pyLoad-ng's WindowsPhoneNotify addon allows an authenticated user with non-admin SETTINGS permission to configure the addon to send HTTP POST requests to arbitrary internal hosts. This occurs because the addon uses Python's http.client.HTTPConnection without outbound address validation, bypassing pyLoad's usual SSRF protections. The attacker can control the destination host, port, request path, and part of the request body. This can lead to blind SSRF attacks enabling internal service probing and potential state changes on internal HTTP endpoints. The vulnerability affects pyLoad-ng versions up to 0.5.0b3.dev101 and has a CVSS score of 6.4 (medium severity).
pyLoad-ng versions up to 0.5.0b3.dev101 contain a vulnerability in the UnTar extractor where tar archive member types are not properly validated during extraction. This allows crafted tar archives containing device nodes or FIFOs to be created on disk. When pyLoad runs as root, such as in the official Docker deployment, this can lead to raw disk access and full host compromise. The vulnerability arises because the extraction function calls tarfile.extractall without a filter, and only validates member names and link targets, not member types. This issue affects Python versions prior to 3.14, which default to a fully trusted extraction filter.
The FBI has arrested a suspected member of the ShinyHunters extortion group linked to a recent breach of FBI systems via a third-party vendor platform. The group exploited an alleged Oracle PeopleSoft zero-day vulnerability to access FBI systems and later moved into FBI-managed AWS GovCloud infrastructure, stealing 2-3TB of sensitive data including employee personal and medical information. Multiple arrests and law enforcement actions have targeted ShinyHunters members internationally. The FBI attributes the breach to a failure by a third-party contractor to install a security update. ShinyHunters is known for data theft and extortion campaigns against various organizations worldwide, often leveraging stolen credentials and phishing attacks to access cloud SaaS platforms.
The npm package @tunstock/remact-dom is a typosquatting malicious package impersonating the legitimate react-dom package. It includes a postinstall script that automatically runs during installation, collecting system and project information and exfiltrating it to a suspicious third-party domain. The package falsifies its identity in the data sent to the attacker’s server, indicating a reconnaissance attempt for further supply-chain compromise.
CVE-2026-42695 is a stored cross-site scripting (XSS) vulnerability in the FolioVision FV Flowplayer Video Player WordPress plugin. It affects versions from the initial release up to 7.5.54.7212. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with low privileges and requiring user interaction to execute malicious scripts. The CVSS score is 6.5, indicating a medium severity level. No official patch or vendor advisory is provided in the data. There are no known exploits in the wild at this time.
CVE-2026-108119 is a medium severity vulnerability in the busybox tar applet used in Red Hat Hardened Images. The flaw involves improper validation of symlink and hardlink targets during deferred link creation, allowing crafted tar archives to create or replace files outside the intended extraction directory. This can lead to privilege escalation or arbitrary code execution if extraction occurs with elevated privileges. Red Hat has issued an update to busybox (version 1.37.0-9.4.hum1) to address this issue.
A NULL pointer dereference vulnerability exists in the GIMP XCF loader on Red Hat Enterprise Linux 10. This occurs when the loader processes image-simulation-intent and image-simulation-bpc parasites without verifying the presence of parasite data. Opening a specially crafted XCF file with a zero-size simulation parasite can cause GIMP to crash.
pyLoad-ng contains a critical authentication bypass vulnerability in its API key validation cache. The cache mechanism in check_apikey() uses only the key_id to validate requests, skipping secret verification on cache hits within a 300-second window. Since key_id values are sequential and easily guessable, an attacker can forge an API key with a known key_id that was recently used legitimately and gain full access without knowing the secret. This results in a complete remote authentication bypass with high impact on confidentiality, integrity, and availability. A patch is available to fix this issue.
### Impact
Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the repo-server.
All versions from v2.11.0 onward are affected, including every currently supported release. v2.10.20 and earlier are not. The behavior was introduced in [9b27aeb1a4](https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205) (2024-01-09, [#15864](https://github.com/argoproj/argo-cd/pull/15864)), the change that added SOCKS5 proxy support for SSH Git URLs, and was first released in v2.11.0.
The repository must use SSH. `http`, `https`, and `socks5` proxy URLs all take this path when they are set on an SSH repository. An HTTPS Git repository uses the proxy as an HTTP proxy and does not build this command.
Anyone who can create or update a repository or a repository credential template can set the proxy. That includes a project-scoped repository permission, `argocd repo add --proxy`, and a repository Secret. A credential template applies its proxy to every matching SSH repository that does not have its own credentials. Argo CD runs the command when it tests the repository connection and on later fetches. The process can read other Git, Helm, and OCI credentials stored for the repo-server.
### Patches
A patch for this vulnerability has been released in the following Argo CD versions:
* v3.6.0-rc2
* v3.5.4
* v3.4.10
* v3.3.15
The fix stops passing the proxy host and port through a shell.
Argo CD 2.x and 3.0 through 3.2 are out of support and will not receive a patch. Upgrade to a patched 3.3 or newer release.
### Workarounds
There is no setting that keeps SSH repository proxies and removes the shell command.
