Dutch police arrested two individuals involved in a bank helpdesk fraud scheme that used NFC relay attacks to steal over $400,000 from 170 victims. The suspects called victims, played AI-generated audio impersonating banks, and persuaded them to install an app to scan their credit cards via NFC. The stolen card data was then used to withdraw money from victims' accounts at ATMs. The suspects were arrested and their infrastructure seized.
CVE-2026-105947 is a path traversal vulnerability in Innotim Software's Logsign SIEM affecting versions from 6.4.120 up to but not including 6.4.122. This flaw allows an attacker with low privileges to access files outside the intended directory, potentially leading to unauthorized disclosure of sensitive information. The vulnerability has been assigned a CVSS 3.1 score of 6.5, indicating medium severity. A fix is available in version 6.4.122.
CVE-2026-116262 is a heap-based buffer overflow vulnerability in libimobiledevice up to version 1.4.0. It occurs in the webinspector_receive_with_timeout function of the Web Inspector component. The flaw can be exploited remotely and public exploit code is available. The vendor has not responded to the disclosure. The CVSS 4.0 score rates this vulnerability as medium severity.
Frappe Builder versions before 1.36.1 have a server-side request forgery (SSRF) vulnerability in the convert_to_webp API endpoint. This endpoint lacks proper access control and performs unprotected HTTP requests that follow redirects without revalidating IP addresses. A low-privilege authenticated user can exploit this to make the server fetch internal network resources or cloud metadata endpoints. The fetched images are saved to a publicly accessible URL, enabling data exfiltration or internal network probing.
Frappe Builder versions 1.33.0 up to but not including 1.36.0 have a missing authorization vulnerability in the improve_prompt API endpoint. This flaw allows any authenticated user, except guests, to invoke large language model (LLM) completions without proper permission checks. Exploitation enables attackers to use the site owner's stored OpenRouter API key, consuming paid LLM credits and effectively turning the site into a free LLM proxy. The vulnerability is fixed in version 1.36.0.
CVE-2026-96432 is a low-severity vulnerability in the Qt Network module's QNetworkAccessManager class. It arises when a malicious or compromised HTTP/2 server withholds SETTINGS ACK, sends a RST_STREAM on a completed stream planting a null pointer, and then sends a PUSH_PROMISE for that stream. This sequence causes a null pointer dereference that crashes the application. The affected Qt versions are from 6.8.0 through 6.8.9 and 6.9.0 through 6.11.2.
CVE-2026-116261 is a medium severity vulnerability in libimobiledevice up to version 1.4.0. It involves an out-of-bounds read in the afc_file_open function of the AFC File Handler component. The flaw arises from improper handling of the argument bytes, allowing a remote attacker to trigger the issue. Public exploit code has been disclosed, but there is no indication of exploitation in the wild. The vendor has not responded to the disclosure, and no patch information is available.
V-DAP is an experimental Rust engine designed to measure cryptographic execution timing to explore whether such measurements can provide useful diagnostic information for latency issues beyond conventional observability tools. Preliminary experiments show a correlation between cryptographic timing intervals and total request latency, but the project does not claim production readiness or proven diagnostic advantage. The research is ongoing to determine if V-DAP can distinguish causes of latency and improve diagnostic accuracy compared to existing methods.
CVE-2026-94380 is a high-severity vulnerability in HAVELSAN Inc.'s Liman MYS product affecting versions from 2.3.4-1124 up to but not including 2.3.5-1131. It involves a weak password recovery mechanism that could be exploited to recover user passwords. The vulnerability has been fixed in version 2.3.5-1131.
CVE-2026-116260 is a double free vulnerability in the libimobiledevice library up to version 1.4.0, specifically in the service_receive function of the AFC Service component. The flaw can be triggered remotely and has publicly available exploit code. The vendor has not responded to the disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-116259 is a medium-severity memory corruption vulnerability in libimobiledevice up to version 1.4.0. It affects the afc_get_device_info_key function in the Device Info Handler component. The flaw is triggered by manipulating the argument Value, causing memory corruption. Exploit code has been publicly released, but exploitation requires local access. The vendor has not responded to the disclosure and no patch information is available.
CVE-2026-116258 is a heap-based buffer overflow vulnerability in libimobiledevice affecting versions 1.0 through 1.4.0. The flaw exists in the AFC component, specifically in the src/afc.c file. This vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure attempts. The CVSS 4.0 score is 5.3, indicating medium severity.
CVE-2026-89209 is an authentication bypass vulnerability in Siemens Mendix SAML modules for Mendix 9, 10, and 11 compatible versions prior to 3.6.29 and 4.2.4 respectively. The flaw allows unauthenticated remote attackers to replay valid SAML assertions in IdP-initiated authentication flows, potentially gaining unauthorized access to applications.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.
Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.
MISP Guard, a security filter for MISP feed distribution, has a case-sensitivity flaw in multiple policy enforcement checks. This flaw allows attackers with event creation privileges to bypass configured allow/block lists by altering the letter case of taxonomy tags, attribute categories, or sharing-group UUIDs. As a result, unauthorized threat intelligence data may be disclosed to downstream consumers, violating confidentiality policies.
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid for WordPress block editor: from n/a through 2.5.1.