NullHub versions up to and including 2026.5.29 have a critical missing authentication vulnerability. This flaw allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers can send requests without Authorization or Origin headers to non-loopback listeners and gain control over agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.
A vulnerability in the Linux kernel's RDMA/efa subsystem was fixed by ensuring that EQ resources remain alive while the IRQ handler is registered. The issue involved the IRQ handler accessing EQ state and DMA buffers before they were fully initialized or after they were freed, causing potential use-after-free conditions. The fix involved changing the initialization and teardown order to properly synchronize resource management.
CVE-2026-98428 addresses a use-after-free (UAF) vulnerability in the Linux kernel's ALSA USB 6fire driver. The issue arises because the driver uses embedded USB Request Blocks (URBs) in various structs, which is problematic due to asynchronous release and reference counting. The fix replaces embedded URBs with dynamically allocated URBs using usb_alloc_urb(), eliminating the risk of UAF. No functional changes were introduced, only memory management improvements.
A phishing campaign distributes the AgentTesla infostealer via emails pretending to be business proposals. The attached ZIP file contains a malicious executable disguised as a café management program with Chinese-language UI. The malware uses multi-stage obfuscation and .NET payload loading to ultimately deploy AgentTesla, which steals credentials, cookies, and contact information from browsers, email clients, FTP, and VPN applications. Stolen data is exfiltrated through FTP to a compromised server. The attack targets business users using social engineering and sophisticated loading techniques.
A vulnerability in the Linux kernel's drm/xe component allows asynchronous dropping of runtime power management (PM) references during virtual machine (VM) teardown. This can cause the device to autosuspend while stale page faults from the now-terminated VM are still queued, leading to assertion failures and warnings when the page-fault worker attempts to acknowledge these faults on a suspended device. The issue is addressed by holding a runtime PM reference across the entire pagefault queue worker to prevent device autosuspension during fault processing.
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.0 contains a critical privilege escalation vulnerability. An unauthenticated attacker can exploit a missing capability check in an AJAX action and a flawed exclusion list in user meta saving to create a new Administrator-level account. The required nonce is publicly exposed on all front-end pages, making exploitation trivial. This vulnerability allows full control over the WordPress site without authentication.
Google Chrome and Mozilla Firefox released updates addressing a total of 114 security vulnerabilities, including multiple critical and high-severity use-after-free bugs. Mozilla also introduced Firefox Enterprise, a browser tailored for organizations with strict security and compliance needs, featuring enhanced management controls. The updates fix issues such as buffer overflows, sandbox escapes, privilege escalations, information disclosures, and other memory corruption bugs. No active exploits in the wild have been reported for these vulnerabilities. The patches are included in Chrome versions 155.0.8059.79/.80 and Firefox 158, along with related Thunderbird and Firefox ESR releases.
In Q3 2026, attackers targeted Windows-based MS-SQL and MySQL database servers using brute-force, dictionary attacks, and vulnerability exploitation. They deployed cryptocurrency miners (XMRig), backdoors (GotoHTTP), SoftEther VPN infrastructure, and various web shells for persistence. Additional tools included VShell for remote command execution, HackBrowserData for credential theft, Fscan for reconnaissance, and Cloudflared for port exposure. Attackers created backdoor RDP accounts and used SoftEther VPN servers as command and control infrastructure. The attacks mainly exploited weak passwords, poor account management, and insufficient security on exposed database servers.
CVE-2026-90989 is an information exposure vulnerability in the Tainacan WordPress plugin versions before 1.4.0. The plugin's reports REST endpoints do not restrict access to users with management capabilities, allowing any authenticated subscriber to read email addresses of the repository's staff. This vulnerability has a medium severity with a CVSS score of 4.3.
The Membership & User Roles for WooCommerce (Automatic Role Changer) WordPress plugin contains a privilege escalation vulnerability in versions up to and including 20260828. This flaw allows authenticated users with subscriber-level access or higher to regain previously revoked Administrator roles by exploiting the plugin's role cache mechanism. Exploitation requires the Replace Roles mode to be enabled and that the attacker’s account had legitimately held the Administrator role before revocation. The vulnerability stems from the plugin unconditionally re-assigning cached roles without verifying their current validity from the external provider.
The Bit integrations plugin for WordPress (versions up to and including 2.10.6) contains a privilege escalation vulnerability. This flaw allows unauthenticated attackers to overwrite the administrator's password and take over the admin account. The issue arises because attacker-controlled data is stored without validation and later replayed in an administrator session, enabling password changes without proper authorization. Exploitation requires specific plugin configuration and an administrator to re-execute a logged failure.
CVE-2026-108473 is a high-severity vulnerability in TP-Link Systems Inc. HS103 v5 devices involving missing authentication for critical functions in the local device-management protocol. An unauthenticated attacker on an adjacent network can send management commands without proper authentication, potentially modifying device state or settings. Additionally, under certain conditions involving user, mobile app, and cloud interactions, account-related information may be exposed, risking cloud account compromise.
Multiple vulnerabilities have been identified in various Microsoft development tools and frameworks, including .NET, ASP.NET, Visual Studio, Visual Studio Code, SysInternals Suite, and PowerShell. These tools are widely used for application development, system management, and automation. The specific details of the vulnerabilities, their impact, and remediation status are not provided in the available data.
Komodo versions from 1.19.1 up to but not including 2.3.0 contain an OS command injection vulnerability in the periphery agent's container-management functionality. Authenticated users with specific low-level permissions can inject shell metacharacters in container names, leading to arbitrary command execution as root on the managed host. This allows privilege escalation without requiring Terminal permission.
Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.