Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.
Adobe, Veeam, and Juniper Networks have released patches addressing multiple critical vulnerabilities across their products. These flaws include arbitrary code execution, authorization bypasses, and privilege escalation. Adobe fixed 12 vulnerabilities affecting Campaign Classic, Connect, Creative Cloud, and Substance 3D Painter. Veeam patched nine defects in Backup for Microsoft 365, Backup & Replication, Veeam ONE, and Veeam Agent for Linux. Juniper Networks resolved 18 vulnerabilities in Session Smart Router and Session Smart Conductor. None of these vulnerabilities are currently known to be exploited in the wild.
The npm package mw-communication-client contains malicious preinstall and postinstall scripts that send the installer's OS username, hostname, and current working directory via unencrypted HTTP requests to an attacker-controlled IP address. The package has no functional code and is a dependency-confusion proof of concept targeting private internal package names. It leaks sensitive environment information during installation without executing further code.
The npm package mw-test-utils (versions 1.0.0, 10.0.0, and 10.0.1) contains malicious preinstall and postinstall scripts that send the installing user's environment username, hostname, and working directory via unencrypted HTTP requests to a hardcoded IP address. The package contains no functional code and is labeled as a dependency-confusion proof of concept, but the scripts execute automatically on every install, potentially leaking sensitive environment information.
The npm package mui-wrapper-x-date-pickers versions 1.0.0 and 10.0.0 contains malicious preinstall and postinstall scripts that send the installer's OS username, hostname, and current working directory in plaintext HTTP requests to an untrusted external IP address. The package mimics the naming pattern of a legitimate internal package to exploit dependency confusion. No other code execution or payload is present beyond these data exfiltration requests.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 9.2. These include denial of service, arbitrary code execution, data integrity issues, information disclosure, SSRF, and use-after-free flaws. The update addresses these critical issues to improve the security of XML processing.
MadApe is a sophisticated multi-stage phishing campaign targeting Microsoft Device Code authentication. It uses business-themed PDF lures, configurable redirect chains, and fake document-sharing pages impersonating services like SharePoint, OneDrive, Teams, Adobe Acrobat, and DocuSign. The campaign abuses Microsoft's Device Code flow to access victim accounts without credential theft on phishing pages. It features extensive infrastructure with 155 domains, human-verification challenges, decoy sites, and exposed operator panels. The campaign is localized in at least nine languages and focuses on business communications.
Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.
BAE Systems experienced a cybersecurity incident that disrupted the US federal judiciary's Bankruptcy Noticing Center (BNC) for over two weeks. The disruption halted the flow of bankruptcy court notices starting around October 9, 2026. BAE Systems has since restored the BNC operations and confirmed that no data was extracted and no personally identifiable information (PII) was breached. The cause of the incident and whether it was a cyberattack remain undisclosed. The Judicial Conference declared a Bankruptcy Rules emergency to mitigate the impact of delayed notices. No ransomware or cybercrime group has claimed responsibility for the incident.
The seapy-ops package on PyPI, versions 1.0.0 through 1.2.2, contains malicious functionality hidden behind undocumented commands. It masquerades as a local file analysis tool but includes backdoor features that exfiltrate files from the user's working directory to an attacker-controlled server and allow remote code execution. The package uploads files recursively, including via symlinks, and can write arbitrary files into the working directory based on server responses. Later versions implement a Python REPL that sends input to the server and executes server-supplied code in memory, disguising errors to conceal activity. These behaviors were confirmed through isolated testing with synthetic credentials and mocked servers, without contacting live endpoints.
CVE-2026-113695 is a reflected cross-site scripting (XSS) vulnerability in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to inject malicious script content into HTML responses viewed by other users. The vulnerability has a medium severity with a CVSS score of 4.8. No public exploits or patches are currently documented.
An unauthorized relay service has been installing legitimate OpenAI Codex and Anthropic Claude Code CLI tools on enterprise systems, reconfiguring them to route requests through third-party infrastructure. This activity, active since early 2026, primarily affects organizations in mainland China, South Korea, Taiwan, and Malaysia across multiple industrial sectors. The relay disables execution sandboxes, enables network access, replaces API credentials with relay-issued tokens, and disables telemetry, granting operators full user privilege command execution and access to sensitive data. No abuse evidence is currently reported.
NIK C2 is an advanced AI-enabled command-and-control framework targeting Windows systems. It features a Go-based implant capable of credential dumping, keystroke streaming, and real-time AI-powered data analysis via the OpenAI Chat Completions API. The framework uses a dual-channel C2 architecture with TLS-secured WebSockets and HTTP fallback, employing AES-256-GCM encryption. It includes surveillance, lateral movement, screen-locking ransomware demanding cryptocurrency payments, and bootkit preparation. The implant employs advanced defense evasion techniques such as AMSI patching, process hollowing, and anti-debugging. Active infrastructure has been observed, confirming operational deployment beyond proof-of-concept. The framework is under active development with multiple versions compiled using Go 1.23.4.
CVE-2026-93009 is an out-of-bounds read vulnerability in the dnsmasq DHCPv6 client hostname parser used in Red Hat Ceph Storage 9. The flaw allows reading one byte past the end of a crafted Fully Qualified Domain Name (FQDN) option due to insufficient boundary checks. This can be triggered by an attacker on the local network sending a single DHCPv6 packet. No crash or data leak has been demonstrated, and the vulnerability is rated as low impact.
CVE-2026-93010 is a vulnerability in dnsmasq used by Red Hat Ceph Storage 9 where enabling DHCP leasequery without restricting source addresses allows any host on the local network to request DHCP lease records. This can disclose assigned IP addresses, MAC addresses, hostnames, and lease metadata. The leasequery feature is disabled by default and must be explicitly enabled by an administrator. The vulnerability is rated as low impact because the exposed information is not highly sensitive and is often accessible by other means on local networks.
CVE-2026-113694 is an improper authorization vulnerability in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users with limited privileges to access or modify attachment resources belonging to other users without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3.
The npm package @testsecuiitytestme/cache-helper is a malicious package that installs a credential stealer and self-propagating worm. It executes a native addon at install time that loads an obfuscated Bun program to collect a wide range of credentials and secrets from developer machines. The malware targets credentials from npm, GitHub, GitLab, PyPI, RubyGems, cloud providers (AWS, GCP, Azure), HashiCorp Vault, Kubernetes, SSH keys, browser logins, and password managers. It also propagates by publishing malicious packages and injecting CI/CD workflow changes and AI assistant configurations. The package was published and updated multiple times on October 27, 2026, then unpublished shortly after. Users who installed any version should consider all accessible credentials compromised and rotate them immediately.
