UgCS server versions before 6.2 have an authentication bypass vulnerability in the HCI protocol login handler on TCP port 3334. If the user database contains exactly one user, a login request with empty credentials is accepted as that user, granting a fully authenticated session. The service listens on all interfaces without TLS by default, allowing unauthenticated remote attackers with network access to port 3334 to gain privileged access, including commanding drones and uploading flight routes.
A security vulnerability exists in chenyme grok2api versions up to 3.1.6 in the STT Billing component, specifically in an unknown function within backend/internal/transport/http/inference/voice_ws_handler.go. This vulnerability allows remote attackers to enforce behavioral workflow. The issue is resolved by upgrading to version 3.1.7.
CVE-2026-71881 is a stored cross-site scripting (XSS) vulnerability in the GBIF Integrated Publishing Toolkit affecting versions before 3.3.5. Authenticated remote attackers can inject malicious code into resource metadata fields, which executes in another user's session after interaction. The vulnerability has a medium severity score of 4.8 and requires user interaction for exploitation.
CVE-2026-109469 is a critical authorization bypass vulnerability in Microsoft Entra Device Registration. It involves a user-controlled key that allows an unauthorized attacker to elevate privileges over a network. This vulnerability has a CVSS score of 10.0, indicating maximum severity. An official fix is available from Microsoft.
CVE-2026-118786 is an improper input validation vulnerability in the non-secure-callable veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example. This flaw affects versions up to 26.06.00-lts and 26.09.00, allowing a non-secure caller to supply unvalidated pointers and size values. Exploitation could lead to disclosure of secure-world memory or denial of service. The issue is fixed in versions 26.06.01-lts and 26.12.00-pvw1.
CVE-2026-118785 is an improper input validation vulnerability in the NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples. It affects versions prior to 26.06.01-lts and 26.09.00. The flaw allows a non-secure caller to supply unvalidated pointers or untrusted data, which may lead to timing side-channel attacks, TOCTOU conditions, or format-string misuse. This can potentially result in secure-world memory disclosure or denial of service. The issue has been fixed in versions 26.06.01-lts and 26.09.00.
CVE-2026-120845 is a stored cross-site scripting (XSS) vulnerability in the WPMU DEV Smush Image Compression and Optimization plugin for WordPress. The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts. This affects versions from initial release up to 4.3.5. The issue is fixed in version 4.3.6.
CVE-2026-123471 is a medium severity vulnerability in the myCred plugin affecting versions prior to 4.0.3. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability is fixed in version 4.0.3.
CVE-2026-120851 is a Missing Authorization vulnerability in the PublishPress Revisions plugin up to version 4.2.0. It allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized users with limited privileges to perform actions they should not be allowed to. The issue is fixed in version 4.3.1.
CVE-2026-119519 is a missing authorization vulnerability in WProyal Royal Elementor Addons affecting versions prior to 1.7.1069. It allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions or data. The vulnerability has a medium severity with a CVSS score of 4.3. A fix is available in version 1.7.1069.
CVE-2026-122670 is a missing authorization vulnerability in the WP SYNTEX Polylang plugin affecting versions prior to 3.9.1. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure or modification. The issue is fixed in version 3.9.1.
The npm package @cherrydotfun/miniapp-sdk versions 0.1.22 and 0.1.23 contain malicious code. Any computer with this package installed or running is considered fully compromised, potentially allowing an attacker full control. Immediate removal of the package and rotation of all secrets and keys from a different computer are strongly advised.
The PyPI package 'fhqiouhq' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location upon import. This package is identified as part of a typosquatting campaign targeting Telegram users, aiming to steal information.
The PyPI package 'ajfhiuqhfqgwerhuqnfqh' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location during import. This package is identified as part of a typosquatting campaign targeting Telegram users with clear malicious intent to steal information.