TWCERT/CC disclosed two code injection flaws in TeamPlus Messenger 16.8.0 through 17.0.6, each rated 8.8 under CVSS 3.1. Attackers who trick users into opening crafted links or content can run code after a Windows warning; version 17.0.7 fixes them.
If the user then confirms a Windows security warning, the attacker can run arbitrary code with that user's privileges.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
CVE-2026-110536 is an unauthenticated OS command injection flaw in the HNAP handler of D-Link DIR-868L firmware 2.01b05, rated 10.0 by VulDB. Exploit code is public, and D-Link no longer patches the end-of-life router.
CISA added PAN-OS flaw CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14, giving federal agencies until October 17 to act. The management-interface bug lets authenticated attackers run code as root; Palo Alto reports very limited exploitation.
Adobe disclosed CVE-2026-106634, a path traversal flaw in Experience Manager 6.5 LTS SP3 and earlier and 6.5.25 and earlier that lets low-privileged attackers write files to unauthorized locations. Adobe rates it 7.7 under CVSS 3.1.
A critical SQL injection vulnerability assigned CVE-2026-97668 affects the Abandoned Cart Pro for WooCommerce plugin in all versions through 10.8.0. Unauthenticated attackers can extract database information and escalate privileges to administrator via the wp_usermeta table.
Powerlevel10k through 1.20.0 has CVE-2026-110102, an insecure download flaw in its gitstatus installer. VulnCheck rates it 7.5 under CVSS 3.1 and 7.7 under CVSS 4.0; NVD has not scored it. The maintainer confirmed the report and advised against installing on systems without digest tools where a man-in-the-middle attack is possible.
