CVE-2026-7071 is a medium-severity vulnerability in CodeAstro Online Job Portal version 1.0 that allows remote attackers to expose file and directory information via manipulation of the /users/user-cvs/ file or directory. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available from the vendor. Exploitation does not require privileges or user interaction. The CVSS 4.0 base score is 6.9, reflecting network attack vector and low complexity. No known exploits in the wild have been reported.
CVE-2026-7028 is a medium severity SQL injection vulnerability in CodeAstro Online Job Portal version 1.0. It affects an unknown function in the /admin/jobs-admins/delete-jobs.php file within the All Jobs Page component. The vulnerability arises from improper handling of the ID argument, allowing remote attackers to perform SQL injection. Although an exploit has been publicly released, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
In the Linux kernel, the following vulnerability has been resolved: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask Commit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so that whenever something else modifies CR4, that bit remains set. Which in itself is a perfectly fine idea. However, there's an issue when during boot FRED is initialized: first on the BSP and later on the APs. Thus, there's a window in time when exceptions cannot be handled. This becomes particularly nasty when running as SEV-{ES,SNP} or TDX guests which, when they manage to trigger exceptions during that short window described above, triple fault due to FRED MSRs not being set up yet. See Link tag below for a much more detailed explanation of the situation. So, as a result, the commit in that Link URL tried to address this shortcoming by temporarily disabling CR4 pinning when an AP is not online yet. However, that is a problem in itself because in this case, an attack on the kernel needs to only modify the online bit - a single bit in RW memory - and then disable CR4 pinning and then disable SM*P, leading to more and worse things to happen to the system. So, instead, remove the FRED bit from the CR4 pinning mask, thus obviating the need to temporarily disable CR4 pinning. If someone manages to disable FRED when poking at CR4, then idt_invalidate() would make sure the system would crash'n'burn on the first exception triggered, which is a much better outcome security-wise.
CVE-2026-6376 is a high-severity vulnerability in SpiceJet's Online Booking System that allows unauthenticated access to full passenger booking details using only a PNR and last name. This lack of authentication on a critical function exposes extensive personal, travel, and booking metadata to anyone who can obtain or guess these inputs. The vulnerability stems from missing access control on a sensitive data retrieval feature. There is no official patch or remediation level currently documented. No known exploits are reported in the wild at this time.
CVE-2026-6375 is a high-severity vulnerability in SpiceJet's online booking system API that allows unauthenticated users to access passenger name records (PNRs) without authorization. The vulnerability arises because the API endpoint lacks proper access controls, and PNR identifiers are predictable, enabling attackers to enumerate valid records and retrieve passenger names. There is no official patch or remediation level currently provided by the vendor. No known exploits are reported in the wild at this time.
@node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchange path accepts RFC7636-invalid code_verifier values (including one-character strings) for S256 PKCE flows. Because short/weak verifiers are accepted and failed verifier attempts do not consume the authorization code, an attacker who intercepts an authorization code can brute-force code_verifier guesses online until token issuance succeeds.
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in rename commands is not sanitized for path traversal sequences. Attackers can supply a name value containing directory traversal sequences to move files from project media directories to arbitrary locations on the filesystem, potentially overwriting application files, achieving stored cross-site scripting, or combining with other vulnerabilities to achieve unauthenticated remote code execution by moving PHP code files to the application root.
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
CVE-2026-31445 is a medium severity vulnerability in the Linux kernel's mm/damon/core subsystem. It involves the use of a partially updated or corrupted damon_ctx context after a failed damon_commit_ctx() call due to internal memory allocation failure. This can lead to unexpected behaviors including potential NULL pointer dereference. The issue arises because the system may continue using a half-online-committed context that should be discarded. The fix introduces a flag to mark such corrupted contexts and prevent their further use.
A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Inventory Edit Item Page. The manipulation of the argument Item Name results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Kamerin Stokes sold stolen credentials through an online marketplace even after pleading guilty to his role in the DraftKings attack. The post Another DraftKings Hacker Sentenced to Prison appeared first on SecurityWeek .
In February 2025, BlackBasta ransomware operations ceased after their internal chat logs were leaked online, leading to disbandment. However, former affiliates continued launching attacks using different ransomware families, including the relatively unknown Payouts King group that emerged in April 2025. ThreatLabz has observed continued ransomware activity consistent with former BlackBasta initial access brokers since early 2026, utilizing similar tactics including spam bombing, Microsoft Teams phishing, and Quick Assist abuse. Payouts King implements sophisticated evasion techniques including stack-based string obfuscation, API hashing, and direct system calls to terminate security processes. The ransomware leverages 4,096-bit RSA and 256-bit AES counter mode encryption, selectively encrypting files while targeting security software and employing anti-forensics techniques like shadow copy deletion and event log clearing.
CVE-2026-5502 is a medium severity vulnerability in the Tutor LMS WordPress plugin up to version 3.9.8. It involves a missing authorization check in the tutor_update_course_content_order() function, allowing authenticated users with subscriber-level access or higher to manipulate course content order without proper permission validation. This can disrupt course structure by detaching lessons from topics, moving lessons between topics, and modifying menu order. The vulnerability arises because the function only validates a nonce but skips user permission checks when a specific parameter is omitted.
The MasterStudy LMS WordPress Plugin for Online Courses and Education contains a time-based blind SQL injection vulnerability in the /lms/stm-lms/order/items REST API endpoint. This flaw exists in versions up to and including 3.7.25 and arises from improper sanitization of the 'order' and 'orderby' parameters, allowing SQL injection via the ORDER BY clause. Authenticated users with subscriber-level access or higher can exploit this to extract sensitive database information such as user credentials and session tokens. The vulnerability is due to a design flaw in the plugin's custom Query builder class that concatenates unquoted SQL functions directly into queries. The CVSS score is 6.5 (medium severity). No official patch or remediation guidance is currently available from the vendor. No known exploits in the wild have been reported.
Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request Forgery.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.
The LearnPress WordPress plugin up to version 4.3.2.8 contains a critical vulnerability (CVE-2026-4365) due to missing authorization checks in the delete_question_answer() function. An unauthenticated attacker can exploit a publicly exposed wp_rest nonce in frontend HTML to send crafted POST requests to delete any quiz answer option without proper capability or ownership verification. This results in unauthorized data deletion with high impact on integrity and availability.