Red Hat has issued a security advisory for a kernel live patch module targeting kernel-5.14.0-427.100.1.el9_4. The update addresses multiple vulnerabilities in the Linux kernel, including issues in netfilter, pppoe, bridge, packet, and xfrm subsystems. These vulnerabilities involve improper memory handling and validation errors that could potentially be exploited. The advisory rates the security impact as Important and notes known exploitation in the wild. The update is available as kpatch patches for Red Hat Enterprise Linux 9.4 variants.
CVE-2026-87879 is a vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 involving improper verification of cryptographic signatures. This flaw leads to sensitive information disclosure due to improper token validation. The vulnerability has a CVSS 3.0 score of 5.9, indicating medium severity. A fix is available in build 42587.
CVE-2026-87097 is a vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587 that involves insufficiently protected credentials, leading to sensitive information disclosure. The flaw is classified under CWE-522. The vulnerability has a CVSS 3.0 base score of 5.3, indicating medium severity. A fix is available in build 42587.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to access the filesystem. This vulnerability is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later. The CVSS v3.1 base score is 5.3, indicating medium severity.
MR ROBOT is a sophisticated Android Malware-as-a-Service operation targeting Indian bank customers. It operates on a subscription model allowing cybercriminals to rent customized banking trojans distributed via fake Play Store pages and messaging apps. The malware uses a multi-stage dropper to deploy banking trojans that intercept SMS and OTPs, silently enable call forwarding to bypass two-factor authentication, and overlay phishing screens to steal sensitive financial and identity information. One affiliate compromised 153 devices and intercepted over 5,400 SMS messages. The operation includes a Telegram bot storefront offering about 36 fake apps impersonating banks and government services, with stolen data exfiltrated to Firebase Realtime Database and Telegram channels.
The VikRentCar Car Rental Management System plugin for WordPress contains a blind SQL Injection vulnerability in the 'catid' parameter affecting all versions up to and including 1.4.10. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries via a specially crafted block stored through the REST API and triggered by previewing a post. The vulnerability arises from insufficient escaping and lack of proper query preparation, enabling extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain a Missing Authorization vulnerability (CWE-862). This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. Fixed versions are available starting from 8.9.0.0 and certain later LTS releases.
CVE-2026-118435 is an out-of-bounds write vulnerability in the Samsung Open Source escargot project. This flaw allows buffer manipulation which can lead to integrity and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 5.4. No affected versions or patches are explicitly stated in the available data.
The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the allowed-extensions sanitizer and deliberate override of WordPress's native MIME and extension defences via a registered wp_check_filetype_and_ext filter. This makes it possible for authenticated attackers, with custom-level access and above, to upload files that may be executable, which makes remote code execution possible. An authenticated attacker with the custom add_edit_forms capability must first configure a File Upload field with a dangerous extension (e.g., php) in the allowed-extensions list; once that form is published, any unauthenticated visitor can trigger the actual file upload via the publicly accessible /wp-json/ivyforms/v1/form/submission/ REST route.
The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeatedly trigger RAG document sync operations that issue paid embedding API calls to OpenAI, Gemini, OpenRouter, or xAI charged to the site administrator's stored API key, draining their AI API credits and causing financial loss. The wp_chatbot nonce required to reach this endpoint is emitted to every authenticated frontend visitor via wp_localize_script, making it trivially obtainable by any subscriber-level account.
The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected javascript: payload fires on click rather than on page load, making exploitation contingent on a privileged user such as an Editor or Administrator clicking the attacker-crafted link while reviewing or previewing the Contributor's post.
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
The MP3 Audio Player WordPress plugin versions before 5.16 contain a vulnerability where one of its audio player shortcode attributes is not properly escaped before being output into an HTML attribute. This flaw allows users with Contributor-level access or higher to inject arbitrary JavaScript code. The injected script executes when another user, such as an administrator previewing a pending post, views the content.
The GoSMTP WordPress plugin versions before 1.2.5 lack an authorization check on the SMTP configuration page, allowing users with roles below administrator to modify outbound mail settings. This vulnerability can lead to administrator account takeover.
A vulnerability in Google Agent Development Kit (ADK) for Python's FileArtifactService allows an application to access artifacts of another application when both share a root directory and user ID. This occurs because the service accepted an application name in its API but did not use it when constructing on-disk paths, leading to cross-application access. The issue affects versions before 1.39.1 in the 1.x series and before 2.7.0 in the 2.x series. The vulnerability was addressed by enforcing full per-application path scoping in version 2.7.0 and backported to 1.39.1. The CVSS 4.0 base score is 5.3, indicating medium severity.
