A long-running malware campaign has infected 953 online stores, primarily Magento-based, with loader code that selectively serves malicious payloads to real visitors to evade detection. The campaign began in July 2025 and has used multiple domains for its JavaScript loader, with recent activity observed as late as October 2026. The loader performs visitor fingerprinting and has been delivered through exploitation of known Magento vulnerabilities and backdoors. Store owners are advised to check for loader code, vulnerabilities, backdoors, rogue admin accounts, and to apply the latest patches and security measures.
A stored Cross-Site Scripting (XSS) vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2 allows an attacker to inject malicious scripts via HTML-type custom contact fields. When an affected contact's detail page is viewed, the script executes in the context of the viewer's browser session, potentially enabling administrative actions such as creating admin accounts or accessing sensitive data. This vulnerability is fixed in version 7.2.2.
CVE-2026-115192 is an SQL Injection vulnerability in the Mautic core dashboard widget data API endpoint (/api/data/{type}). It allows an authenticated user with API access to inject SQL via chart filter parameters that are not properly validated. Exploitation can lead to unauthorized reading of arbitrary database data, including sensitive contact, marketing, and user account information with password hashes. The vulnerability does not allow data modification but can be used to degrade database query performance, impacting availability. Exploitation requires the Mautic API to be enabled.
Kameleo versions up to 5.0.1.19 contain a server-side request forgery (SSRF) vulnerability in the InternalController.TestProxy function of the Proxy Validation component. This vulnerability allows remote attackers to manipulate host and port arguments to induce SSRF. The issue is addressed in version 5.2.0, where the vulnerable route was removed and replaced.
CVE-2026-115191 is a SQL injection vulnerability in the Mautic administration interface's contact lookup AJAX endpoint (/s/ajax). It allows any authenticated user, regardless of role or permissions, to execute arbitrary SQL queries on the Mautic database by exploiting improper validation of a request parameter. This can lead to unauthorized reading of sensitive data such as user accounts, password hashes, contact information, and campaign content. The vulnerability affects multiple Mautic core versions and has been assigned a high severity rating.
CVE-2026-115190 is a high-severity deserialization vulnerability in Mautic's core affecting versions >=2.15.2 <5.2.12, >=6.0.0 <6.0.10, and >=7.0.0 <7.2.0. It involves insecure deserialization of PHP objects from segment filters and custom field properties, allowing an attacker with write privileges to inject crafted serialized data. This can lead to arbitrary code execution, data disclosure, modification, or deletion, and impact availability. The vulnerability is fixed in versions 5.2.12, 6.0.10, and 7.2.0.
CVE-2026-115189 is a server-side template injection vulnerability in Mautic's Twig theme rendering sandbox. The sandbox, intended to restrict user-uploaded theme templates, does not fully enforce restrictions, allowing an authenticated user with core:themes:create permission to upload a malicious theme. This can lead to arbitrary code execution on the server with web server privileges, including OS command execution, file read/write, and access to internal services. The vulnerability affects multiple Mautic versions prior to fixed releases.
CVE-2026-115188 is a critical unrestricted file upload vulnerability in Mautic core versions 7.0.0 up to but not including 7.2.2. It affects the campaign import feature, allowing authenticated users with campaign import permissions to upload arbitrary files, including server-side scripts, to a publicly accessible media directory. This can lead to remote code execution on web servers that honor per-directory configurations, such as Apache in the official Mautic Docker image, without requiring administrator privileges.
CVE-2026-116275 is a code injection vulnerability in AllenAI AllenNLP versions 2.10.0 and 2.10.1. It affects the Registrable.resolve_class_name function in the Registrable Configuration Machinery component. The vulnerability allows remote attackers to perform code injection by manipulating the argument Type. The exploit code has been publicly disclosed. The affected versions are no longer supported by the vendor.
Frappe CRM versions before 1.89.1 have a missing authorization vulnerability in the get_contact_by_phone_number API. This flaw allows authenticated users with low privileges to query CRM Lead records they should not access by supplying a phone number, bypassing normal permission checks. The vulnerability leads to unauthorized disclosure of sensitive CRM lead data.
CVE-2026-110475 is a critical vulnerability in the CreditNirvana Collections Platform (CollectionWorkz) caused by weak authentication and authorization controls in the platform login service. An unauthenticated remote attacker can exploit this flaw to manipulate authentication requests and access APIs without a valid session. This allows the attacker to enumerate users, impersonate arbitrary users including administrators, and access or modify sensitive data with the privileges of the impersonated user.
CVE-2026-116274 is an improper authorization vulnerability in JIZHICMS versions 2.5.0 through 2.5.6. It affects the Pay function in the app/home/c/OrderController.php file, allowing remote attackers to manipulate the orderno argument to bypass authorization controls. The vulnerability has been publicly disclosed with available exploit details, but the vendor has not responded or issued a patch.
CVE-2026-110474 is a vulnerability in the CreditNirvana Agentic AI Call Centre application caused by a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. Using the extracted key, the attacker can make arbitrary API calls to access sensitive call transcripts and recordings through the application API.
CVE-2026-115720 is a server-side request forgery (SSRF) vulnerability in Frappe Builder versions before 1.36.1. The flaw exists in builder/api.py where the URL validation only checks the initial hostname but does not handle HTTP redirects properly, allowing attackers to redirect requests to internal or link-local addresses. An authenticated attacker can exploit this by calling the convert_to_webp endpoint, which lacks permission checks, to perform SSRF attacks, internal port scanning, or cause denial of service due to request hangs.
CVE-2026-116263 is a race condition vulnerability in HaschekSolutions PictShare versions 3.7.0 and 3.7.1, specifically in the function architect within src/inc/core.php related to file upload handling. The flaw can be exploited remotely but requires high attack complexity and is difficult to exploit. A public exploit exists. Upgrading to version 3.7.2 resolves the issue.
Dutch police arrested two individuals involved in a bank helpdesk fraud scheme that used NFC relay attacks to steal over $400,000 from 170 victims. The suspects called victims, played AI-generated audio impersonating banks, and persuaded them to install an app to scan their credit cards via NFC. The stolen card data was then used to withdraw money from victims' accounts at ATMs. The suspects were arrested and their infrastructure seized.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal.
This issue affects Logsign SIEM: from 6.4.120 before 6.4.122.
CVE-2026-116262 is a heap-based buffer overflow vulnerability in libimobiledevice up to version 1.4.0. It occurs in the webinspector_receive_with_timeout function of the Web Inspector component. The flaw can be exploited remotely and public exploit code is available. The vendor has not responded to the disclosure. The CVSS 4.0 score rates this vulnerability as medium severity.
Frappe Builder versions before 1.36.1 have a server-side request forgery (SSRF) vulnerability in the convert_to_webp API endpoint. This endpoint lacks proper access control and performs unprotected HTTP requests that follow redirects without revalidating IP addresses. A low-privilege authenticated user can exploit this to make the server fetch internal network resources or cloud metadata endpoints. The fetched images are saved to a publicly accessible URL, enabling data exfiltration or internal network probing.
Frappe Builder versions 1.33.0 up to but not including 1.36.0 have a missing authorization vulnerability in the improve_prompt API endpoint. This flaw allows any authenticated user, except guests, to invoke large language model (LLM) completions without proper permission checks. Exploitation enables attackers to use the site owner's stored OpenRouter API key, consuming paid LLM credits and effectively turning the site into a free LLM proxy. The vulnerability is fixed in version 1.36.0.