected 953 online stores, primarily Magento-based, with loader code that selectively serves malicious payloads to real visitors to evade detection. The campaign began in July 2025 and has used multiple domains for its JavaScript loader, with recent activity observed as late as October 2026. The loader performs visitor fingerprinting and has been delivered through exploitation of known Magento vulnerabilities and backdoors. Store owners are advised to check for loader code, vulnerabilities, backdoors, rogue admin accounts, and to apply the latest patches and security measures.
A stored Cross-Site Scripting (XSS) vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2 allows an attacker to inject malicious scripts via HTML-type custom contact fields. When an affected contact's detail page is viewed, the script executes in the context of the viewer's browser session, potentially enabling administrative actions such as creating admin accounts or accessing sensitive data. This vulnerability is fixed in version 7.2.2.
CVE-2026-115192 is an SQL Injection vulnerability in the Mautic core dashboard widget data API endpoint (/api/data/{type}). It allows an authenticated user with API access to inject SQL via chart filter parameters that are not properly validated. Exploitation can lead to unauthorized reading of arbitrary database data, including sensitive contact, marketing, and user account information with password hashes. The vulnerability does not allow data modification but can be used to degrade database query performance, impacting availability. Exploitation requires the Mautic API to be enabled.
Kameleo versions up to 5.0.1.19 contain a server-side request forgery (SSRF) vulnerability in the InternalController.TestProxy function of the Proxy Validation component. This vulnerability allows remote attackers to manipulate host and port arguments to induce SSRF. The issue is addressed in version 5.2.0, where the vulnerable route was removed and replaced.
CVE-2026-115191 is a SQL injection vulnerability in the Mautic administration interface's contact lookup AJAX endpoint (/s/ajax). It allows any authenticated user, regardless of role or permissions, to execute arbitrary SQL queries on the Mautic database by exploiting improper validation of a request parameter. This can lead to unauthorized reading of sensitive data such as user accounts, password hashes, contact information, and campaign content. The vulnerability affects multiple Mautic core versions and has been assigned a high severity rating.
CVE-2026-115190 is a high-severity deserialization vulnerability in Mautic's core affecting versions >=2.15.2 <5.2.12, >=6.0.0 <6.0.10, and >=7.0.0 <7.2.0. It involves insecure deserialization of PHP objects from segment filters and custom field properties, allowing an attacker with write privileges to inject crafted serialized data. This can lead to arbitrary code execution, data disclosure, modification, or deletion, and impact availability. The vulnerability is fixed in versions 5.2.12, 6.0.10, and 7.2.0.
CVE-2026-115189 is a server-side template injection vulnerability in Mautic's Twig theme rendering sandbox. The sandbox, intended to restrict user-uploaded theme templates, does not fully enforce restrictions, allowing an authenticated user with core:themes:create permission to upload a malicious theme. This can lead to arbitrary code execution on the server with web server privileges, including OS command execution, file read/write, and access to internal services. The vulnerability affects multiple Mautic versions prior to fixed releases.
CVE-2026-115188 is a critical unrestricted file upload vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2. It affects the campaign import feature, allowing authenticated users with campaign import permissions to upload arbitrary files, including server-side scripts, to a publicly accessible media directory. This can lead to remote code execution on web servers that honor per-directory configurations, such as Apache in the official Mautic Docker image, without requiring administrator privileges.
CVE-2026-116275 is a code injection vulnerability in AllenAI AllenNLP versions 2.10.0 and 2.10.1. It affects the Registrable.resolve_class_name function in the Registrable Configuration Machinery component. The vulnerability allows remote attackers to perform code injection by manipulating the argument Type. The exploit code has been publicly disclosed. The affected versions are no longer supported by the vendor.
Frappe CRM versions before 1.89.1 have a missing authorization vulnerability in the get_contact_by_phone_number API. This flaw allows authenticated users with low privileges to query CRM Lead records they should not access by supplying a phone number, bypassing normal permission checks. The vulnerability leads to unauthorized disclosure of sensitive CRM lead data.
CVE-2026-110475 is a critical vulnerability in the CreditNirvana Collections Platform (CollectionWorkz) caused by weak authentication and authorization controls in the platform login service. An unauthenticated remote attacker can exploit this flaw to manipulate authentication requests and access APIs without a valid session. This allows the attacker to enumerate users, impersonate arbitrary users including administrators, and access or modify sensitive data with the privileges of the impersonated user.
CVE-2026-116274 is an improper authorization vulnerability in JIZHICMS versions 2.5.0 through 2.5.6. It affects the Pay function in the app/home/c/OrderController.php file, allowing remote attackers to manipulate the orderno argument to bypass authorization controls. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or issued a patch.
CVE-2026-110474 is a vulnerability in the CreditNirvana Agentic AI Call Centre application caused by a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. Using the extracted key, the attacker can make arbitrary API calls to access sensitive call transcripts and recordings through the application API.
CVE-2026-115720 is a server-side request forgery (SSRF) vulnerability in Frappe Builder versions before 1.36.1. The flaw exists in builder/api.py where the URL validation only checks the initial hostname but does not handle HTTP redirects properly, allowing attackers to redirect requests to internal or link-local addresses. An authenticated attacker can exploit this by calling the convert_to_webp endpoint, which lacks permission checks, to perform SSRF attacks, internal port scanning, or cause denial of service due to request hangs.
CVE-2026-116263 is a race condition vulnerability in HaschekSolutions PictShare versions 3.7.0 and 3.7.1, specifically in the function architect within src/inc/core.php related to file upload handling. The flaw can be exploited remotely but requires high attack complexity and is difficult to exploit. A public exploit exists. Upgrading to version 3.7.2 resolves the issue.
Dutch police arrested two individuals involved in a bank helpdesk fraud scheme that used NFC relay attacks to steal over $400,000 from 170 victims. The suspects called victims, played AI-generated audio impersonating banks, and persuaded them to install an app to scan their credit cards via NFC. The stolen card data was then used to withdraw money from victims' accounts at ATMs. The suspects were arrested and their infrastructure seized.