CVE-2026-79403 is a high-severity vulnerability in Kilo Code versions before 7.4.1 that allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint. This vulnerability has a CVSS score of 8.4, indicating a significant risk. There is no information about an official patch or vendor advisory in the provided data.
CVE-2024-31027 is a Cross Site Scripting (XSS) vulnerability in the Greek Universities Network (GUnet) Open eClass Platform version 3.15. It allows a remote attacker to execute arbitrary code by exploiting the last name, first name, and username parameters in the user registration functionality. The vulnerability has a medium severity with a CVSS score of 5.4. No patch or remediation information is currently provided.
metatool-ai MetaMCP versions up to and including 2.4.22 contain a critical remote code execution vulnerability in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio. This flaw allows unauthenticated attackers to execute arbitrary code on the affected system without user interaction.
mark3labs mcp-filesystem-server version 0.11.1 contains a directory traversal vulnerability due to improper handling of dangling symbolic links in the validatePath function. This flaw allows certain file operations to create or modify files outside the intended allowed directories by following unresolved symlinks. The vulnerability has a medium severity with a CVSS score of 5.9.
CVE-2024-31026 is a critical remote code execution vulnerability in Greek Universities Network (GUnet) Open eClass Platform version 3.15. It allows an unauthenticated attacker to execute arbitrary code by sending crafted input through the chat field in the course module. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation information is currently provided.
CVE-2026-77177 is a critical vulnerability in Open GenAI Stack (ogx-ai) used by Meta AI backend for WhatsApp and other products. It allows unauthenticated remote attackers to execute arbitrary code via prompt injection exploiting unsanitized Jinja2 template syntax for server-side expression evaluation. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
CVE-2026-18747 is an integer underflow vulnerability in the Zephyr project's MCUmgr SMP-over-console transport. It occurs when a malformed base64 frame declares a packet length of zero or one, causing an underflow during CRC stripping and resulting in an inflated packet length. This leads to out-of-bounds reads in the SMP request processing, potentially causing denial of service or memory disclosure. The vulnerability can be triggered by an unauthenticated 7-byte input on the management console, such as a USB CDC-ACM port. A fix is available that rejects packet lengths of two bytes or fewer, preventing the underflow.
CVE-2026-18746 is a memory-safety vulnerability in the Zephyr project affecting the LwM2M CoAP block-wise write handling. It occurs when the function parse_write_op() improperly dereferences a NULL pointer due to a logic flaw in handling block contexts during inbound CoAP WRITE/CREATE requests with the Block1 option. This can cause a fatal memory fault leading to device crashes or resets. The vulnerability does not affect confidentiality or integrity. It impacts Zephyr versions from 3.7.0 up to but not including 4.5.0.
CVE-2026-18417 is a memory-safety vulnerability in the Zephyr project's native BSD-socket layer affecting versions 4.3.0 up to but not including 4.4.2. The issue arises from improper handling of asynchronous socket errors by storing error codes in a field expected to hold a pointer, leading to wild-pointer dereferences during repeated network interface down events. This results in a kernel fatal error causing denial of service (device crash or reset) but does not allow attacker-controlled memory corruption. The vulnerability requires an attacker to repeatedly cause link-down events, such as disrupting a wireless link or having local/physical access. Later versions fix this by separating error storage from the user_data field and preventing stale error propagation.
CVE-2026-101264 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. The flaw exists in the /api/ZRnetwork/set_passwd endpoint where manipulation of the password1 argument allows remote attackers to execute arbitrary commands. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. Exploitation requires no user interaction and can be performed remotely with high impact on confidentiality, integrity, and availability.
The IBM Semeru Runtime Certified Edition 21 runtime environment.
Security Fix(es):
* OpenJDK: Improve Resource Resolving (2026-08 Security Update) (CVE-2026-60589)
* OpenJDK: Enhance HTTP Connections (2026-08 Security Update) (CVE-2026-61308)
* OpenJDK: Enhance TLS server (2026-08 Security Update) (CVE-2026-70907)
* openj9: Eclipse OpenJ9: Denial of Service via crafted .class file (CVE-2026-16440)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-101263 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. The flaw exists in the processing of the /api/ZRQos/set_online_client endpoint, where manipulation of the 'mac' argument allows remote attackers to execute arbitrary commands. The vulnerability has a high CVSS score of 9.4 and public exploit code is available. The vendor has not responded to disclosure requests and no patch or mitigation has been provided.
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
ZoneMinder versions before 1.38.4 contain static buffer overflow vulnerabilities in the RemoteCameraHttp::GetResponse() function. These vulnerabilities arise from processing oversized HTTP response headers sent by malicious HTTP cameras or intercepting attackers. Crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries can corrupt parser state, leading to crashes or memory corruption in the capture process.
ZoneMinder versions before 1.38.4 have a vulnerability where per-monitor access restrictions are not enforced in the FramesController index endpoint. Authenticated users with Events view permission can access frame records from monitors they should not have access to, leading to unauthorized disclosure of event and frame metadata across monitor boundaries. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-101260 is a critical command injection vulnerability in Ziroom ZHOME A0101 version 1.0.1.0. It affects the /api/ZRnetwork/firstLogin endpoint, allowing remote attackers to manipulate the firstLogin argument to execute arbitrary commands. The vulnerability is publicly known and exploitable, but the vendor has not responded or provided a fix.
The npm package 'rai6jaisahthaghee5ou-loader-package' version 1.0.0 contains malicious code that injects a script element pointing to an attacker-controlled URL. This causes arbitrary JavaScript from the external host to execute within the context of any application bundling this package, enabling full code execution, credential or session theft, and further malicious actions.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc)
hardhat-zet@2.0.1 is published under a name that impersonates the Hardhat Ethereum tooling ecosystem, but its README, type definitions and docs/ tree are copied verbatim from the unrelated `pino` logger project (badges and links point at npmjs.com/package/pino and github.com/pinojs/pino). The exported `middleware` in index.js is a no-op Express middleware and matches neither the `hardhat-zet` name nor the pino README. The package's declared main (index.js) top-level-requires./lib/config, which is not a configuration file but a 4,498,609-byte obfuscator.io-style bundle: a 26,113-entry rotated string array behind two runtime decoders (functions v and F), hex-encoded identifiers, and control-flow flattening. All strings and destination URLs are hidden behind the decoders, so this code runs automatically on any `require('hardhat-zet')` and its behavior is not observable without deobfuscation. Publisher metadata (author 'Robert King <hello@jsonspack.com>', bugs URL https://jsonspack.com/issues) ties to neither the Hardhat nor the pino identity. The combination — ecosystem-typosquat name targeting crypto/Hardhat developers, cover-story README lifted from an unrelated popular package, no-op public API, and a multi-megabyte obfuscated payload auto-executed on import — is the shape of a supply-chain stealer aimed at Ethereum developers.
## Source: ghsa-malware (781273d2c802d3781fecccd4434ba418c93ce88edf920b2a1163dbacf7576254)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package hardhat-lock@2.21.0 is a malicious package that impersonates a legitimate logging/middleware library but contains a large, heavily obfuscated payload that executes immediately upon import. This payload grants attacker-controlled code unrestricted access to environment variables, filesystem, and network within the Node.js process. The package misuses the Ethereum tooling keyword 'hardhat' and copies unrelated project documentation to disguise its true nature.