The npm package 'serpacksven' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious components, as the attacker may have gained full control of the system.
This content is an invitation to a Reddit Ask Me Anything (AMA) session hosted by IBM Security experts Jeff Crume and Guido Crucq. They discuss cybersecurity trends and findings from the Cost of a Data Breach Report, which analyzes real-world data breaches. No specific vulnerability, exploit, or active breach details are provided.
CVE-2025-15643 is a high-severity reflected cross-site scripting (XSS) vulnerability in Jose Fernandez Adsmonetizer (adsensei-b30) affecting versions up to and including 3.2.4. The flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch or remediation information is provided in the available data.
Italy's Data Protection Authority fined IQVIA €7 million ($7.8 million) for inadequate anonymization of health data, which risked exposing and de-anonymizing roughly one million patients. The company aggregated data from 800 general practitioners, using unique codes that could be linked back to individuals when combined with detailed personal and medical information. Additionally, IQVIA processed data without proper legal basis or patient notification, violating GDPR, and failed to establish data retention periods, with records dating back to 2001. A subset of 3,300 patients had personally identifiable information included. The authority ordered IQVIA to comply within 120 days. IQVIA disputes some findings and is cooperating with the investigation.
CVE-2026-78411 is a vulnerability in Rapid7 Velociraptor where the SetClientMetadata function uses an incorrect permission check. This flaw allows users with LABEL_CLIENTS permission to update server metadata, which is typically reserved for server administrators. Server metadata often contains site-wide configuration data, so unauthorized modification could impact system integrity. The vulnerability affects Velociraptor versions from initial releases up to but not including 0.77.3. The CVSS score is 6.5, indicating a medium severity level.
A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.
A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.
A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.
CVE-2026-105383 is a SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting an unknown function in php/controller.php. The vulnerability arises from manipulation of the transaction_idS argument and can be exploited remotely without authentication. The project uses a rolling release model, so specific affected or fixed versions are not available. The vulnerability has been publicly disclosed, but no vendor response or patch is currently known. The CVSS 4.0 score is 6.9, indicating medium severity.
Plane, an open-source project management tool, has a race condition vulnerability (CVE-2026-104970) affecting versions prior to 1.4.0. The flaw occurs in the InstanceAdminSignUpEndpoint where concurrent unauthenticated requests can bypass proper synchronization and create multiple instance administrators. This allows attackers to gain unrestricted instance administration privileges. The issue is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has a missing authorization vulnerability prior to version 1.4.0. An authenticated user who knows a workspace slug can access workspace member information and project member data via a specific API endpoint, even if they are not a member of that workspace. This issue is due to the lack of workspace-membership checks in the API's permission implementation. The vulnerability is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission decorator on each endpoint validates only that the caller is a member or administrator of the workspace and project named in the URL. BulkDeleteIssuesEndpoint can destroy CycleIssue and ModuleIssue associations belonging to foreign issues. SubIssuesEndpoint can re-parent foreign issues under an attacker-selected issue and return the foreign issues' metadata. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has an authorization bypass vulnerability prior to version 1.4.0. The flaw allows authenticated users to read or modify estimates and inject comments in issues belonging to other workspaces due to improper scoping of nested resource identifiers. This occurs because certain endpoints fetch resources by primary key without verifying they belong to the workspace and project specified in the URL. The issue is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0.