In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_only=False). Related cache helpers in monai/data/utils.py also call pickle.loads on cached content and derive cache keys with hashlib.md5. As a result, a local user with write access to a shared or world-writable cache_dir (e.g. /tmp/monai_cache, HPC scratch, ~/.cache/monai) can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context. All released versions of the monai pip package are affected; no patched version is available as of the advisory.
MONAI versions prior to 1.6.1 contain a remote code execution vulnerability due to improper neutralization of directives in dynamically evaluated code. This flaw exists in the bundle configuration engine, which resolves _target_ values to arbitrary importable callables without an allow list and evaluates $ expressions using Python's eval(). An attacker can craft a malicious bundle that executes arbitrary code when loaded or run via monai.bundle.load() or monai.bundle.run().
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.
CVE-2026-100744 is a medium severity vulnerability in coollabsio Coolify up to version 4.1.2. It involves missing authorization in a route-level middleware function located in app/Http/Middleware/CanUpdateResource.php. The flaw can be exploited remotely without authentication. An exploit has been published. Upgrading to version 4.2.0 addresses this issue.
A technical audit evaluated the default security configurations of 15 official Helm charts used for AI serving, vector databases, and Model Context Protocol (MCP) agents on Kubernetes. Key findings include plaintext secret handling, unauthenticated remote code execution, and over-privileged agent access due to insecure default settings. Standard static analysis tools failed to detect some issues in Custom Resource Definitions. The report provides reproducible test commands, network logs, and remediation advice. No active exploits are reported, and the findings are based on local test cluster probes.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb)
setup.py invokes a module-level _trigger() that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run(), which downloads https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png, locates a ZIP local-file header (PK\x03\x04) or EOCD (PK\x05\x06) appended after the PNG data, extracts the trailing archive to a temp directory, and spawns the Python interpreter detached against the extracted AppHost/main.py with a DAS_STAGED environment variable used as a reentry guard. All errors are swallowed to keep the operation silent. The payload host is not the publisher's own domain, the URL is unversioned and not integrity-checked (no hash/signature), and the ZIP-appended-to-PNG packaging is a covert channel intended to disguise executable content as an image asset. A source-comment in setup.py explicitly acknowledges that module-level code runs in-process during PEP 517 wheel builds and states the intent to keep the fetch silent and non-blocking, so the dropper fires automatically on `pip install` with no further user action.
## Source: kam193 (c8af51da84b6b458a704ca222ba17f56d1158e0bfa52e0360aaeca4ae07c4cf8)
During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-donutautosellsrc
Reasons (based on the campaign):
- infostealer
- Downloads and executes a remote executable.
- obfuscation
- malware
- native-extension
- steganography
- c2-in-blockchain
- The package contains code to detect if it is running in a sandbox environment.
The requests-cache-utils package version 1.0.0 on PyPI contains malicious code that executes during installation. This code downloads and runs an infostealer designed to exfiltrate browser data. The package overrides the standard install command to perform these malicious actions.
Froxlor versions prior to 2.3.12 have a vulnerability in the DirProtections.listing API command that allows authenticated API users to retrieve bcrypt password hashes from htpasswd files. This exposure enables offline cracking attempts and risks credential reuse compromise.
Froxlor versions 2.0.0 through 2.3.10 contain a stored cross-site scripting (XSS) vulnerability. This occurs when a customer uploads an SSL certificate, and the issuer organization field is stored without sanitization. The vulnerability allows attacker-supplied script to execute in the session of privileged users such as administrators or resellers. Exploitation can lead to full administrator account takeover and potential root command execution on the managed server. The issue is resolved in Froxlor version 2.3.12.
Kyverno versions prior to 1.19.1 have a namespace isolation bypass vulnerability in the apiCall context entry of namespaced Policy resources. This occurs due to inconsistent path interpretation between validation and execution, allowing a low-privilege tenant to use percent-encoded dot-segments in the urlPath to bypass namespace checks. Exploitation enables reading resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.
Froxlor versions through 2.3.10 have an issue where sensitive columns, specifically the dkim_privkey field, are not filtered from API responses in certain domain-related API calls. This allows authenticated non-superadmin admins with the delegated customers_see_all flag to access DKIM private keys of other tenants' domains. The vulnerability enables unauthorized reading of private signing keys, which could be used to sign emails that pass DKIM verification and DMARC alignment. The issue was fixed in version 2.3.12.
froxlor versions up to 2.3.10 contain a vulnerability where an unauthenticated GET request to the two-factor authentication (2FA) management page disables a user's 2FA without confirmation or re-authentication. This occurs because the global CSRF protection does not cover GET requests, and the session cookie's SameSite=Lax setting allows cross-site navigation to carry the session, enabling silent 2FA disablement. Both customer and admin 2FA handlers are affected. The issue is fixed in version 2.3.12.
Froxlor versions 2.3.10 and earlier have a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron job. This flaw allows a local user with shell access to exploit a race between symlink validation and file write operations, potentially leading to root-level compromise of the host running the Froxlor panel. The vulnerability is fixed in version 2.3.12.
Froxlor versions up to and including 2.3.10 have a critical vulnerability where the system.letsencryptchallengepath setting is not properly restricted or escaped. This allows an administrator or any actor able to write settings to inject arbitrary command-line options into the acme.sh command executed by root via cron, leading to arbitrary command execution or file writes as root. The issue is fixed in version 2.3.12.
Kyverno versions before 1.19.1 contain a critical vulnerability in the validation of URL-encoded path segments within the Policy apiCall urlPath. This flaw allows namespace tenants to bypass namespace restrictions and create objects in other namespaces using percent-encoded directory traversal sequences. Exploitation can lead to creation of MutatingWebhookConfiguration objects cluster-wide or PolicyException objects in the kyverno namespace, resulting in privilege escalation to cluster admin.
Froxlor versions up to 2.3.10 have a vulnerability where the mail.allow_external_domains policy is not enforced in the EmailSender.add API command. This allows an authenticated customer with API access to register arbitrary external sender addresses despite policy settings that should prevent this. The issue creates a bypass between the administrator UI configuration and the API, enabling sender spoofing by authorizing sender identities outside the hosted domains. The vulnerability is fixed in version 2.3.12.
Froxlor versions through 2.3.10 have a vulnerability in their two-factor authentication (2FA) remembered-token mechanism. The system stores only a numeric user ID in remembered-2FA tokens without recording the account namespace, causing token lookups to be ambiguous between customer and administrator accounts. This allows an attacker who controls a customer account with a colliding ID and a valid remembered-2FA token, and who knows the administrator's password, to bypass the administrator's TOTP second factor and gain an authenticated administrator session. This vulnerability affects only the second-factor authentication step and does not bypass password authentication. The issue is fixed in version 2.3.12.
In froxlor versions 2.3.10 and earlier, the URL validation function Validate::validateUrl does not properly inspect the userinfo component of URLs for carriage return and line feed characters. This allows an authenticated low-privilege user with subdomain creation rights to inject malicious payloads into the web server configuration. The injected directives can execute with root privileges, enabling server-wide impact such as response hijacking or local file reading. The vulnerability is fixed in version 2.3.12.