The npm package '@beloved-lenora/opencode-btw' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to secrets and keys stored on the affected system. Removal of the package does not guarantee complete eradication of the malicious software, as the attacker may have established persistent control.
The npm package @beloved-lenora/opencode-goal contains malicious code that fully compromises any computer on which it is installed or running. It can lead to complete system compromise, requiring immediate rotation of all secrets and keys from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @beloved-lenora/opencode-stats contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may lead to unauthorized access to secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by it. Immediate rotation of all secrets and keys from a separate, uncompromised device is strongly recommended.
The npm package @beloved-lenora/opencode-todo contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @beloved-lenora/opencode-shared-rpc contains malicious code that fully compromises any computer on which it is installed or running. Immediate removal of the package is advised, but full remediation requires rotating all secrets and keys from a different, uncompromised machine due to potential persistent control by an attacker.
The npm package @beloved-lenora/opencode-shell-guard contains malicious code that fully compromises any computer on which it is installed or running. Immediate rotation of all secrets and keys stored on the affected computer is required, and the package should be removed. However, removal does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
CVE-2026-17073 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper access control due to missing subtree checks during file handle resolution, which could allow a local attacker to obtain sensitive information. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain an improper authentication vulnerability that could allow a remote authenticated attacker to bypass security restrictions. The vulnerability is identified as CWE-287 and has a medium severity with a CVSS score of 4.3. No specific exploit details or active exploitation in the wild have been reported. No patch or remediation information is provided in the available data.
CVE-2026-17491 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper privilege management where a remote authenticated attacker could bypass security restrictions due to incorrect enforcement of the ChrootDirectory configuration directive. The vulnerability has a CVSS score of 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability (CWE-269) that allows an authenticated attacker to elevate their privileges to QSECOFR/Root authority. This could enable the attacker to perform high-impact operations on the system without proper authorization. The vulnerability has a high severity with a CVSS score of 7.8.
A vulnerability in nfs-utils' fsidd daemon allows a local user to cause a denial of service by sending malformed input over the local domain socket. The daemon relies on program assertions to verify command arguments, and a malformed request lacking required arguments triggers an assertion failure, crashing the daemon and disrupting filesystem identifier lookup services until restarted.
Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain a Least Privilege Violation vulnerability (CVE-2026-81452). This flaw allows a low privileged local attacker to potentially elevate privileges and cause denial of service. The vulnerability has a high severity rating with a CVSS score of 7. No patch or remediation details are provided in the available data.
LangChat through commit 2a6285a has a critical missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers. Due to the absence of a Sa-Token interceptor, attackers can query sensitive endpoints such as /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
ClickVisual versions through 1.1.2 have a missing authorization vulnerability in the /api/v2/reports handlers. This flaw allows authenticated users with low privileges to access ClickHouse instances they should not have permission to access. By manipulating the instance-id parameter in several report-related API endpoints, attackers can enumerate database schemas and infer row counts of restricted tables. The vulnerability has a CVSS score of 4.3, indicating medium severity.
Chaskiq versions through 2.0.3 have a server-side request forgery (SSRF) vulnerability in the /oembed endpoint. This flaw allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter. The vulnerable service, FetchLinkCardService, follows redirects and skips TLS verification, enabling attackers to access internal resources such as loopback, private network, or cloud metadata endpoints. The vulnerability has a CVSS score of 5.8, indicating medium severity.
Chaskiq versions up to 2.0.3 have a server-side request forgery (SSRF) vulnerability in the createUrlUpload GraphQL mutation. This flaw allows unauthenticated attackers to submit arbitrary URLs, including internal or cloud metadata endpoints, via POST requests to /graphql and retrieve the response through an ActiveStorage blob URL. The vulnerability has a high severity with a CVSS score of 8.6.
BeikeShop versions through 2.0.0.31 have an insecure direct object reference (IDOR) vulnerability in the markAsShipped handler of the RmaController. Authenticated customers can exploit this flaw by submitting sequential RMA IDs to the account/rmas/{id}/mark_as_shipped endpoint, allowing them to modify other customers' return shipments. This includes overwriting courier names, tracking numbers, and marking approved returns as shipped without authorization.
FastapiAdmin versions through 3.0 contain a hard-coded JWT signing secret in the backend/app/config/setting.py file. This vulnerability allows low-privileged users to forge JWT tokens to impersonate the superuser. Attackers can exploit this by registering via the unauthenticated /api/v1/system/user/register endpoint, logging in, and crafting a token that retains their session_id but sets the user_name to the superuser, thereby gaining elevated privileges.