Posts of last few hours

CVE-2026-72560 | HumanSignal Label Studio up to 1.24.0 Import-From-URL Endpoint server-side request forgery
A vulnerability categorized as critical has been discovered in HumanSignal Label Studio up to 1.24.0. Impacted is an unknown function of the component Import-From-URL Endpoint. The manipulation results in server-side request forgery. This vulnerability is cataloged as CVE-2026-72560. The attack may be launched remotely. There is no exploit available.
https://vuldb.com/vuln/388075
CVE-2026-72553 | ElkArte up to 2.0 Profile cust_blurb/cust_locate cross site scripting
A vulnerability identified as problematic has been detected in ElkArte up to 2.0. The affected element is an unknown function of the component Profile. This manipulation of the argument cust_blurb/cust_locate causes cross site scripting. This vulnerability is registered as CVE-2026-72553. Remote exploitation of the attack is possible. No exploit is available.
https://vuldb.com/vuln/388076
CVE-2026-72559 | Daniel Brendel HortusFox up to 5.9 cross site scripting
A vulnerability labeled as problematic has been found in Daniel Brendel HortusFox up to 5.9. The impacted element is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-72559. The attack can be executed remotely. There is not any exploit available.
https://vuldb.com/vuln/388077
CVE-2026-85538 | MISP up to 2.5.45 Attribute Deletion deleteAttribute privileges management (d0a6f963f / EUVD-2026-70958)
A vulnerability classified as critical has been found in MISP up to 2.5.45. This affects the function MispAttribute::deleteAttribute of the component Attribute Deletion. This manipulation causes improper privilege management. The identification of this vulnerability is CVE-2026-85538. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.
https://vuldb.com/vuln/398720
CVE-2026-85184 | fastify middie up to 9.3.3 access control (EUVD-2026-70979)
A vulnerability has been found in fastify middie up to 9.3.3 and classified as critical. The affected element is an unknown function. The manipulation leads to improper access controls. This vulnerability is listed as CVE-2026-85184. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.
https://vuldb.com/vuln/398724
CVE-2026-27086 | Xtemos WoodMart Plugin up to 8.3.7 on WordPress cross site scripting (EUVD-2026-70980)
A vulnerability was found in Xtemos WoodMart Plugin up to 8.3.7 on WordPress and classified as problematic. The impacted element is an unknown function. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2026-27086. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.
https://vuldb.com/vuln/398725
CVE-2026-85546 | MISP up to 2.4.54 Sharing Group __initialiseSGQuickEdit cross-site request forgery (EUVD-2026-70981)
A vulnerability was found in MISP up to 2.4.54. It has been classified as problematic. This affects the function __initialiseSGQuickEdit of the component Sharing Group. This manipulation causes cross-site request forgery. This vulnerability is registered as CVE-2026-85546. Remote exploitation of the attack is possible. No exploit is available.
https://vuldb.com/vuln/398726
CVE-2026-85541 | Interinfo DreamMaker cross site scripting (EUVD-2026-70983)
A vulnerability was found in Interinfo DreamMaker. It has been rated as problematic. Affected is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-85541. The attack is possible to be carried out remotely. No exploit exists.
https://vuldb.com/vuln/398728
CVE-2026-85540 | Interinfo DreamMaker sql injection (EUVD-2026-70982)
A vulnerability marked as critical has been reported in Interinfo DreamMaker. This vulnerability affects unknown code. This manipulation causes sql injection. This vulnerability is handled as CVE-2026-85540. The attack can be initiated remotely. There is not any exploit available.
https://vuldb.com/vuln/398732
CVE-2026-84045 | E-cab Taxi Booking Manager for Woocommerce Plugin up to 2.0.4 on WordPress external control of assumed-immutable web parameter (EUVD-2026-70993)
A vulnerability has been found in E-cab Taxi Booking Manager for Woocommerce Plugin up to 2.0.4 on WordPress and classified as problematic. This impacts an unknown function. This manipulation causes external control of assumed-immutable web parameter. This vulnerability is tracked as CVE-2026-84045. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.
https://vuldb.com/vuln/398738
Microsoft Confirms New Exchange Online Outage Delaying Emails from External Domains

