The whalibmob npm package contains malicious code that silently subscribes the installer's authenticated WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries to attacker-chosen WhatsApp Channel/Newsletter JIDs. The targeted JIDs are obfuscated or dynamically fetched to evade detection. The malicious behavior does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The xvinleys npm package (version 1.0.0) is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. It achieves this by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The xzbails npm package, versions 0.0.3, 0.0.4, and 0.0.5, is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package xzvbails (version 0.0.1) is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channel JIDs are obfuscated or fetched remotely, allowing dynamic control by the attacker. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code beyond this subscription action.
The npm package xzvexpzcbailey is part of a large family of malicious forks of the Baileys WhatsApp Web library. These packages inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious behavior abuses the installer's own WhatsApp session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package yonzoffic-baileys version 8.6.90 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. The malicious code uses the installer's authenticated WhatsApp session to issue a covert FOLLOW query to subscribe to hidden WhatsApp Channel/Newsletter JIDs. The target JIDs are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. This behavior does not steal credentials, establish persistence, or execute arbitrary code.
The npm package yonzofficial (versions 2.1.0 through 2.1.3) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
A heap-based buffer overflow vulnerability exists in parted when processing specially crafted FAT32 filesystem images due to an integer calculation error during buffer allocation. This flaw can be exploited locally by enticing a user or automated service to open a malicious filesystem image, potentially causing an application crash resulting in denial of service or memory corruption. The vulnerability requires local user interaction and does not affect network-exposed services. The impact is primarily denial of service with limited confidentiality and integrity impact.
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occurs when evaluating YCbCr420 display emulation. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service.
CVE-2026-47518 is a vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves incorrect permission assignment in a secure microcontroller component, allowing a local attacker with high privileges to modify protected memory. Exploitation could lead to code execution and privilege escalation. The vulnerability has a medium severity rating with a CVSS score of 6. No specific affected versions or patches are provided in the available data.
CVE-2026-47565 is a race condition vulnerability in the NVIDIA GeForce GPU Display Driver for Linux kernel mode layer. It allows a privileged user to trigger an out-of-bounds write due to improper synchronization. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.4, indicating medium severity. No specific affected versions or patch information are provided.
CVE-2026-47547 is an improper input validation vulnerability in the NVIDIA GeForce GPU Display Driver firmware for Windows and Linux. Exploitation could allow attackers with high privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The vulnerability has a CVSS score of 6.7, indicating medium severity. No specific affected versions or patch information is provided.
CVE-2026-47546 is a vulnerability in the NVIDIA GeForce GPU Display Driver firmware for Windows and Linux. It involves improper input validation, which could be exploited by an attacker with high privileges. Successful exploitation may result in code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. No specific affected versions or patches are provided in the available data.
CVE-2026-47543 is a vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux involving improper input validation in the kernel mode layer. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.7, indicating medium severity. No specific affected versions or patch information is provided.
CVE-2026-103470 is a critical privilege escalation vulnerability in Internet2 Grouper before version 7.5.1. It affects configurations where users are allowed to create or edit rules via the User Interface, enabling them to escalate their privileges improperly.
CVE-2026-47542 is a vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux involving improper input validation in the kernel mode layer. Exploitation could allow attackers with high privileges to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The CVSS score is 6.7, indicating medium severity. No specific affected versions or patch information are provided.
CVE-2026-47538 is an out-of-bounds write vulnerability in the NVIDIA GeForce GPU Display Driver firmware for Windows and Linux. Exploitation could allow code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.7, indicating medium severity. No specific affected versions or patch information are provided.
CVE-2026-47537 is an out-of-bounds write vulnerability in the NVIDIA GPU Display Driver for Linux kernel mode layer. Exploitation could allow code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.7, indicating medium severity. No specific affected versions or patches are provided in the available data.
CVE-2026-47533 is a vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It involves improper validation of an array index in the kernel mode layer. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a CVSS score of 6.7, indicating medium severity. No specific affected versions or patch information are provided.