The Kirki plugin for WordPress versions prior to 6.2.5 has a vulnerability that allows unauthenticated attackers to bypass the reCAPTCHA verification on frontend forms. By omitting the g-recaptcha-token field in POST requests, attackers can submit forms without valid verification, leading to unlimited form submissions and triggering notification emails, webhooks, and database writes without completing reCAPTCHA validation. This issue is fixed in version 6.2.5.
This analysis discusses the security implications of passkeys as a replacement for passwords. Passkeys improve authentication security by using cryptographic credentials that are phishing-resistant and not reusable, reducing risks like credential theft and phishing. However, passkeys do not eliminate broader identity risks such as compromised account enrollment, device changes, recovery processes, or session hijacking. Attackers may target these surrounding areas rather than the authenticator itself. Continuous identity threat detection is necessary to evaluate trust beyond the moment of authentication, addressing risks throughout the identity lifecycle.
Kirki plugin for WordPress versions before 6.4.1 has a broken object-level access control vulnerability in its REST API. This flaw allows users with the Editor role, who have Kirki edit access, to modify the title, slug, and publication status of any non-trashed post, including custom post types and WooCommerce products they do not own. The vulnerability arises because the plugin relies only on a coarse role-based check without verifying per-object WordPress capabilities. This can lead to unauthorized exposure or removal of content.
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials.
This issue affects Vatos DLP: from 1.1.176 before 1.1.243.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.
The FBI seized the domain virtualine.net, used by Virtualine, a Russian-speaking bulletproof hosting provider that supported various cybercriminal activities including hack-for-hire services, ransomware, infostealers, phishing, spam, and carding. Despite law enforcement takedown requests, Virtualine continued aiding illicit customers and hosting illegal content. The provider received significant cryptocurrency payments linked to criminal operations such as drug marketplaces, sextortion schemes, and ransomware groups. Domain seizure disrupts access but does not guarantee cessation of the operator's activities or loss of infrastructure access.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery.
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page.
Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin could still call window.webkit.messageHandlers.tlsErrorPage.postMessage(...). The only authorization check compares a numeric WebKit page id that increments predictably; an attacker can burst-guess ids and approve a certificate exception with no user click.
If a victim visits malicious site A that redirects to site B with an invalid certificate, site A can, for a few milliseconds, disable TLS certificate error warnings for host B until Epiphany is restarted, enabling man-in-the-middle or site spoofing for that host.
Upstream report: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2978
Proof of concept: https://beford.net/poc/ssl_poc.html
Fix: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2245 (register handlers on LOAD_COMMITTED). No fixed release tagged yet; reporter and maintainer describe all current versions as affected. Maintainer notes the risky registration timing dates to commit 1da1caed (Epiphany 45.x era); before that the handlers were always registered and similarly reachable from web content.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
CVE-2026-119602 is a vulnerability in libmspack up to version 0.11alpha where the MS-ZIP decompressor uses uninitialized memory. This flaw allows an attacker to craft a malicious MS-ZIP CAB file that causes the decompressor to leak up to 32 KiB of stale heap memory into the extracted output. The issue arises from unchecked back-reference distances in the first block of the CAB file. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3.
AFFLIB versions up to 3.7.22 have a heap out-of-bounds write vulnerability in the af_get_page() function. This occurs when crafted AFF images use mismatched page and sector sizes, allowing memory corruption and potential crashes of forensic tools.
tcpflow versions up to 1.6.1 have an out-of-bounds read vulnerability caused by improper handling of inconsistent length parameters in IP payloads. This flaw allows unauthenticated attackers to send crafted IPv4 or IPv6 TCP packets with forged payload lengths, leading to leakage of adjacent process memory into reconstructed flow files or causing tcpflow to crash.
AxonHub versions up to 1.0.0-beta11 have a privilege escalation vulnerability that allows users with write_api_keys permission to create service_account API keys with unvalidated system-level scopes. This flaw enables unauthorized access to sensitive channel configurations via the /admin/graphql endpoint.
Miaomiaowu versions before 0.9.3 have an insecure direct object reference vulnerability in the /api/user/proxy-provider-configs endpoint. This flaw allows authenticated users to access other users' configuration data by iterating over the external_subscription_id parameter. The exposed data includes override scripts, filter rules, custom request headers, and health-check URLs. The vulnerability is fixed in version 0.9.3.