CVE-2026-101145 is an LDAP injection vulnerability in Eleveo Call Recording Software version 9.7.0. It affects the User Management component, specifically the /callrec/userAddAction.do endpoint, where the Username argument can be manipulated to perform LDAP injection. The vulnerability can be exploited remotely without user interaction. No vendor patch or official fix has been provided yet. Public exploit code is available. The CVSS score is 5.3, indicating medium severity.
Eleveo Call Recording Software version 9.7.0 contains a vulnerability in the Query Builder component, specifically in the /callrec/searchAction.do file, that leads to improper access controls. This flaw allows remote attackers to exploit the system without user interaction and with low privileges. The vulnerability has a medium severity rating and a CVSS score of 5.3. The vendor has not responded to disclosure attempts, and no official patch or remediation guidance is currently available.
NeedyMantis is a modular post-compromise malware family deployed in limited targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Active since at least October 2025, the malware is typically deployed after threat actors have established access, serving to maintain long-term persistence and support follow-on operations. Its architecture combines multiple loaders, custom encrypted file archives, a custom executable file format, and modular components enabling operators to evade analysis and extend functionality. The malware employs DLL sideloading, WebSockets-based command-and-control communications, and RC4 encryption. Activity aligns with China-based threat actors, with Storm-3069 identified as one operator using NeedyMantis following the DAEMON Tools supply chain compromise.
Eleveo Quality Management version 9.7.0 contains an information disclosure vulnerability related to the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. This vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has not responded to disclosure attempts, and public exploit code is available. The CVSS score is 4.3, indicating a low severity issue.
The llm-nebula npm package version 1.0.0 contains a malicious preinstall script that executes automatically during installation. This script is heavily obfuscated and runs with the user's privileges, enabling arbitrary filesystem, process, and network operations. The package pretends to be a legitimate LLM SDK but includes a runtime decoder that dynamically resolves Node.js built-in modules and commands, allowing remote code execution at install time.
Eleveo Quality Management version 9.7.0 contains a path traversal vulnerability in the Scorecard.jsp file within the Questionnaire Audio Upload component. This vulnerability allows remote attackers with low privileges to manipulate file paths, potentially leading to unauthorized file access or modification. The issue has a medium severity with a CVSS score of 6.3. No patch or remediation guidance is currently available, and the vendor has not responded to notifications. Although public exploit details exist, there have been no reports of exploitation in the wild.
A use-after-free vulnerability exists in GCC's libstdc++ library when the erase_if function is called on a binary heap priority queue. This flaw causes the library to reallocate storage without updating its internal entry pointer, potentially leading to application crashes or memory corruption. The vulnerability can be exploited to cause denial of service. Red Hat has issued a security advisory with updated packages to address this issue.
A vulnerability in the StreamsHub Console for Apache Kafka allows a Console custom resource author to exfiltrate sensitive credentials by setting certain Kafka client properties without filtering security-sensitive keys. This flaw leads to unauthorized disclosure of the console-api ServiceAccount token to an attacker-controlled Kafka broker. The issue arises because tenant-supplied Kafka client properties are copied directly into the console-api AdminClient configuration without proper filtering.
A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be initiated from a local position. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will. The file declares "use server" at file scope, so every exported function compiles into a POST-invokable Server Action; revalidateProducts calls updateTag("products") with no session or role check, unlike the read-only actions in the same file which are safe by construction. Two client components under src/components/admin import the function, which causes its Server Action id to be compiled into a public /_next/static chunk that the application's admin middleware (proxy.ts) does not gate, so any unauthenticated user can extract that id from the public bundle and invoke the action directly. With cacheComponents enabled, the entire storefront (home, categories, product pages, search) is served from "use cache" entries produced by getAllProducts, getCategoryProducts and getProduct, all tagged products with an hours-long cacheLife. Repeated unauthenticated invocation of revalidateProducts keeps that cache permanently cold, forcing every visitor's request to read the full product catalog from Postgres instead of serving from cache, degrading storefront availability at near-zero attacker cost.
The npm package simple-date-formatter-new-12@1.0.0 contains malicious code in its postinstall script that executes automatically during installation. This script fetches data from an internal Baidu host and exfiltrates the response to an attacker-controlled server. The package's stated functionality is a simple date formatter, but the embedded network activity is unrelated and indicative of a dependency confusion or typosquatting attack to probe internal network access and leak data.
The nebulaai-sdk npm package version 1.0.0 contains malicious code that executes a hidden Windows executable during installation on Windows systems. This executable is disguised as a legitimate Windows console host binary and establishes a remote command-and-control connection. The package lacks legitimate SDK functionality and solely serves to deploy and run this malicious payload, resulting in arbitrary code execution under the installing user's context.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4)
On every `require('figlet-chalk-render')`, a top-level IIFE queries `https://registry.npmjs.org/figlet-chalk-render/latest` and, if a newer version exists, spawns `npm install figlet-chalk-render@<latest>` with cwd set to `path.join(__dirname, '..', '..')` (the consumer project's root) and stdio ignored. The `https`, `child_process`, and `path` core-module names are loaded via hex-escaped string literals (`'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73'`, etc.) rather than plain identifiers, deliberately hiding the sensitive requires backing the auto-update. The behavior is undocumented in the README. Every consumer that imports the module receives whatever the latest published version happens to be at that moment, executed with the installer's npm privileges and lifecycle scripts, giving anyone who later controls this package name a silent code-execution channel into every installer's project tree. The hex-obfuscation of the module names is anti-evasion and rebuts a benign-self-update reading: legitimate insecure-update code does not disguise `require('child_process')`.
The npm package chalk-figlet version 1.2.0 contains malicious code that executes during installation. It runs a postinstall script that downloads a binary named RuntimeBroker.exe from an untrusted HTTP source and executes it on the host system. The package masquerades as a harmless chalk and figlet wrapper but performs unauthorized code execution.
The npm package nebula-llm version 1.0.0 contains a malicious preinstall script that executes a hidden Windows executable during installation. This executable impersonates a legitimate Windows system binary and acts as a persistent remote-access implant. The package installs this implant without user interaction and unrelated to any documented functionality.
The fabric-asset-pipeline npm package version 1.0.0 and 1.0.1 contains malicious code that executes during installation. This code is heavily obfuscated and designed to steal Minecraft account credentials from multiple launchers by reading local credential stores and session dumps. The stolen data, including account names, access tokens, and refresh tokens, is exfiltrated to a hardcoded remote webhook. Additional system information such as hostname, username, platform, and Minecraft username is also sent to the attacker. This malicious behavior is hidden from the package's advertised functionality and is not part of its legitimate purpose.
The npm package fabric-render-bridge (version 1.0.0) contains malicious code that executes automatically upon installation. Instead of providing rendering functionality, it steals Minecraft launcher credentials and system information, sending them to a hardcoded Discord webhook. This behavior occurs during the post-install script execution, compromising user credentials and host identity.
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.
FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7.
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.