* Do not grant repository create or update to untrusted users, including project-scoped repository access. See [RBAC resources](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-model-structure) and [project-scoped repositories](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters).
* Do not set a proxy on an SSH repository or on a credential template that matches SSH repositories. The proxy field is documented in [Configure repositories with proxy](https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#configure-repositories-with-proxy). Credential templates are documented in [Credential templates](https://argo-cd.readthedocs.io/en/stable/user-guide/private-repositories/#credential-templates). The `--proxy` flag is documented in [`argocd repo add`](https://argo-cd.readthedocs.io/en/stable/user-guide/commands/argocd_repo_add/).
An HTTPS Git repository with an HTTP proxy does not use this command. Review existing repository and credential-template Secrets for unexpected `proxy` values.
### Credits
The Argo CD team would like to thank @kamil-sawicki, @yuvalelarat, @cherez0ff, @McCaulay, @gehan-psbc, @ria-labs-security, @parameter-ai-security, and @zwindler for responsibly disclosing this issue according to our [security reporting guidelines](https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).
### References
* Introducing commit: [9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205](https://github.com/argoproj/argo-cd/commit/9b27aeb1a4fb15d11a0f01cad65dea1fdfc60205) ([#15864](https://github.com/argoproj/argo-cd/pull/15864)), first released in v2.11.0
* [Configure repositories with proxy](https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#configure-repositories-with-proxy)
### For more information
* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
pyLoad-ng versions prior to 0.5.0b3.dev101 have an unauthenticated access vulnerability in the /web/<path:filename> route, which allows rendering of sensitive Jinja2 templates without authentication. This bypasses the access control enforced on other direct routes. Additionally, an exception handling bug leaks internal error details, including Jinja2 variable names, in HTTP 500 responses to unauthenticated users. This enables attackers to enumerate valid templates and gain insight into internal application structure and system information.
MariaDB server versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 have a vulnerability where the mysql service account's home directory is set to the database data directory. This allows a database user with FILE privilege to write startup dot-files such as .bash_profile that execute when an administrator opens a login shell for the mysql account. Debian packages are not affected due to using /nonexistent as the home directory. The issue is fixed in the listed fixed versions.
An out-of-bounds write vulnerability exists in the MariaDB server's CONNECT engine DOS table type in certain versions. This flaw allows an authenticated user with CONNECT engine access to write a null byte beyond a stack buffer boundary, potentially causing a crash or remote code execution. The issue affects multiple MariaDB versions starting from 10.6.1 up to but not including fixed versions such as 10.6.28 and others. The vulnerability has a high severity score of 8.5 and is addressed in specific patched versions.
AstronRPA versions up to 1.1.6 have a vulnerability where the desktop client downloads code updates without verifying their integrity. This allows a network attacker positioned between the client and update server to deliver malicious update manifests and installers, which are installed without signature checks, leading to code execution with the desktop user's privileges.
AstronRPA versions up to 1.1.6 contain a cross-site scripting (XSS) vulnerability in the desktop client's smart-component chat. This flaw allows remote attackers to execute operating system commands by injecting malicious content into the LLM output, which is rendered unsanitized via v-html. The vulnerability arises from improper neutralization of input during web page generation, enabling attackers to embed HTML event handlers that invoke an unrestricted IPC handler with shell metacharacters. This results in command execution with the privileges of the desktop user.
plugNmeet Server versions up to 2.5.2 have a path traversal vulnerability in the whiteboard conversion endpoint. This flaw allows any meeting participant to read arbitrary server files by supplying crafted filePath values containing ../ sequences. The vulnerability enables attackers to convert text or office documents into page images and then retrieve them without authentication via the /download/uploadedFile/ endpoint.
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
LobsterAI versions 2026.5.27 through 2026.9.23 have a vulnerability where the uninstallation process can be manipulated via a crafted skill's _meta.json file. This flaw allows an attacker to cause recursive deletion of arbitrary user-writable directories by controlling the openclawSourceDir value. The vulnerability arises because the security scanner does not inspect the _meta.json file during skill installation.
Ransomware threat actors are shifting tactics away from encrypting data to extorting victims through data theft and demonstrating access by hijacking Active Directory environments. The PAYLOAD campaign exemplifies this trend by using malicious Group Policy Objects to display ransom notes and lock screens without encrypting files. This shift is driven by the increasing difficulty attackers face in collecting ransom payments due to widespread backup practices and the complexity of decrypting large-scale infections. Instead, attackers steal confidential data and threaten publication, which can cause reputational damage and regulatory penalties. Data exfiltration is also harder to detect than encryption-based attacks, making it a more attractive method for extortion. Businesses are advised to maintain strong cyber hygiene, including regular backups, patch management, endpoint protection, and access control to mitigate these evolving extortion threats.
The npm package 'kmf-vendor-pack' version 99.0.0 contains malicious code that executes automatically upon installation. It runs a postinstall script that sends an HTTPS request to an attacker-controlled domain, leaking the installer's OS hostname and username. This behavior confirms unauthorized code execution and data exfiltration without user interaction.