A vulnerability in CoolerMaster MASTERPLUS+ 1.9.6 affects the Device Driver component WinRing0x64.sys, specifically the function sub_11504. The flaw involves improper handling of the PhysicalAddress argument, resulting in incorrect default permissions. Exploitation requires local access. The vendor has not responded to disclosure attempts, and no patch information is available.
A cross-site scripting (XSS) vulnerability exists in Opixido OCMS in the admin/TUI/index.php component due to improper handling of the 'img' argument. This flaw allows remote attackers to inject malicious scripts. The product uses continuous delivery with rolling releases, so specific affected or fixed versions are not available. The vendor did not respond to early disclosure attempts. Exploit code has been published. The CVSS score is 4.3, indicating medium severity.
The gateio-client package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The ps-bool package on PyPI contains obfuscated malicious code that, upon import, exfiltrates photos and documents from Android devices to a Telegram bot. This malware targets Android platforms and is designed for data theft through file exfiltration.
CVE-2026-129259 is a cross-site scripting (XSS) vulnerability in Mereithhh VanBlog versions up to 0.54.0. The flaw exists in the Image Upload Endpoint component, specifically in the file packages/server/src/types/access/access.ts. This vulnerability allows remote attackers to execute malicious scripts via crafted input. Public exploit code is available, and the vendor has not responded to disclosure attempts.
CVE-2026-129258 is a critical vulnerability in the Tenda AC18 router firmware version 15.03.05.05_multi. It involves insufficient verification of data authenticity in the firmware upgrade handler component, specifically in the /cgi-bin/upgrade file when processing the upgradeFile argument. This flaw can be exploited remotely and public exploit code is available.
This article discusses the potential negative impact of overreliance on AI in cybersecurity. It argues that excessive dependence on AI tools may erode essential human skills such as creativity, humor, sincerity, clear communication, and critical thinking, which are vital for effective security operations. The author emphasizes that while AI can enhance productivity, it should not replace human judgment and unique problem-solving abilities.
The Shipo WordPress plugin versions 1.6 through 1.8.0 contain an authentication bypass vulnerability. The flaw arises because the authenticate_rest_user() function accepts a LOGGED_IN_COOKIE value and authenticates the user without verifying the cookie's cryptographic signature. Additionally, the intended restriction to the /wp-json/shipo/ REST API route can be bypassed by including that substring in the query string of other REST endpoints. This allows unauthenticated attackers who know a valid username to impersonate that user, including administrators, and perform privileged actions such as creating new administrator accounts.
The MemberDash plugin for WordPress contains a privilege escalation vulnerability in versions up to and including 1.8.7. This flaw allows authenticated users with subscriber-level access or higher to manipulate the user ID parameter in a way that overwrites any WordPress user's email and password, including administrators. This vulnerability arises from a mass-assignment issue in the user_account_manager() function where no proper validation or capability checks are performed on submitted data.
The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads WordPress plugin is vulnerable to an arbitrary file write vulnerability due to missing authorization checks and insufficient path validation. This flaw affects all versions up to and including 1.2.0. An unauthenticated attacker can exploit this to write files outside the intended directory, potentially leading to remote code execution if a PHP file is written in a web-accessible location.
CVE-2025-71464 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.4. The flaw occurs in the toggleEditorMode() function, which assigns source view text directly to innerHTML without proper sanitization using Angular's DomSanitizer. This allows attackers to craft HTML containing event handlers (e.g., img onerror) that execute scripts in the application's origin when users toggle between editor views.
CVE-2025-71465 is a cross-site scripting (XSS) vulnerability in the kolkov/angular-editor component before version 3.0.3. The vulnerability arises because the refreshView() function writes HTML content from ngModel or reactive form controls directly to innerHTML without using Angular's DomSanitizer, bypassing default sanitization. This allows attackers to inject HTML with event-handler attributes that execute scripts in the application's origin when loaded in the editor. The issue is fixed in version 3.0.3.
Pulse versions from 5.0.17 up to but not including 6.8.0 have a missing authorization vulnerability in the /api/ai/approvals endpoints. Authenticated users with viewer-level privileges can improperly manage approval requests, including listing pending requests and approving or denying requests made by others. This flaw allows alteration of decision and audit states without proper authorization.
CVE-2026-129429 is a missing authorization vulnerability in the frappe india-payroll software versions before 16.0.4. It affects the get_employee_details, compute_tax_comparison, and set_tax_regime methods in tax_regime_selector.py. Authenticated low-privileged users can exploit this flaw to access payroll data of other employees, including base pay and earning and deduction components. They can also alter the tax regime on draft Salary Structure Assignments, potentially impacting tax withholding. The vulnerability has a high severity score of 7.1 and was fixed in version 16.0.4.
Axeloz Filesharing versions before 2.14.3 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts by embedding raw HTML or javascript: Markdown links in bundle descriptions. When recipients view the public bundle preview page, the injected script executes via Alpine x-html, potentially allowing attackers to steal the owner_token from localStorage and perform owner-scoped actions on victim bundles.
Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the SOCKS5 dissector. This flaw allows network-adjacent attackers to send crafted SOCKS5 authentication packets that cause Ettercap to read up to 255 bytes beyond the heap buffer. The leaked memory can include sensitive information printed and logged as captured credentials.
Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the dissector_mountd() function. This flaw occurs because the function validates RPC credential and directory lengths independently rather than against the packet boundary, allowing an attacker to read up to 100 bytes beyond the heap buffer. The vulnerability can be triggered by a network-adjacent attacker sending a crafted MOUNT MNT call, potentially leaking memory contents to the console and logs.