CVE-2026-124636 is a path traversal vulnerability in kevquirk PureBlog versions 3.7.0 through 3.7.2. The flaw exists in the save_page function within includes/lib/content.php of the Page Editor component. An attacker can manipulate the page slug argument to perform path traversal, potentially accessing unauthorized files. Remote exploitation is possible. The issue is fixed in version 3.7.3.
Online fashion retailer Revolve experienced a data breach in September 2026 affecting over 1.5 million individuals. An unauthorized party accessed some of Revolve's systems, including its e-commerce platform, potentially using automated methods to collect customer names, contact information, mailing addresses, and stored payment card numbers with expiration dates. The breach impacted customers who had stored payment methods in their online accounts. Revolve reported the incident to federal law enforcement and engaged external cybersecurity experts for response. The company has not disclosed the exact method of intrusion, and no hacker group has claimed responsibility.
CVE-2026-124635 is a vulnerability in kevquirk PureBlog versions 3.7.0 through 3.7.2 affecting the admin/upload-image.php component. It allows remote attackers to perform unrestricted file uploads. The issue is resolved in version 3.7.3, which should be applied to mitigate the risk.
CVE-2026-124625 is a SQL injection vulnerability in PipraPay version 3.0.0 affecting the deleteData function in the Admin Panel component. The vulnerability arises from improper handling of the selected_ids/ItemID argument, allowing remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed and exploit code may be available. No official response or patch has been issued by the vendor yet.
CVE-2026-121841 is a moderate impact vulnerability described as 'Other issue' in Firefox for iOS. It was fixed in Firefox for iOS version 160.0. The specific technical details of the vulnerability are not provided in the advisory.
CVE-2026-16283 is an OS command injection vulnerability in Osbil Technology Ltd.'s oPanel software. The flaw arises from improper neutralization of special elements used in OS commands, allowing an attacker with limited privileges to execute arbitrary commands on the affected system. This vulnerability affects oPanel versions before 1.20.66. A fix is available starting from version 1.20.66.
pdfmake versions from 0.3.0-beta.1 up to but not including 0.3.14 have a vulnerability involving shared resource caching. This flaw allows attackers to access cached resources across different documents by exploiting a process-wide virtual file system that keys only by URL, without enforcing request headers or per-document access controls. As a result, attackers can retrieve resources fetched with other users' credentials or from URLs that would normally be restricted by access policies, leading to cross-document information disclosure and bypass of URL access restrictions. The issue is fixed in version 0.3.14.
The npm package '@massnerder/x402-scraper-mcp' version 1.0.0 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as malware within the software supply chain.
CVE-2026-124624 is a vulnerability in PipraPay version 3.0.0 involving hard-coded credentials in the hash_hmac function within the pp-token anti-CSRF handler component. This weakness allows remote attackers to exploit the hard-coded credentials. The vulnerability has a medium severity rating with a CVSS score of 6.9. Public exploit code is available, but no official response or patch has been provided by the vendor as of the publication date.
Threat actors are exploiting a chain of four vulnerabilities known as Plex2Shell in the Plex Media Server application on QNAP NAS devices. These vulnerabilities allow attackers to execute arbitrary code with Plex service privileges without requiring valid credentials. The vulnerabilities were patched in Plex Media Server version 1.43.3. QNAP NAS operating systems themselves are not affected. Users are advised to update Plex Media Server promptly and take additional precautions to secure remote access.
CVE-2026-119613 is a vulnerability in ash-project's ash_ai versions 1.5.0 up to but not including 1.5.1. It allows an attacker calling an AshAi tool to obtain internal error details, such as module names and data values, by causing a tool call to fail. The issue arises because error messages include sensitive information from exceptions or inspected error terms, which are sent directly to clients and the model without logging. The vulnerability is fixed in version 1.5.1 by logging errors under an error ID and returning only that ID to the caller.
A use of uninitialized memory vulnerability exists in the GStreamer gst-plugins-bad package's H.265 bitstream parser when processing Video Parameter Sets with multiple HRD parameter sets. This flaw can be triggered by a crafted H.265 media file or stream, causing unpredictable parser behavior and potentially crashing applications using GStreamer for H.265 playback, resulting in denial of service.
A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.
CVE-2026-119610 is a vulnerability in GStreamer's gst-plugins-good H.264 RTP depayloader element affecting multi-time aggregation RTP packets (MTAP16/MTAP24). A signed/unsigned integer conversion error can cause an out-of-bounds heap read of up to 64 KiB when processing truncated packets. This can lead to denial of service by crashing the GStreamer pipeline and potentially leaking adjacent heap memory in relay or transcoding scenarios where output is attacker-accessible. The flaw is present in upstream gst-plugins-good starting from version 1.28.0. Red Hat Enterprise Linux 10 currently ships versions below 1.28.0 and is expected not to include the vulnerable code path until a future rebase. Fedora 44 is affected pending confirmation. Mitigations include blocking untrusted H.264 RTP streams at the network perimeter or avoiding the vulnerable element for untrusted sources.
CVE-2026-124623 is a medium severity vulnerability in PipraPay version 3.0.0. It affects the system-settings-import function in the ZIP Archive Handler component, allowing an attacker to perform unrestricted file uploads remotely. The vulnerability has a CVSS 4.0 base score of 5.1. Public exploit code is available, but no official patch or vendor response has been reported yet.