CVE-2026-108258 is a path traversal vulnerability in py-shiny, a Python framework for interactive web applications. Versions from 1.4.0 up to but not including 1.6.4 allow an unauthenticated attacker to manipulate the bookmark restore feature by supplying a crafted state_id. This can lead to unauthorized reading of files outside the intended bookmark directory, including sensitive files like input.json and values.json. Additionally, in configurations using server-side bookmark storage and ui.input_file(), attackers can copy and expose arbitrary files from the server. The issue is fixed in version 1.6.4.
Mindwtr versions prior to 1.1.5 store sensitive Cloud sync bearer tokens and WebDAV passwords in cleartext within unencrypted AsyncStorage on mobile devices. This allows anyone with access to the application database or device backups to retrieve these credentials and access the user's synchronized tasks and attachments. The issue is resolved in version 1.1.5.
Hackers are exploiting legitimate Bing search-result redirects used in Google search ads to funnel users to fake Claude installers. These installers deliver ClickFix attacks, a form of malware or unwanted software. This abuse leverages trusted advertising and search infrastructure to deceive users into installing malicious software.
The npm package @fer2809fl/baileys contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The cloud-baileys npm package versions 1.0.0 through 1.1.42 contain malicious code. Installing or running this package can lead to full system compromise, potentially exposing all secrets and keys stored on the affected computer. Removal of the package does not guarantee elimination of all malicious software introduced. Immediate secret and key rotation from a separate, uncompromised system is strongly advised.
The npm package '@myorder-frontend-commons/analytics' versions 3.0.0, 10.0.0, and 99.0.0 have been identified as malicious due to communication with a domain linked to malicious activity. This behavior classifies the package as a malicious software component within the supply chain.
The npm package 'kmf-i18n' version 100.100.102 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as a security threat in the software supply chain.
The npm package 'test-account-portal-fe' version 100.100.102 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain known for malicious activity. There is no CVSS score available for this threat. No official patch or remediation guidance is provided in the source data. No known exploits in the wild have been reported. The affected version is exactly 100.100.102.
The npm package 'kmf-bootstrap' versions 100.100.102 and 100.100.103 have been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain linked to malicious activity. No CVSS score is available for this threat.
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The vulnerability occurs when the parser processes certain optional socket address information items without validating the buffer length, allowing a remote attacker to cause a denial of service.
Hayat Mobile versions from 3.3.0 up to but not including 3.4.0 contain a client-side authentication vulnerability that allows authentication bypass. This vulnerability is identified as CVE-2026-90983 and has a high severity rating with a CVSS score of 8.2. The flaw enables attackers to bypass authentication mechanisms, potentially gaining unauthorized access to the application.
An out-of-bounds read vulnerability in EIPStackGroup OpENer v2.3 and master through commit 76b95cf affects the server-side CIP SetAttributeList service. This vulnerability allows a remote attacker to cause a denial of service condition. The vulnerability is identified as CVE-2026-75346 and has a high severity rating with a CVSS score of 7.5.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability due to improper validation of counts, offsets, lengths, and field boundaries in FRM metadata when opening binary FRM files. This can allow an attacker who can place a crafted FRM file in the data directory to cause out-of-bounds reads or writes, potentially crashing the server or executing arbitrary code. The issue is fixed in the versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
MariaDB Connector/C versions from 3.4.1 up to but not including 3.4.10 contain a vulnerability where the TLS hostname verification mismatch is not properly rejected during Zero-Configuration SSL authentication-switch logic. This flaw allows an active man-in-the-middle attacker with a valid certificate for a different hostname to request mysql_clear_password and potentially obtain the database password over the attacker-controlled TLS connection. The issue is fixed in version 3.4.10. Other MariaDB connectors are not affected.
CVE-2026-107841 is an incorrect authorization vulnerability in the john-broadway pacioli package version 0.9.6. It allows an attacker with a credential having API Key Scope 'require_consent' to cancel documents without proper consent markers due to a flaw in the consent gate logic. This enables cancellation of submitted documents that a human operator never approved, reversing ledger effects. The issue is fixed in version 0.10.0, which enforces act-bound consent markers for cascading cancels. Only sites that opted into consent gating are affected.
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.
This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct 1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4 and @aws-amplify/graphql-api-construct 1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.
CVE-2026-107840 is an uncontrolled resource consumption vulnerability in the Prometheus metrics middleware of jhaals yopass before version 14.7.0. The middleware uses the HTTP request method directly as a label value in metrics, allowing an attacker to send requests with arbitrary method strings. This causes unbounded growth in Prometheus metric time series, leading to memory exhaustion and degraded metrics scrape performance.
CVE-2026-107839 is a high-severity vulnerability in luskaner's ageLANServer prior to version 1.15.2. The vulnerability arises from the POST /game/cloud/getFileURL handler, which lacks limits on the size of the request body and the length of an attacker-controlled JSON array. This can lead to uncontrolled memory allocation, causing the server to crash or hang, disrupting active players and making the service unavailable until restarted. The issue is resolved in version 1.15.2.
CVE-2026-107838 is a high-severity vulnerability in RIOT-OS affecting versions from 2023.07 through 2026.07. It involves unchecked return values in the nanocoap_fileserver component, where failure from _resp_init() is ignored, leading to assertion failures and termination of the affected service or device task when processing specially crafted CoAP requests with large extended tokens. No official fix is available as of the latest review.
CVE-2026-107837 is a high-severity out-of-bounds read vulnerability in RIOT-OS, an open-source microcontroller operating system for IoT devices. The flaw exists in the _receive() function of the sixlowpan network layer in versions 2026.07 and earlier. It allows a remote attacker to send a malformed 6LoWPAN fragment that triggers reading beyond the packet buffer, potentially causing memory disclosure and crashing the network stack. No official fix or patched release is available as of the latest review.