A denial of service vulnerability exists in Systrome Validation & Certification 1.0 via the 't' URL parameter in the qrcode_auth.html component. This issue allows an attacker to cause service disruption by exploiting this parameter. No CVSS score or detailed impact information is available.
A vulnerability in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch file. The issue affects version 1.0.3 of the router firmware. No patch or remediation information is provided. There is no CVSS score available for this vulnerability.
A vulnerability in Webasyst Framework versions 4.0.3 and earlier allows remote attackers to execute arbitrary code by crafting a malicious OAuth authorization URL with an arbitrary redirect_uri parameter.
AiDot Linkind Matter Smart Plug version 1.01.32 contains a buffer overflow vulnerability in the SSDP local header parsing functionality. This vulnerability could potentially be exploited to cause unexpected behavior or crashes. No CVSS score or detailed impact information is provided.
CVE-2026-114574 is an information disclosure vulnerability in massCodeIO massCode version 5.10. It affects an unspecified function within the Local HTTP Service component in the file src/main/api/index.ts. The vulnerability can be exploited remotely without privileges or user interaction. A patch identified by commit d25d8fa3f5a1e34285c8634f18729650c0c05cda is available to address the issue.
CVE-2026-76531 is a critical vulnerability identified by Cisco during an internal security review. It involves multiple software weaknesses related to files or directories accessible to external parties, categorized under CWE-552. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. Cisco has released a software hardening update addressing these issues. No known exploits are reported in the wild, and no specific affected versions are detailed in the available data.
Red Hat has issued a security update for PHP 8.3 addressing three vulnerabilities: a denial of service via unbounded recursion in the SOAP parser (CVE-2026-91765), an out-of-memory bailout during request parsing that can lead to memory corruption and remote code execution (CVE-2026-109618), and a use-after-free vulnerability due to stale request state retention in fatal error handling (CVE-2026-109619). These issues affect Red Hat Enterprise Linux 9 across multiple architectures. The update is rated as Important by Red Hat Product Security.
LiteLLM version 1.107.0 was compromised in a supply chain attack affecting PyPI packages and Docker images. The malicious release includes Python startup files that execute automatically, stealing cloud credentials, private keys, browser data, and AI development tool authentication tokens. The attack used a lookalike repository in the release workflow and targets credentials for AWS, Azure, Google Cloud, GitHub CLI, SSH keys, npm/PyPI, and AI tools such as Claude, Gemini, and Cursor. Stolen data is encrypted and sent to a command-and-control server. A loader enables remote Python code execution. The package has approximately 23 million weekly downloads, indicating a significant potential impact.
The npm packages pixel-map-testmetest versions 0.0.1 and 0.0.2 contain malicious code that executes at install time via a node-gyp binding.gyp script. This script runs an obfuscated loader that decrypts and decompresses an encrypted payload, then executes it using the Bun runtime. The package masquerades as a benign placeholder but actually delivers a credential stealer payload. The malicious behavior is hidden through multi-layer obfuscation and use of an alternate runtime, making static analysis difficult.
The npm package test-brotli-testmetest version 1.0.0 contains malicious code that executes during installation. Its install script triggers a node-gyp rebuild that runs an obfuscated JavaScript loader (index.js). This loader decrypts and executes a Brotli-compressed payload, effectively running attacker-controlled code at install time without user visibility. The package was published by the npm account testnewtestme2 on 2026-10-21.
The npm package test-brotli2-testmetest version 1.0.0 contains malicious code that executes during installation. Its install script triggers node-gyp to run an obfuscated JavaScript loader (index.js) that decrypts and executes a Brotli-compressed payload. This payload acts as a credential stealer. The package was published by the npm account testnewtestme2 on 2026-10-21.
log-sink-testmetest version 1.0.1 is a malicious npm package that executes a concealed credential stealer during installation. It abuses the node-gyp build process by embedding a binding.gyp file that triggers execution of an encrypted payload without any native source code. The payload is heavily obfuscated and decrypts an AES-128-GCM encrypted blob, which is then executed either directly in Node.js or via the Bun runtime to evade detection. The package was published on 2026-10-21 by the npm account 'testnewtestme2'. Version 1.0.0 is clean and unaffected.
The npm package data-pipeline-testmetest version 2.0.1 contains malicious code that executes during installation without a declared install script. It uses a binding.gyp file to run an obfuscated loader that decrypts and executes a large payload. This payload steals credentials from GitHub, npm, PyPI, RubyGems, and cloud services, then commits them to a public GitHub repository created in the victim's account. It also republishes the victim's packages with the same malicious hook. If a GitHub token is found, it installs a destructive service that deletes the user's home directory once the token is revoked. Removal of this service before token revocation and credential rotation is necessary to prevent data loss.
The npm package event-emitter-testmetest contains malicious code in specific versions that use multi-layer obfuscation to execute attacker-controlled payloads. Versions 1.0.6 and 1.0.7 run an obfuscated loader that decrypts and executes code on load or during npm install via a binding.gyp hook. Versions 4.1.0 and 5.0.0 include a stealer payload executed similarly through binding.gyp. Other versions do not contain executable payloads.
This golang security update addresses multiple vulnerabilities including a high-severity HTTP/1 CONNECT request handling flaw (CVE-2026-56866) where a non-empty request body can cause connection desynchronization and cross-user response poisoning in reverse proxies. Additional issues fixed include HTTP/2 response smuggling due to lax header validation (CVE-2026-78660) and multipart form parsing that can bypass memory limits (CVE-2026-94440).