Posts of last few hours

CVE-2026-85643 | code-projects Online Shopping System 1.0 admin/adduser.php mysqli_query mobile sql injection
A vulnerability described as problematic has been identified in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. This vulnerability appears as CVE-2026-85643. The attack may be performed from remote. In addition, an exploit is available.
https://vuldb.com/vuln/398789
CVE-2026-18198 | GOLDENHORN ONEIT prior Göbeklitepe sql injection
A vulnerability marked as critical has been reported in TAC Information Services Internal and External Trade GOLDENHORN ONEIT. This issue affects some unknown processing. Performing a manipulation results in sql injection. This vulnerability is reported as CVE-2026-18198. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.
https://vuldb.com/vuln/398788
G7 urges organizations to prepare for quantum cyber threats
In a joint advisory released Thursday, the G7 Cyber Security Working Group and the U.S. Cybersecurity and Infrastructure Security Agency, CISA, said organizations should begin moving to post-quantum cryptography now.
https://therecord.media/g7-urges-organizations-to-prepare-for-quantum-threats
CVE-2026-79707 | Google Cloud Agent Development Kit up to 1.21.x Builder Endpoint file_path path traversal (EUVD-2026-70994)
A vulnerability, which was classified as problematic, was found in Google Cloud Agent Development Kit up to 1.21.x. This affects an unknown function of the component Builder Endpoint. The manipulation of the argument file_path results in path traversal. This vulnerability is identified as CVE-2026-79707. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.
https://vuldb.com/vuln/398737
CVE-2026-85512 | SourceCodester Class and Exam Timetabling System 1.0 /admin/session.php ID authorization (EUVD-2026-70995)
A vulnerability described as critical has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. This vulnerability is identified as CVE-2026-85512. The attack can be executed remotely. Additionally, an exploit exists.
https://vuldb.com/vuln/398677
CVE-2026-4644 | Google Integration Connectors prior 2025-12-11 HTTP Connector improper authorization (EUVD-2026-70996)
A vulnerability was found in Google Integration Connectors and classified as critical. Affected is an unknown function of the component HTTP Connector. Such manipulation leads to improper authorization. This vulnerability is listed as CVE-2026-4644. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.
https://vuldb.com/vuln/398739
CVE-2026-85534 | Red Hat Enterprise Linux up to 10 libsoup buffer overflow (EUVD-2026-70997)
A vulnerability was found in Red Hat Enterprise Linux 6/7/8/9/10. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component libsoup. Performing a manipulation results in buffer overflow. This vulnerability is cataloged as CVE-2026-85534. It is possible to initiate the attack remotely. There is no exploit available.
https://vuldb.com/vuln/398740
CVE-2026-78074 | miniOrange Extension missing authentication (EUVD-2026-68522)
A vulnerability marked as critical has been reported in miniOrange Extension. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-78074. The attack can be initiated remotely. There is not any exploit available.
https://vuldb.com/vuln/397332
CVE-2026-84428 | Fastify up to 5.12.1 Header Schema Compilation input validation (EUVD-2026-70998)
A vulnerability was found in Fastify up to 5.12.1. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Header Schema Compilation. Executing a manipulation can lead to improper input validation. This vulnerability is registered as CVE-2026-84428. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/398741
CVE-2026-27347 | Crocoblock JetPopup Plugin up to 2.0.20.2 on WordPress authorization (EUVD-2026-70999)
A vulnerability was found in Crocoblock JetPopup Plugin up to 2.0.20.2 on WordPress. It has been rated as problematic. This affects an unknown part. The manipulation leads to missing authorization. This vulnerability is documented as CVE-2026-27347. The attack can be initiated remotely. There is not any exploit available.
https://vuldb.com/vuln/398742
CVE-2026-85639 | jofpin trape 2.0 Telemetry Endpoint core/user.py vId race condition (Issue 408)
A vulnerability labeled as problematic has been found in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry Endpoint. Such manipulation of the argument vId leads to race condition. This vulnerability is documented as CVE-2026-85639. The attack can be executed remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.
https://vuldb.com/vuln/398787
CVE-2026-85638 | jofpin trape 2.0 core/user.py vId/id authorization (Issue 407)
A vulnerability identified as critical has been detected in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. This vulnerability is registered as CVE-2026-85638. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.
https://vuldb.com/vuln/398786
CVE-2026-85637 | jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room missing authentication (Issue 406)
A vulnerability categorized as problematic has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join_room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. This vulnerability is cataloged as CVE-2026-85637. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.
https://vuldb.com/vuln/398785
CVE-2026-85636 | jofpin trape 1.0.0 Login Endpoint core/stats.py missing authentication (Issue 405)
A vulnerability was found in jofpin trape 1.0.0. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. This vulnerability is listed as CVE-2026-85636. The attack may be initiated remotely. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.
https://vuldb.com/vuln/398784
Exchange Online outage causes email delays, 'Server busy' errors
Microsoft is working to resolve an ongoing Exchange Online outage that is delaying email sent to and received from external domains. [...]
https://www.bleepingcomputer.com/news/microsoft/exchange-online-outage-causes-email-delays-server-busy-errors/
CVE-2026-85617 | Grokability Snipe-IT up to 8.6.2 Bulk Delete authorization
A vulnerability was found in Grokability Snipe-IT up to 8.6.2. It has been declared as critical. Affected is an unknown function of the component Bulk Delete. Executing a manipulation can lead to authorization bypass. This vulnerability is tracked as CVE-2026-85617. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/398783
Synology ActiveProtect Manager 2.0 improves AI-driven security

