Threats Affecting Ireland

CVE-2026-23736 is a high-severity prototype pollution vulnerability in the seroval JavaScript value stringification library (versions below 1.4.1). The flaw arises from improper input validation during JSON deserialization, allowing attackers to modify object prototype attributes maliciously. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Successful attacks can lead to partial compromise of confidentiality, integrity, and availability of affected applications. The vulnerability is fixed in seroval version 1.4.1. European organizations using vulnerable versions in their JavaScript environments should prioritize updating to mitigate risks.

HighVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-23736#cwe-1321

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet size is not verified properly for SFTP packets. As a result when multiple SSH packets (conforming to max SSH packet size) are received by ssh, they might be combined into an SFTP packet which will exceed the max allowed packet size and potentially cause large amount of memory to be allocated. Note that situation described above can only happen for successfully authenticated users after completing the SSH handshake. This issue has been patched in OTP versions 27.2.4, 26.2.5.9, and 25.3.2.18. There are no known workarounds for this vulnerability.

HighVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-26618#cwe-789

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-13437#cwe-706

### Summary Files denied by [`server.fs.deny`](https://vitejs.dev/config/server-options.html#server-fs-deny) were sent if the URL ended with `\` when the dev server is running on Windows. ### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using --host or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - running the dev server on Windows ### Details `server.fs.deny` can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass by using a back slash(`\`). The root cause is that `fs.readFile('/foo.png/')` loads `/foo.png`. ### PoC ```shell npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173 ``` <img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-62522#cwe-22

CVE-2025-58752 is a low-severity relative path traversal vulnerability in the vitejs vite development and preview servers. It allows an attacker to retrieve arbitrary HTML files from the server filesystem regardless of the configured file system access restrictions, if the Vite dev server is exposed to the network and using default or specified app types. This occurs because certain middlewares serving HTML files do not enforce allow or deny rules or root directory restrictions. The vulnerability affects vite versions prior to 5.4.20.

LowVulnerabilityGermanyFranceNetherlands+6#cve#cve-2025-58752#cwe-23

CVE-2025-69228 is a medium severity vulnerability in aiohttp versions prior to 3.13.3 that allows an attacker to exhaust server memory by crafting malicious HTTP requests targeting handlers using the Request.post() method. This flaw arises from the lack of resource allocation limits or throttling, causing uncontrolled memory consumption and potential server freeze or denial of service. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, affected servers remain at risk until patched. European organizations using aiohttp-based asynchronous Python web servers should prioritize updating to version 3.13.3 to mitigate this risk.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2025-69228#cwe-770

CVE-2025-69225 is a low-severity HTTP request smuggling vulnerability in aio-libs aiohttp versions prior to 3.13.3. It arises from the parser allowing non-ASCII decimal characters in the HTTP Range header, potentially enabling inconsistent interpretation of HTTP requests. Although no known exploits or impacts have been reported, this flaw could theoretically be leveraged to smuggle HTTP requests, leading to request desynchronization between front-end and back-end servers. The vulnerability is fixed in aiohttp 3.13.3. European organizations using vulnerable aiohttp versions in asynchronous Python web services should upgrade promptly to mitigate risk. Given the low CVSS score and lack of known exploits, the threat is currently low but should not be ignored in sensitive environments.

LowVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-69225#cwe-444

### Summary Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system. ### Details When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. i.e. An application is only vulnerable with setup code like: ``` app.router.add_routes([ web.static("/static", "static/", follow_symlinks=True), # Remove follow_symlinks to avoid the vulnerability ]) ``` ### Impact This is a directory traversal vulnerability with CWE ID 22. When using aiohttp as a web server and enabling static resource resolution with `follow_symlinks` set to True, it can lead to this vulnerability. This vulnerability has been present since the introduction of the `follow_symlinks` parameter. ### Workaround Even if upgrading to a patched version of aiohttp, we recommend following these steps regardless. If using `follow_symlinks=True` outside of a restricted local development environment, disable the option immediately. This option is NOT needed to follow symlinks which point to a location _within_ the static root directory, it is _only_ intended to allow a symlink to break out of the static directory. Even with this CVE fixed, there is still a substantial risk of misconfiguration when using this option on a server that accepts requests from remote users. Additionally, aiohttp has always recommended using a reverse proxy server (such as nginx) to handle static resources and _not_ to use these static resources in aiohttp for production environments. Doing so also protects against this vulnerability, and is why we expect the number of affected users to be very low. ----- Patch: https://github.com/aio-libs/aiohttp/pull/8079/files

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2024-23334#cwe-22

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. ### Patches This has been fixed in [pypdf==6.1.3](https://github.com/py-pdf/pypdf/releases/tag/6.1.3). ### Workarounds If you cannot upgrade yet, consider applying the changes from PR [#3502](https://github.com/py-pdf/pypdf/pull/3502).

MediumVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-62708#cwe-409

Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.

MediumMalwareUnited StatesAngolaArgentina+46#phpmyadmin#gh0st rat#china-nexus