A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...

CVE-2026-13586

creationtimestamp| type| source ---|---|--- 2026-08-03 06:15:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/exnxhhsnzqcnb 2026-08-03 11:48:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-13586...

CVE-2026-66299

A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service DoS by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing...

CVE-2026-68583 luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...

CVE-2026-68583

Luci-app-adblock-fast prior to 1.2.4-4 contains a stored XSS in the blocklist name field. When an administrator views the AdBlock Fast status page, the payload executes in the administrator’s browser under the LuCI origin. Affected version is 1.2.4-3 and earlier; upgrade to 1.2.4-4 or later to re...

EUVD-2026-51993

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser...

CVE-2026-67355

creationtimestamp| type| source ---|---|--- 2026-08-01 14:09:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5yssuoga274vr 2026-08-01 22:24:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2j4mwb6f2e 2026-08-01 22:24:37+00:00| seen|...

CVE-2026-67352

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

EUVD-2026-51867

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolverurl parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the...

CVE-2026-67352

CVE-2026-67352 affects luci-app-https-dns-proxy. A stored XSS flaw exists in the resolver_url parameter; authenticated users can inject active HTML, which is rendered as raw HTML on the HTTPS DNS Proxy status page and can execute JavaScript in the admin’s browser origin. Documents provide CVSS me...

CVE-2026-15006

creationtimestamp| type| source ---|---|--- 2026-08-01 04:12:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fjzicctxlhcte 2026-08-01 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mryn3ucp2a2b 2026-08-01 13:00:52+00:00| seen|...

CVE-2026-45330

creationtimestamp| type| source ---|---|--- 2026-07-31 23:54:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6ngeypsnmbjir...

EUVD-2026-44802

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE...

CVE-2026-58047

creationtimestamp| type| source ---|---|--- 2026-07-31 18:06:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23v3iiu47byar 2026-08-04 16:07:10+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3msbfge7k4v24 2026-08-04 16:15:25+00:00| seen|...

CVE-2026-17349

creationtimestamp| type| source ---|---|--- 2026-07-31 17:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgmxn3vz2s 2026-08-01 09:38:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz6clkjkg24 2026-08-01 09:38:47+00:00| seen|...

CVE-2026-14919

creationtimestamp| type| source ---|---|--- 2026-07-31 17:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgjgetfu2a...

CVE-2026-10064

creationtimestamp| type| source ---|---|--- 2026-07-31 16:53:02+00:00| seen| https://bsky.app/profile/vulny-app.bsky.social/post/3mrxg4s54re2q...

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise...

CVE-2026-12562

creationtimestamp| type| source ---|---|--- 2026-07-31 09:19:37+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrwmrz4q652w 2026-07-31 12:10:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrwwcsfwf22j 2026-08-02 22:00:47+00:00| seen|...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...