The npm package 'latest-update-my-talking-angela-h-a-c-k-gen-erat-or-q8z42f' is identified as malicious software. Installation or execution of this package results in full compromise of the affected computer. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine. However, removal of the package alone may not eliminate all malicious components due to potential persistent control by an attacker.
The npm package 'gene-rator-new-rope-hero-h-a-c-k-gen-erat-or-azkrvc' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package 'gene-rator-new-hearthstone-h-a-c-k-gen-erat-or-9wy4b5' is identified as malicious software. Any system with this package installed or running is considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised computer. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.
The npm package 'code-resour-ces-new-app-cloner-premium-9upyk2' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control.
The npm package 'updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eliminate the malicious presence due to potential persistent control by an external entity.
A buffer overflow vulnerability (CWE-787) exists in the Brotli decompression library used by .NET, potentially allowing unauthenticated attackers to read or corrupt process memory. This can lead to information disclosure, denial of service, or elevation of privilege. The vulnerability affects .NET applications that enable Brotli decompression or explicitly use Brotli decompression APIs with attacker-controlled data. ASP.NET Core and HttpClient do not enable Brotli decompression by default, so exposure requires explicit configuration. The .NET Framework is not affected. Fixed versions have been released for affected packages.
This campaign uses trojanized Inno Setup-style installers disguised as cracked software, free games, activators, and utilities to deliver multiple monetization payloads during a single installation session. The installers employ a callback and status-tracking system to manage payload delivery and record installation outcomes. Confirmed monetization branches include proxy and network-resource monetization, distributed computing enrollment, and adware-style utility installation, often without user consent. These payloads introduce security and privacy risks by silently installing software that may have legitimate uses but are deployed deceptively. Organizations can mitigate exposure by avoiding untrusted software sources, enabling protection against potentially unwanted applications, and monitoring for unexpected software installations and persistence mechanisms.
A path traversal vulnerability in praktor's Telegram file upload functionality allows remote users to write files outside the intended uploads/ directory within the agent's persistent workspace. This occurs because the Telegram document filename is not sanitized and is concatenated into the destination path, enabling directory traversal sequences. An attacker can overwrite or plant files that the agent later uses, potentially injecting malicious instructions or configurations. The vulnerability affects versions prior to 0.9.1 and requires no authentication by default. It is fixed in version 0.9.1.
The npm package '@shein-risk/si_verify' contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
A JWT algorithm confusion vulnerability in Keycloak's JWT Authorization Grant flow allows attackers with valid client credentials to bypass signature verification. This flaw enables forging assertions to create unauthorized access tokens, permitting impersonation of any federated user linked to the affected Identity Provider. The vulnerability affects Keycloak versions prior to 26.6.4 and has been assigned CVE-2026-11800 with a high severity rating. A patch is available in version 26.6.4.
A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
Buku versions 5.0 through 5.1.1 contain a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL, which can be submitted through the unauthenticated /api/bookmarks endpoint. Exploitation enables attackers to execute scripts in the context of the victim's browser, potentially issuing same-origin API requests with the victim's credentials.
GNU Gatekeeper (gnugk) versions before 5.16 have an out-of-bounds read vulnerability in the H46024Socket::ReceivedProbePacket() function. This flaw allows remote attackers to cause a heap over-read by sending short probe packets, specifically short application-defined RTCP packets during H.460.24 probing. Exploitation may lead to reading beyond allocated heap memory and potentially crashing the gatekeeper.
GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.
Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.
CVE-2026-97072 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 4.0.3.
CVE-2026-114187 is a missing authorization vulnerability in the WPVibes AnyWhere Elementor plugin, affecting versions from initial release up to 1.3.0. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.3.1.