CVE-2026-19610 is a vulnerability in Red Hat JBoss Enterprise Application Platform 7's platform-mbean component. The flaw is due to missing Role-Based Access Control (RBAC) checks in the handler for the read-resource operation on the runtime management resource. This allows authenticated users with low-privileged roles, such as Monitor, to access sensitive JVM system properties and configuration details that should be restricted.
The LogixFast Auth WordPress plugin versions before 1.0.4 contain a vulnerability in the password reset functionality. The plugin sends the password-reset one-time code to the email address supplied in the request rather than the email address associated with the user account. This flaw allows unauthenticated attackers to reset any user's password, including administrators, leading to account takeover.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the WP Photo Album Plus WordPress plugin before version 9.3.04.004. The plugin fails to verify the origin or a security token for a comment-management request, which allows attackers to trick logged-in users with comment-moderation rights into deleting photo comments without their consent.
CVE-2026-118579 is a critical vulnerability in the D-Link DIR-505 router version 1.10B02. It involves a backdoor in the Web Management CGI component, specifically in the main function of /secmark1524.cgi. This backdoor can be triggered remotely by manipulating certain arguments, allowing unauthorized access. Public exploit code is available, increasing the risk of exploitation.
Volmarg Personal Management System versions up to 2.1.0 contain an OS command injection vulnerability. Authenticated users can exploit this flaw by creating directories with shell metacharacters in the upload/files path and then moving or copying them, resulting in arbitrary shell command execution as the web server user. The vulnerability arises from improper neutralization of special elements in folder paths within the storage module's tree command.
CVE-2026-118262 is a resource management vulnerability in the labstack Echo Go web framework affecting versions 4.15.0 up to but not including 4.16.1, and 5.0.0 up to but not including 5.4.1. The issue occurs in Echo's Proxy middleware where resources such as handlers, goroutines, and network connections may be retained after a WebSocket client disconnects if the upstream connection remains open. This can lead to resource accumulation and potential denial of service. The vulnerability is fixed in versions 4.16.1 and 5.4.1.
CVE-2026-93536 is a use-after-free vulnerability in the GestureBuildSprite() function of the X.Org X Server and XWayland. It affects versions before 21.1.25 of X.Org X Server and before 24.1.14 of XWayland. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code.
This report from Unit 42 outlines key cyber threats targeting retail organizations during peak shopping seasons, emphasizing ransomware, data theft, DDoS attacks, digital skimming, and account takeover. It highlights historical incidents and evolving attack trends, including autonomous attacks and AI-driven threats. The report stresses the operational and reputational risks posed by these attacks to retailers and their customers, especially during high-sales periods. It provides mitigation strategies such as zero trust access, advanced endpoint protection, data loss prevention, application-layer defenses, and vulnerability management.
The OAuth2 Token Manager module for Drupal allows management of system-wide OAuth2 access and refresh tokens for integrations such as Box, Quip, and Slack. A vulnerability exists because the module does not restrict access to its OAuth2 routes, potentially allowing an anonymous visitor to connect the site's integration to an account they control. However, exploitation requires the attacker to obtain the OAuth2 state value from a prior token initialization, which mitigates the risk. The issue is fixed in version 1.2.0.
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1.
CVE-2026-59979 is an authorization bypass vulnerability in YosemiteCrew's Yosemite-Crew platform. Certain API routes for service and PMS task-library/template management lack proper organization and permission checks, allowing any registered user to read, modify, or delete data belonging to other organizations. Some service records can be accessed without authentication. This flaw affects critical operations such as bookings and billing. No fixed release or patch information is currently available.
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /layout/status/{id}` allow an authenticated user with any privileges to view the `status and metadata` of any layout, including layouts for which the user does not have view rights. This issue is fixed in version 4.4.3.
A use-after-free vulnerability exists in X.org X Server before version 21.1.25 and XWayland before version 24.1.14 due to improper lifecycle management when adding or removing XInput master devices. Authenticated X clients could exploit this flaw to crash the X server, causing denial of service, or potentially execute code within the X server context.
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on `/notification/export/{id}` allows an authenticated user to download attachments from any notification, including notifications created by administrators, by iterating over `sequential notification IDs`. Exploitation requires access to the `Notification Centre` to view past notifications, a privilege granted to non-administrators as standard. This issue is fixed in version 4.4.3.
The n0n ransomware operation is an AI-assisted extortion campaign revealed in 2026 through an exposed staging server. It targets organizations globally using credential stuffing attacks against FortiGate SSL-VPN devices, exposed cloud keys, and compromised management portals. The operation combines data exfiltration with destructive actions such as encryption and backup deletion. The attacker uses an AI coding agent with numerous models to generate attack scripts, enhancing human-directed operations. At least 23 victims across 14 countries were identified initially, with 93 victims listed by October 2026 and ransom demands totaling $283.7 million. No software vulnerabilities were exploited; all compromises relied on weak or stolen credentials.
On September 6, 2026, an unidentified operator exfiltrated approximately 68.8 GiB of database backups from a Philippine government agency responsible for overseas employment and migrant workers. The stolen data included 27 SQL Server backups related to case management systems such as POEA and OFW variants. The operator inadvertently exposed their staging infrastructure through an open HTTP directory on a VPS in Singapore, revealing tools including a rebranded GodPotato privilege escalation tool (Wrqsnx), PowerShell stagers, and the Impacket toolkit. The attack leveraged DCOM and RPC mechanisms to gain SYSTEM-level access without exploiting known vulnerabilities. Certificate analysis linked the compromised infrastructure to the Philippine Overseas Employment Administration portal farm. Initial access methods and command-and-control channels remain unknown, though the tooling was deployed on agency portal hosts.
