NewsThe Hacker News
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
More on Third-Party
Other advisories
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- CriticalCVE-2026-116692MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
- Not ratedosv:CVE-2026-116692MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- MediumCVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Not ratedosv:CVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Not ratedosv:CVE-2026-97400jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)
Other news entries
- Japan Airlines suffers third-party data breach exposing passenger infoNewsBleepingComputer
- Polymarket halts trading after crypto-draining script breach, $2.5M tracedNewsBleepingComputer
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 MillionNewsSecurityWeek
- Polymarket halts trading after a compromised third-party provider drains user wallets through its websiteBreachpwn.watch
- Attackers compromised 42 GitHub repositories by using files too large to be searchedNewsCSO Online
- bunny.net pulls an Armenia CDN node after its hosting provider is breached and reissues TLS certificatesBreachpwn.watch
- Warp discloses breach exposing AI agent logs, user telemetry dataNewsBleepingComputer
- Solflare's staking provider has validator keys compromised; rewards halted on ~1.6M delegated SOLBreachpwn.watch
Source: https://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.html
ID