CVE-2026-62097

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...

CVE-2026-18782

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another...

Exploit for CVE-2026-102971

CVE-2026-102971: hidden revision author ID disclosure Reporte...

CVE-2026-82307

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1...

EUVD-2026-89963

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...

CVE-2026-18782 SQL Injection in Trex Digital Manufacturing's Trex MES

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...

CVE-2026-18782 SQL Injection in Trex Digital Manufacturing's Trex MES

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...

CVE-2026-62097 WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...

CVE-2026-62097 WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...

EUVD-2026-89957

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...

METIS

METIS - Modular Exploitation & Threat Intelligence Framework...

EUVD-2026-89953

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1...

CVE-2026-82307 Multiple Vulnerabilities in Dolusoft Software's SOPLOG

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1...

CVE-2026-82307

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1...

wordpress_exploit

Vulnerable Lab: CVE-2026-63030 WordPress This environment r...

Know Your Enemy: Browser-Based Attack Techniques in 2026

Given that the browser is where business apps are accessed and used, it makes sense that attacks are happening there too. Most breaches today begin in a browser session. Often, they never leave it, with the entire attack chain from initial access to exfiltration playing out in the browser. Here a...

AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub

AI coding agents asked to share screenshots of code changes for review have put internal company images in public GitHub repositories, security company Glow said. Its researchers found more than 13,000 internal images from developers at over 300 organizations, including customer billing records a...

I Want Better Reporting on AI Genie Behavior

AI systems are regularly completing tasks in ways that their prompters don't want or intend. Some of them are disturbing, and some of them are dangerous. This is something I've been calling "genie behavior," because I think that really gets at the core of what's happening. I wish the popular pres...

CVE-2026-92950

A flaw was found in vm2. An attacker can achieve arbitrary code execution on the host system by escaping sandbox isolation through the command-line interface CLI tool. By supplying a malicious script that uses the require function to re-execute itself within the host environment, untrusted code c...