Threat Intelligence Database

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component (WebView) running on the affected product, resulting in the displayed content being altered.

Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026.

Two critical vulnerabilities (CVE-2026-72529 and CVE-2026-72530) in TrueConf Server have been actively exploited by the hacktivist group Head Mare to deploy PhantomCore malware. These flaws allow remote attackers with access to the TrueConf server port to execute arbitrary code and escape isolated environments. The vulnerabilities were patched in June 2026 in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog and urges immediate patching. The attackers replaced legitimate client installers with malicious ones to spread malware and installed backdoors using TrueConf protocol and GitHub for command-and-control communications.

A typosquatting campaign involved 40 fake npm packages impersonating popular libraries such as chalk, axios, lodash, react, typescript, and commander. The malicious install scripts detected Windows Subsystem for Linux (WSL) environments and used this as a vector to execute native payloads on the underlying Windows host. These payloads targeted cryptocurrency wallets, Chromium browser data, and Telegram sessions. Although the npm packages were removed after about 84 minutes, the payload hosted on GitHub remained active for approximately 39 hours, continuing the attack beyond the removal of the delivery mechanism.

CVE-2026-75796 is a privilege management vulnerability in the AI Engine WordPress plugin before version 3.6.1. It allows users with the Administrator role on a Multisite sub-site to perform privileged user management operations without proper authorization checks. This flaw enables such users to take over any account on the network, including the Network Administrator's account.

The Duplicate Post WordPress plugin before version 1.5.6 contains an information exposure vulnerability. It fails to verify user capabilities before returning post data, which allows users with delegated roles to access content, metadata, and passwords of posts they should not have permission to view, including private and draft posts belonging to other users.

The Duplicate Post WordPress plugin before version 1.5.6 contains an authorization bypass vulnerability. It fails to verify whether a user has permission to read a post before allowing duplication. This flaw enables users with delegated roles to duplicate password-protected posts and republish them as publicly accessible content.

CVE-2026-18781 is a code injection vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before version 1.3.9.9. The plugin fails to properly validate the final name of uploaded files after character stripping, allowing unauthenticated users to bypass file type restrictions and execute arbitrary code on the server. No official patch or remediation guidance is currently available. There are no known exploits in the wild at this time.

The Tamara Checkout WordPress plugin up to version 1.9.9.20 contains a missing authorization vulnerability. It does not verify order keys, nonces, or user capabilities on its public payment cancel/fail return URLs. This allows an unauthenticated attacker to change the status of arbitrary WooCommerce orders by supplying numeric order IDs, potentially triggering stock release and notification side effects.

A SQL injection vulnerability exists in the Media Library Assistant WordPress plugin before version 3.40. The flaw arises because the plugin does not validate a search parameter before including it in a SQL query within one of its media-library query handlers. This allows users with the Author role to perform SQL injection attacks.