Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service MaaS platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aime...

SUSE CVE-2026-80431

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-100669

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...

CVE-2026-100669 Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...

CVE-2026-100669 Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...

CVE-2026-100669

Grav versions before 2.0.25 ship web server configuration samples with case-sensitive deny rules, leading to sensitive file disclosure . In webserver-configs/web.config (IIS), the ignoreCase="false" setting on URL Rewrite elements allows unauthenticated remote attackers to bypass access controls ...

CVE-2026-100669 Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...

EUVD-2026-87763

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...

CVE-2026-100669

Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In webserver-configs/web.config IIS, every deny rule usersensitivefolders, useraccounts, userdata, usererrorredirect, userpages, system, vendor, ignorefolders sets...

CVE-2026-100312

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

CVE-2026-100312

A security flaw exists in mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be) where an unknown function in the /updateguest.php file is vulnerable to SQL injection . The vulnerability can be triggered remotely by manipulating the gname/editassid argumen...

EUVD-2026-87545

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

CVE-2026-100312 mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

CVE-2026-100312 mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

CVE-2026-100312 mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

CVE-2026-100311

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument VTitle/VUrl/VRemarks lea...

CVE-2026-100311 mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument VTitle/VUrl/VRemarks lea...

EUVD-2026-87543

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument VTitle/VUrl/VRemarks lea...

CVE-2026-100311 mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument VTitle/VUrl/VRemarks lea...

CVE-2026-100311

A cross-site scripting (XSS) vulnerability exists in the Faculty Video Management component of the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw is caused by an unknown function in the managevideos2.php file that fails to properly handle...