CVE-2026-116274 is an improper authorization vulnerability in JIZHICMS versions 2.5.0 through 2.5.6. It affects the Pay function in the app/home/c/OrderController.php file, allowing remote attackers to manipulate the orderno argument to bypass authorization controls. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or issued a patch.
CVE-2026-110474 is a vulnerability in the CreditNirvana Agentic AI Call Centre application caused by a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. Using the extracted key, the attacker can make arbitrary API calls to access sensitive call transcripts and recordings through the application API.
CVE-2026-115720 is a server-side request forgery (SSRF) vulnerability in Frappe Builder versions before 1.36.1. The flaw exists in builder/api.py where the URL validation only checks the initial hostname but does not handle HTTP redirects properly, allowing attackers to redirect requests to internal or link-local addresses. An authenticated attacker can exploit this by calling the convert_to_webp endpoint, which lacks permission checks, to perform SSRF attacks, internal port scanning, or cause denial of service due to request hangs.
CVE-2026-116263 is a race condition vulnerability in HaschekSolutions PictShare versions 3.7.0 and 3.7.1, specifically in the function architect within src/inc/core.php related to file upload handling. The flaw can be exploited remotely but requires high attack complexity and is difficult to exploit. A public exploit exists. Upgrading to version 3.7.2 resolves the issue.
Dutch police arrested two individuals involved in a bank helpdesk fraud scheme that used NFC relay attacks to steal over $400,000 from 170 victims. The suspects called victims, played AI-generated audio impersonating banks, and persuaded them to install an app to scan their credit cards via NFC. The stolen card data was then used to withdraw money from victims' accounts at ATMs. The suspects were arrested and their infrastructure seized.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal.
This issue affects Logsign SIEM: from 6.4.120 before 6.4.122.
CVE-2026-116262 is a heap-based buffer overflow vulnerability in libimobiledevice up to version 1.4.0. It occurs in the webinspector_receive_with_timeout function of the Web Inspector component. The flaw can be exploited remotely and public exploit code is available. The vendor has not responded to the disclosure. The CVSS 4.0 score rates this vulnerability as medium severity.
Frappe Builder versions before 1.36.1 have a server-side request forgery (SSRF) vulnerability in the convert_to_webp API endpoint. This endpoint lacks proper access control and performs unprotected HTTP requests that follow redirects without revalidating IP addresses. A low-privilege authenticated user can exploit this to make the server fetch internal network resources or cloud metadata endpoints. The fetched images are saved to a publicly accessible URL, enabling data exfiltration or internal network probing.
Frappe Builder versions 1.33.0 up to but not including 1.36.0 have a missing authorization vulnerability in the improve_prompt API endpoint. This flaw allows any authenticated user, except guests, to invoke large language model (LLM) completions without proper permission checks. Exploitation enables attackers to use the site owner's stored OpenRouter API key, consuming paid LLM credits and effectively turning the site into a free LLM proxy. The vulnerability is fixed in version 1.36.0.
A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send a PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.
CVE-2026-116261 is a medium severity vulnerability in libimobiledevice up to version 1.4.0. It involves an out-of-bounds read in the afc_file_open function of the AFC File Handler component. The flaw arises from improper handling of the argument bytes, allowing a remote attacker to trigger the issue. Public exploit code has been disclosed, but there is no indication of exploitation in the wild. The vendor has not responded to the disclosure, and no patch information is available.
V-DAP is an experimental Rust engine designed to measure cryptographic execution timing to explore whether such measurements can provide useful diagnostic information for latency issues beyond conventional observability tools. Preliminary experiments show a correlation between cryptographic timing intervals and total request latency, but the project does not claim production readiness or proven diagnostic advantage. The research is ongoing to determine if V-DAP can distinguish causes of latency and improve diagnostic accuracy compared to existing methods.
Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.
This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.
CVE-2026-116260 is a double free vulnerability in the libimobiledevice library up to version 1.4.0, specifically in the service_receive function of the AFC Service component. The flaw can be triggered remotely and has publicly available exploit code. The vendor has not responded to the disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-116259 is a medium-severity memory corruption vulnerability in libimobiledevice up to version 1.4.0. It affects the afc_get_device_info_key function in the Device Info Handler component. The flaw is triggered by manipulating the argument Value, causing memory corruption. Exploit code has been publicly released, but exploitation requires local access. The vendor has not responded to the disclosure and no patch information is available.
CVE-2026-116258 is a heap-based buffer overflow vulnerability in libimobiledevice affecting versions 1.0 through 1.4.0. The flaw exists in the AFC component, specifically in the src/afc.c file. This vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure attempts. The CVSS 4.0 score is 5.3, indicating medium severity.
CVE-2026-89209 is an authentication bypass vulnerability in Siemens Mendix SAML modules for Mendix 9, 10, and 11 compatible versions prior to 3.6.29 and 4.2.4 respectively. The flaw allows unauthenticated remote attackers to replay valid SAML assertions in IdP-initiated authentication flows, potentially gaining unauthorized access to applications.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1.
Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7.
MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.
An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter.
The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce.
The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.