NewsThe Hacker News
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
More on Third-Party
Other advisories
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- Not ratedosv:CVE-2026-116692MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Not ratedosv:CVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Not ratedosv:CVE-2026-97400jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
- Not ratedosv:CVE-2026-91858Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
Other news entries
- Attackers compromised 42 GitHub repositories by using files too large to be searchedNewsCSO Online
- Warp discloses breach exposing AI agent logs, user telemetry dataNewsBleepingComputer
- Solflare's staking provider has validator keys compromised; rewards halted on ~1.6M delegated SOLBreachpwn.watch
- Bubble says an attacker accessed users' third-party API keys and tokens in an active security incidentBreachpwn.watch
- Atlassian Patches 75 Flaws in Data Center and Server ProductsNewsSecurityWeek
- Predict.fun: about 400,000 USDT drained from user wallets; third-party API docs site suspectedBreachpwn.watch
- Major U.S. banks detect unauthorized third-party AI agents inside customer accountsBreachpwn.watch
- Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposedBreachpwn.watch
Source: https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html
ID