CVE-2026-75953

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-75953 Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

CVE-2026-75953

J-BusinessDirectory is a Joomla extension by cmsjunkie.com. In versions below 6.2.3 , an open mail relay flaw exists: the mail recipient address was read from the request parameters (contact_id_offer / contact_id_event ) rather than from the server-side offer/event record, allowing an unauthentic...

CVE-2026-75953 Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

EUVD-2026-62498

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer P2P relay technique. The activity, codenamed Operatio...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a...

CVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

CVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

UBUNTU-CVE-2026-72360

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

CVE-2026-72360 drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

CVE-2026-72360

The CVE-2026-72360 entry concerns the Linux kernel, specifically the DRM XE PCIe PF path. The vulnerability arises from PF relay logic attempting to process FAST_REQ or EVENT relays; VF/PF relay actions were defined only for regular REQUEST messages. This misbehavior could break the VFPF ABI prot...

EUVD-2026-59259

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FASTREQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FASTREQUEST nor EVENT messages as this would result in...

PT-2026-72548

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Don't attempt to process FAST REQ or EVENT relays Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST REQUEST nor EVENT messages as this would result in...

Security Bulletin: Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow

Summary The POST /api/v2/registration/ endpoint in affected versions lacked authentication requirements, allowing unauthenticated attackers to overwrite the server's registered admin email address and trigger outbound telemetry calls to external servers, enabling the Langflow instance to be abuse...

CVE-2026-73216

A flaw was found in coturn. An authenticated client can exploit a vulnerability in the shutdownclientconnection function, which prematurely releases bandwidth accounting during the first stage of closing a mobility-enabled allocation. This allows the client to bypass user and total quotas, leadin...

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

Summary TurnServer.ReceiveUdpAsync places its generic catch Exception OUTSIDE the while receive loop, and Start launches the loop fire-and-forget with no supervision or restart. A single pre-authentication UDP datagram whose STUN header first byte is in 0x80–0xFF causes STUNHeader.ParseSTUNHeader...

CVE-2026-73215

A flaw was found in Coturn. An authenticated client can exploit a vulnerability by sending a specially crafted 'EVEN-PORT Allocate request' with a reservation bit set to zero. This causes the server to incorrectly mark an unused port as taken, leading to the permanent exhaustion of the relay port...