The npm package @hrmony/hyper-json-builder version 1.99.0 contains malicious code that, upon loading, contacts a hardcoded attacker-controlled endpoint to exfiltrate sensitive information. It harvests environment variables, Kubernetes secrets, and AWS EC2 instance metadata credentials, sending these to the attacker. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately. Removal of the package alone may not eliminate the compromise.
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in the expat_realloc() function on 32-bit platforms. This vulnerability can cause heap buffer overflow, memory corruption, or denial of service when processing malicious XML data. The CVSS score is 5.9, indicating medium severity.
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain a vulnerability in the GIF decoder's application extension handler that can disclose uninitialized heap memory. This occurs when processing crafted malicious GIF files, causing the number parser to read and store uninitialized heap memory as image metadata. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-102560 is a heap buffer overflow vulnerability in the libsoup library used by Red Hat Enterprise Linux 9. It occurs when the permessage-deflate WebSocket extension compresses a very large outgoing message, causing size calculations to wrap and zlib to write beyond allocated memory. This flaw can lead to memory corruption and potential denial of service or other impacts. Red Hat has released security updates addressing this issue in libsoup packages for Red Hat Enterprise Linux 9.
A heap buffer overflow vulnerability (CVE-2026-102559) exists in libsoup2.4 when constructing masked WebSocket client frames for very large outgoing payloads. The issue arises from truncation of size values passed to GByteArray allocation APIs while the masking routine uses the full length, leading to heap corruption or denial of service. Exploitation requires sending an extremely large WebSocket message, which depends on whether the application permits attacker-controlled message sizes. Red Hat has released security updates addressing this and related heap overflow issues in libsoup for Red Hat Enterprise Linux 9.
CVE-2026-102558 is a heap buffer overflow vulnerability in libsoup's SoupWebsocketConnection component triggered when max-incoming-payload-size is set to unlimited (0). This allows excessive buffer growth leading to integer wrap and heap corruption during frame data processing. The flaw can cause denial of service or potential information disclosure. Red Hat has released security updates for Red Hat Enterprise Linux 9 to address this issue.
A heap buffer overflow vulnerability exists in libsoup's soup_uri_decode_data_uri() function in Red Hat Enterprise Linux 10. The function incorrectly handles base64 data-URI payloads containing embedded NUL bytes, leading to an uninitialized decoded length. This flaw can cause an out-of-bounds read or application crash when processing crafted data URIs. Red Hat has released an important security update addressing this issue in libsoup3.
A new variant of the Spectre v2 speculative execution side-channel attack, called Branch Target Reuse (BTR), has been demonstrated to leak Linux root password hashes on Intel-based systems within minutes. This attack exploits stale branch predictor information when just-in-time (JIT) compiled code is replaced but the CPU still speculatively executes instructions based on old predictions. Researchers confirmed this vulnerability affects modern CPUs from Intel, AMD, and ARM. Fixes have been merged into the Linux kernel to address this issue.
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process.
CVE-2026-102623 is a vulnerability in Red Hat OpenShift Virtualization 4's KubeVirt component where an authenticated user with permission to create Virtual Machine Instances can cause a denial of service. This occurs by submitting a virtual machine definition containing an empty ephemeral volume, which leads the virt-controller to crash due to improper validation. The crash causes the controller to enter a continuous crash loop, disrupting virtual machine lifecycle operations cluster-wide.
CVE-2026-102425 is a critical remote code execution vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The vulnerability arises from improper control of code generation (CWE-94) due to the way administrator-defined PHP code executes after public form submissions. Specifically, the extension replaces form-field shortcodes with user-submitted values inside a double-quoted PHP string before calling eval(), enabling attackers to inject and execute arbitrary PHP code. Exploitation requires the use of the optional PHP-after-submission feature with an attacker-controlled shortcode. The vulnerability has a CVSS 4.0 score of 9.5, indicating critical severity. No official patch or vendor advisory is provided in the data, and no known exploits in the wild have been reported.
CVE-2026-101126 is a medium severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.3. The flaw involves improper limitation of pathname to a restricted directory, allowing potential path traversal and metadata tampering. The vulnerability arises because the extension processes JSON arrays per upload field, trusting client-supplied filenames and display names without sufficient validation. This can lead to cross-session claiming and unauthorized file metadata manipulation.
Branch Target Reuse (BTR) is a newly disclosed variant of the Spectre v2 attack affecting Intel, AMD, and Arm CPUs. It targets just-in-time (JIT) compilers used in operating system kernels, web browsers, and language runtimes. The attack exploits stale indirect branch prediction entries that persist after code modifications, enabling speculative execution attacks that can leak sensitive data such as password hashes. Researchers demonstrated exploits against the Linux kernel and browser engines like Firefox's SpiderMonkey. Mitigations require software updates, including use of indirect branch prediction barriers (IBPB). Hardware protections reduce but do not eliminate the risk. Vendors acknowledge the issue and have started rolling out mitigations, but no complete fix exists in hardware yet.
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component's JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.
CVE-2026-102796 is a high-severity SQL Injection vulnerability in the Wikimedia Foundation's Mediawiki UserPageViewTracker Extension. It affects multiple versions prior to 1.46.1, 1.45.5, and 1.43.10. The flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to unauthorized disclosure of data but does not impact integrity or availability according to the CVSS vector.
CVE-2026-100242 is a high-severity vulnerability in the Wikimedia Foundation Mediawiki DataTransfer Extension. It involves a dependency on a vulnerable third-party component that leads to uncontrolled resource consumption, specifically excessive memory allocation. The issue affects versions from 1.46.0 up to but not including 1.47.0 of the DataTransfer Extension.
CVE-2026-90916 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It allows unauthorized users with high privileges to view content that should be inaccessible via the content history comparison view. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5)
The package's preinstall script and its main entry (index.js) both perform identical credential-harvesting: they query the EC2 Instance Metadata Service (IMDSv2) at 169.254.169.254 for the identity document and IAM role security credentials, enumerate the entire process.env, and recursively read /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets). The collected data is POSTed to a hardcoded attacker-controlled host at hrnmn.dd.h4x.tv (paths /save_instance_info_hook from preinstall and /save_instance_info_index from index.js). The destination is unrelated to any legitimate package purpose, there is no user configuration, and the behavior fires automatically on `npm install` via the preinstall lifecycle hook as well as on any `require()`/`import` of the package. The harvested material — temporary AWS IAM credentials, cloud instance identity, arbitrary environment variables (which routinely contain API keys, tokens, and database credentials in CI/build environments), and Kubernetes service-account tokens — grants immediate cross-service access to the installer's cloud and cluster resources.
## Source: ghsa-malware (07386b2d1e2efa71fd38c591953684c11302ad77f1c7943bd542b71fd83184e3)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @hrmony/benefit-essenszuschuss (version 3.99.0) contains malicious code that, upon import, harvests cloud and container secrets from the host environment. It retrieves AWS IAM role credentials via the Instance Metadata Service (IMDSv2), collects environment variables, and reads Kubernetes secrets from the filesystem. This sensitive data is then exfiltrated to a hardcoded attacker-controlled endpoint. The package mimics an internal HR utility and includes an unpinned dependency, facilitating a dependency confusion attack. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/account-management version 1.99.0 contains malicious code that executes upon import. It collects sensitive AWS instance metadata, environment variables, and Kubernetes secrets, then exfiltrates this data to an attacker-controlled server. This package is part of a dependency confusion or scope-squatting attack targeting an internal npm scope. Systems with this package installed should be considered fully compromised, and all secrets must be rotated immediately.