New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, the research found...

CVE-2026-15148 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...

EUVD-2026-54327

Server-side request forgery ssrf in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-54316

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-54296

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

CVE-2026-70332

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-62918

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network...

Apple Security Advisory 07-27-2026-8

Apple Security Advisory 07-27-2026-8 - Safari 26.6 addresses out of bounds access, spoofing, and use-after-free vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-18487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user click...

Apple Security Advisory 07-27-2026-1

Apple Security Advisory 07-27-2026-1 - iOS 26.6 and iPadOS 26.6 addresses buffer overflow, bypass, code execution, heap corruption, information leakage, integer overflow, out of bounds access, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...

Apple Security Advisory 07-27-2026-6

Apple Security Advisory 07-27-2026-6 - watchOS 26.6 addresses buffer overflow, bypass, code execution, double free, information leakage, integer overflow, out of bounds access, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...

Apple Security Advisory 07-27-2026-2

Apple Security Advisory 07-27-2026-2 - macOS Tahoe 26.6 addresses buffer overflow, bypass, code execution, denial of service, heap corruption, information leakage, integer overflow, out of bounds access, out of bounds read, out of bounds write, spoofing, traversal, and use-after-free...

Apple Security Advisory 07-27-2026-5

Apple Security Advisory 07-27-2026-5 - tvOS 26.6 addresses buffer overflow, bypass, code execution, double free, heap corruption, information leakage, integer overflow, out of bounds access, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...

Apple Security Advisory 07-27-2026-7

Apple Security Advisory 07-27-2026-7 - visionOS 26.6 addresses buffer overflow, bypass, code execution, double free, heap corruption, integer overflow, out of bounds access, out of bounds read, out of bounds write, spoofing, and use-after-free vulnerabilities...

PT-2026-76578

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp read trailer and merges them into request headers. The fix introduces evhttp parse headers impl and a temporary trailer header list. An unauthenticated...

CVE-2026-70332

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-70332

CVE-2026-70332 describes a server-side request forgery (SSRF) in Microsoft Office SharePoint that allows an unauthorized attacker to perform network spoofing. The connected sources consistently identify SharePoint as affected and report SSRF as the underlying issue, with related entries also refe...

CVE-2026-70332 Microsoft Office SharePoint Spoofing Vulnerability

...

CVE-2026-70332 Microsoft Office SharePoint Spoofing Vulnerability

...

CVE-2026-62918

CVE-2026-62918 affects Microsoft Teams and stems from improper verification of a cryptographic signature, enabling an unauthorized attacker to spoof over a network. The CVSS v3.1 base score is 7.5 (HIGH), with network as the attack vector, no user interaction required, and the core impact on inte...