Microsoft has confirmed a fresh Exchange Online incident, tracked as EX1467029, causing delays for users sending and receiving email messages from external domains. The company first acknowledged the disruption on September 4, 2026, flagging it as a service degradation issue affecting Exchange Online, one of the most widely used business email platforms in the world. […]

The post Microsoft Confirms New Exchange Online Outage Delaying Emails from External Domains appeared first on Cyber Security News.

https://cybersecuritynews.com/exchange-online-outage-delaying-emails/
AI Is Ending the Era of Hidden Vulnerabilities — Are Vendors Ready?
A tidal wave of bug reports is overwhelming software vendors, exposing secure-by-design failures and creating disclosure bottlenecks.
https://www.darkreading.com/vulnerabilities-threats/ai-ending-era-hidden-vulnerabilities-are-vendors-ready
CVE-2026-82309 | robrwo Robots::Validate up to 0.3.10 _check_dns allocation of resources
A vulnerability, which was classified as problematic, was found in robrwo Robots::Validate up to 0.3.10. This impacts the function _check_dns. Such manipulation leads to allocation of resources. This vulnerability is uniquely identified as CVE-2026-82309. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.
https://vuldb.com/vuln/398793
CVE-2026-74237 | GFI Exinda AI up to 7.6.4 Iperf Client web_tools_cmd server/options argument injection
A vulnerability, which was classified as problematic, has been found in GFI Exinda AI up to 7.6.4. This affects the function web_tools_cmd of the component Iperf Client. This manipulation of the argument server/options causes argument injection. This vulnerability is handled as CVE-2026-74237. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.
https://vuldb.com/vuln/398792
ShipMonk Data Breach Exposes Personal Data of 67,000 Additional Trezor Customers

Trezor has revealed that a data breach involving its fulfillment provider, ShipMonk, exposed personal and order information of approximately 67,000 additional US customers. This significantly broadens the scope of an incident initially reported in August. The newly identified data pertains to Trezor orders processed during a prior partnership with ShipMonk, which lasted from November 2019 […]

The post ShipMonk Data Breach Exposes Personal Data of 67,000 Additional Trezor Customers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

https://gbhackers.com/shipmonk-data-breach-exposes-personal-data/
CVE-2026-74236 | GFI Exinda AI up to 7.6.4 Diagnostic File Deletion unlink_or_email_file v_file_row_ path traversal
A vulnerability classified as problematic was found in GFI Exinda AI up to 7.6.4. The impacted element is the function unlink_or_email_file of the component Diagnostic File Deletion Handler. The manipulation of the argument v_file_row_ results in path traversal. This vulnerability is known as CVE-2026-74236. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.
https://vuldb.com/vuln/398791
CVE-2026-74235 | GFI Exinda AI up to 7.6.4 Download wcf_handle_download v_del_ path traversal
A vulnerability classified as problematic has been found in GFI Exinda AI up to 7.6.4. The affected element is the function wcf_handle_download of the component Download Handler. The manipulation of the argument v_del_ leads to path traversal. This vulnerability is traded as CVE-2026-74235. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/398790
CVE-2026-80731 | Linux Kernel up to 7.1.8 Net Header Validation dev_validate_header hard_header_len out-of-bounds write (Nessus ID 342723)
A vulnerability classified as very critical was found in Linux Kernel up to 7.1.8. The impacted element is the function dev_validate_header of the component Net Header Validation. The manipulation of the argument hard_header_len results in out-of-bounds write. This vulnerability was named CVE-2026-80731. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.
https://vuldb.com/vuln/398329
CVE-2026-80733 | Linux Kernel up to 7.1.8 Socket sk_mc_loop privilege escalation (Nessus ID 342724)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.1.8. This affects the function sk_mc_loop of the component Socket. This manipulation causes privilege escalation. The identification of this vulnerability is CVE-2026-80733. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.
https://vuldb.com/vuln/398330
CVE-2026-80754 | Linux Kernel up to 7.1.9 synaptics-rmi4 out-of-bounds (Nessus ID 342725)
A vulnerability classified as very critical has been found in Linux Kernel up to 7.1.9. This impacts an unknown function of the component synaptics-rmi4. This manipulation causes out-of-bounds read. This vulnerability is handled as CVE-2026-80754. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/398342

Managed ad