Synology launched ActiveProtect Manager 2.0 (APM 2.0), the latest software update for its ActiveProtect data protection appliances. This release introduces expanded platform coverage, cross-platform recovery, and enhanced security, with future updates bringing AI-driven threat mitigation. “Managing fragmented backup infrastructure drives up costs and slows recovery. The ActiveProtect appliance unites purpose-built storage with powerful data management software into a single, predictable investment,” said Jia-Yu Liu, EVP of the Synology Data Protection Group. “APM 2.0 builds on … More →

The post Synology ActiveProtect Manager 2.0 improves AI-driven security appeared first on Help Net Security.

https://www.helpnetsecurity.com/2026/09/04/synology-activeprotect-manager-2-0-data-protection/
NodeStealer Spyware Adds Keylogging, Screenshot Capture and Facebook Data Theft

A major upgrade to the Python-based NodeStealer malware, transforming the Facebook-focused infostealer into a broader spyware platform capable of logging keystrokes, monitoring clipboard data, capturing screenshots, and harvesting extensive Facebook profile information. The newly observed variant, identified in August 2026, also expands browser and local data theft, using a split Telegram command-and-control (C2) design to […]

The post NodeStealer Spyware Adds Keylogging, Screenshot Capture and Facebook Data Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

https://gbhackers.com/nodestealer-spyware-malware/
Plex Urges Users to Update Media Server Immediately to Fix Multiple Security Flaws

Plex has issued an urgent security update for Plex Media Server and Plex Desktop, asking users to install the latest releases as soon as possible. The update addresses multiple undisclosed security issues affecting Plex Media Server versions 1.43.2 and earlier, as well as affected Plex Desktop installations. Plex released Plex Media Server version 1.43.3 and […]

The post Plex Urges Users to Update Media Server Immediately to Fix Multiple Security Flaws appeared first on Cyber Security News.

https://cybersecuritynews.com/plex-fix-multiple-security-flaws/
Multiple TP-Link Archer Vulnerabilities Allow Attackers to Execute Remote Code

TP-Link has disclosed two security vulnerabilities in its Archer AX55 v4 router that could let attackers on the local network crash a service, steal administrator credentials, and potentially execute remote code on affected devices. The flaws, tracked as CVE-2026-18167 and CVE-2026-18330, affect the EasyMesh and web login modules in Archer AX55 hardware version V4. TP-Link […]

The post Multiple TP-Link Archer Vulnerabilities Allow Attackers to Execute Remote Code appeared first on Cyber Security News.

https://cybersecuritynews.com/multiple-tp-link-archer-vulnerabilities/

Managed ad