CVE ID :CVE-2026-104398 Published : Oct. 10, 2026, 5:16 p.m. | 59 minutes ago Description :Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from…
CVE ID :CVE-2026-108550 Published : Oct. 10, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge…
CVE ID :CVE-2026-108551 Published : Oct. 10, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted…
CVE ID :CVE-2026-108549 Published : Oct. 10, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform that accepts unauthenticated updates when no webhook_secret is…
CVE ID :CVE-2026-107845 Published : Oct. 9, 2026, 7:29 p.m. | 37 minutes ago Description :Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is…
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. “Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel,…
CVE ID :CVE-2026-107837 Published : Oct. 9, 2026, 6:17 p.m. | 1 hour, 50 minutes ago Description :RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys can…
CVE ID :CVE-2026-107824 Published : Oct. 9, 2026, 6:17 p.m. | 1 hour, 50 minutes ago Description :x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger’s full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server…
The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI’s jobs portal and stolen sensitive data on…
CVE ID :CVE-2026-107821 Published : Oct. 9, 2026, 5:27 p.m. | 40 minutes ago Description :MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths,…