Google fixes actively exploited Android zero-day on Pixel devices

🕵️ RESEARCH & DEEP DIVES

• FluentBoards WordPress plugin before 2.0.15 lets board members perform manager-only actions (CVE-2026-89328)
  The FluentBoards WordPress plugin before 2.0.15 fails to verify board-manager privileges, letting any board member perform manager-only actions.

  • Affects WordPress sites running the FluentBoards plugin in any version before 2.0.15.
  • Improper access control (CWE-284): the plugin checks only board membership, not board-manager privileges, before board-management operations.
  • Any board member can add or remove members and enable public access to a private board.
  • Vulnerability found by vuxvinh, coordinated and published by WPScan (CVE-2026-89328).
  Sources 📄 Source: wpscan.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Google fixes actively exploited Android zero-day on Pixel devices — BleepingComputer

• Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells — The Hacker News

• Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens — The Hacker News

• PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting — CrowdStrike Blog

• Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impact... — CVE ThreatInt

• Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabGitLab has remedia... — CVE ThreatInt

• Improper Control of Resource Identifiers ('Resource Injection') in GitLabGitL... — CVE ThreatInt

• Missing Authorization in GitLabGitLab has remediated an issue in GitLab CE/EE... — CVE ThreatInt

• Missing Authorization in GitLabGitLab has remediated an issue in GitLab EE af... — CVE ThreatInt

• Incorrect Authorization in GitLabGitLab has remediated an issue in GitLab EE ... — CVE ThreatInt

• Appointment Hour Booking before 1.5.95 - Unauthenticated Booking Capacity Bypass v... — CVE ThreatInt

• Eventin before 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross... — CVE ThreatInt

• Royal Elementor Addons before 1.7.1067 - Unauthenticated Stored HTML Injection in ... — CVE ThreatInt

• Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Ro... — CVE ThreatInt

• FluentBoards before 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by... — CVE ThreatInt

• KBoard before 6.7 - Unauthenticated Board Media Deletion via IDORThe kboard WordPr... — CVE ThreatInt

• WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings UpdateThe WPBot WordPres... — CVE ThreatInt

• OpenAI Agent Swarm Linked to 3,022 Malicious RubyGems Packages in GemStuffer Campaign — Cyber Security News

• Microsoft Teams IT Support Calling? Not So Fast, Hackers are Exploiting Trust in Spring Ring — securityboulevard.com (discovered)

• CISOs to Watch in Dallas-Fort Worth: From the Flight Line to the Boardroom — securityboulevard.com (discovered)

• How to Secure AI-Powered Computer Vision Applications: Authentication, Authorization, and Data Protection — securityboulevard.com (discovered)