The ps-bool package on PyPI contains obfuscated malicious code that, upon import, exfiltrates photos and documents from Android devices to a Telegram bot. This malware targets Android platforms and is designed for data theft through file exfiltration.
CVE-2026-129259 is a cross-site scripting (XSS) vulnerability in Mereithhh VanBlog versions up to 0.54.0. The flaw exists in the Image Upload Endpoint component, specifically in the file packages/server/src/types/access/access.ts. This vulnerability allows remote attackers to execute malicious scripts via crafted input. Public exploit code is available, and the vendor has not responded to disclosure attempts.
CVE-2026-129258 is a critical vulnerability in the Tenda AC18 router firmware version 15.03.05.05_multi. It involves insufficient verification of data authenticity in the firmware upgrade handler component, specifically in the /cgi-bin/upgrade file when processing the upgradeFile argument. This flaw can be exploited remotely and public exploit code is available.
This article discusses the potential negative impact of overreliance on AI in cybersecurity. It argues that excessive dependence on AI tools may erode essential human skills such as creativity, humor, sincerity, clear communication, and critical thinking, which are vital for effective security operations. The author emphasizes that while AI can enhance productivity, it should not replace human judgment and unique problem-solving abilities.
The Shipo WordPress plugin versions 1.6 through 1.8.0 contain an authentication bypass vulnerability. The flaw arises because the authenticate_rest_user() function accepts a LOGGED_IN_COOKIE value and authenticates the user without verifying the cookie's cryptographic signature. Additionally, the intended restriction to the /wp-json/shipo/ REST API route can be bypassed by including that substring in the query string of other REST endpoints. This allows unauthenticated attackers who know a valid username to impersonate that user, including administrators, and perform privileged actions such as creating new administrator accounts.
The MemberDash plugin for WordPress contains a privilege escalation vulnerability in versions up to and including 1.8.7. This flaw allows authenticated users with subscriber-level access or higher to manipulate the user ID parameter in a way that overwrites any WordPress user's email and password, including administrators. This vulnerability arises from a mass-assignment issue in the user_account_manager() function where no proper validation or capability checks are performed on submitted data.
The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads WordPress plugin is vulnerable to an arbitrary file write vulnerability due to missing authorization checks and insufficient path validation. This flaw affects all versions up to and including 1.2.0. An unauthenticated attacker can exploit this to write files outside the intended directory, potentially leading to remote code execution if a PHP file is written in a web-accessible location.
CVE-2025-71464 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.4. The flaw occurs in the toggleEditorMode() function, which assigns source view text directly to innerHTML without proper sanitization using Angular's DomSanitizer. This allows attackers to craft HTML containing event handlers (e.g., img onerror) that execute scripts in the application's origin when users toggle between editor views.
CVE-2025-71465 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.3. The vulnerability arises because the refreshView() function writes HTML content from ngModel or reactive form controls directly to innerHTML without using Angular's DomSanitizer, bypassing default sanitization. This allows attackers to inject HTML with event-handler attributes that execute scripts in the application's origin when loaded in the editor. The issue is fixed in version 3.0.3.
Pulse versions from 5.0.17 up to but not including 6.8.0 have a missing authorization vulnerability in the /api/ai/approvals endpoints. Authenticated users with viewer-level privileges can improperly manage approval requests, including listing pending requests and approving or denying requests made by others. This flaw allows alteration of decision and audit states without proper authorization.
CVE-2026-129429 is a missing authorization vulnerability in the frappe india-payroll software versions before 16.0.4. It affects the get_employee_details, compute_tax_comparison, and set_tax_regime methods in tax_regime_selector.py. Authenticated low-privileged users can exploit this flaw to access payroll data of other employees, including base pay and earning and deduction components. They can also alter the tax regime on draft Salary Structure Assignments, potentially impacting tax withholding. The vulnerability has a high severity score of 7.1 and was fixed in version 16.0.4.
Axeloz Filesharing versions before 2.14.3 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts by embedding raw HTML or javascript: Markdown links in bundle descriptions. When recipients view the public bundle preview page, the injected script executes via Alpine x-html, potentially allowing attackers to steal the owner_token from localStorage and perform owner-scoped actions on victim bundles.
Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the SOCKS5 dissector. This flaw allows network-adjacent attackers to send crafted SOCKS5 authentication packets that cause Ettercap to read up to 255 bytes beyond the heap buffer. The leaked memory can include sensitive information printed and logged as captured credentials.
Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the dissector_mountd() function. This flaw occurs because the function validates RPC credential and directory lengths independently rather than against the packet boundary, allowing an attacker to read up to 100 bytes beyond the heap buffer. The vulnerability can be triggered by a network-adjacent attacker sending a crafted MOUNT MNT call, potentially leaking memory contents to the console and logs.
Dokploy versions before 0.31.1 contain an OS command injection vulnerability in the getComposeContainerCommand() function. Authenticated organization members can exploit this flaw by injecting shell commands via the serviceName parameter, which is stored through backup.create or backup.update procedures. When scheduled backups run, these commands execute with root privileges due to the mounted Docker socket, allowing full host takeover. This vulnerability is critical and has been fixed in version 0.31.1.
Cervantes version v1.3-beta contains a stored cross-site scripting (XSS) vulnerability via avatar upload combined with an authentication bypass in the /Attachments endpoint. This flaw could allow an attacker to execute arbitrary code in another user's browser with elevated privileges, potentially leading to account takeover (ATO). The vulnerability has a high severity rating with a CVSS score of 8.7.
JSON::XS versions from 3.0 up to but not including 4.05 for Perl have a vulnerability where reading freed stack memory can occur during serialization with allow_tags enabled. This happens when an object's FREEZE method returns values that cause the Perl stack to grow and be reallocated, leaving saved pointers referencing freed memory. The encoding process may then read this freed memory and can return undef without an error.
A critical buffer overflow vulnerability exists in the Edimax BR6478ACV2 router firmware version 1.23. The flaw is in the formPPTPSetup function within the webs file, where improper handling of the pptpUserName argument allows remote attackers to trigger a buffer overflow. Public exploit code has been disclosed, and the vendor has not responded to the vulnerability report.
JSON::XS versions before 4.05 for Perl contain a vulnerability in the decode_str function where rejected long strings leak decoded data. This occurs because decoded string parts are stored in fixed-size buffers that are not freed upon rejection due to control characters, invalid escapes, malformed UTF-8, or premature end of input. A process that continues running after such failed decodes retains these leaked string parts, potentially exhausting memory over repeated requests.
A vulnerability in JSON::XS for Perl versions before 4.05 allows an attacker to cause stack exhaustion by crafting nested tagged values when using the allow_tags feature in decode_tag. This leads to an uncatchable segmentation fault due to C stack exhaustion, bypassing the max_depth protection.