The npm package @exclipz/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The @exclipz/bails npm package contains malicious code that can fully compromise any computer on which it is installed or running. Due to the potential for complete system takeover, all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-63774 is a critical vulnerability in the PowerSYSTEM Center report designer where insufficient input validation allows an authenticated user to execute unauthorized SQL commands. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-63017 is an authorization vulnerability in PowerSYSTEM Center that allows a low-privileged, authenticated user to access resources normally restricted to administrators. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.
A memory corruption vulnerability exists in the libvmdk_extent_table_get_extent_data_file_path function of libyal libvmdk up to commit 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. The flaw affects the Extent Data File Handler component and can be triggered remotely. A patch identified by commit 175d3fc0a0b961f362f16e7560a6169d7213e16b is available to address this issue. The vulnerability has a low CVSS score of 3.5 and no known exploitation in the wild has been reported.
A local vulnerability in libyal libvmdk's Descriptor File Parser component allows an out-of-bounds read via the function libvmdk_descriptor_file_read_header. The flaw has a low severity score and does not impact confidentiality or integrity but affects availability. Public exploit code exists. A patch has been identified to address the issue.
FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 have an unauthenticated SQL injection vulnerability in the /linkinfo endpoint. This flaw allows remote attackers to perform blind SQL injection via the source_se and dest_se query parameters, potentially exposing stored cloud storage credentials and token provider client secrets.
Three individuals were charged with using AI technology to impersonate CEOs and attorneys to defraud companies worldwide, stealing approximately $129 million. The scheme involved targeting accounting departments with emails and AI-generated voice and video calls to authorize fraudulent financial transactions. The stolen funds were laundered through cryptocurrency. The accused were arrested and face charges including wire fraud, aggravated identity theft, and money laundering.
Exposed Dixell/Copeland XWEB PRO refrigeration controllers with unpatched vulnerabilities, notably CVE-2026-25085, are being exploited as part of an SMTP botnet. These industrial control devices, commonly used in supermarkets and cold storage, are abused as tunnel gateways, residential proxy exits, and spam senders. Analysis shows coordinated outbound SMTP traffic targeting overlapping mail lists, indicating organized malicious use. The vulnerable devices lack security monitoring, enabling prolonged exploitation without detection.
Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. (?:){50000000} — the match engine executes the empty loop body m-1 times, pushing two integers onto the backtracking stack on every iteration. Because the parser accepts any repetition count up to math.MaxInt32 and the backtracking stack grows without bound, a pattern of fewer than 20 bytes matched against an empty input can force multi-gigabyte allocation and OOM-kill the process. MatchTimeout does not fully mitigate this because the memory is allocated faster than the 100 ms timeout clock can fire. This issue has been patched in version 2.3.0.
A security vulnerability was identified in the keycloak package affecting versions prior to 26.7.5-r3. The issue has been resolved in version 26.7.5-r3. No specific details about the nature or impact of the vulnerability are provided.
A security vulnerability exists in Keycloak due to the use of pgjdbc, the PostgreSQL JDBC Driver, version 42. This affects Keycloak versions prior to 26.7.5-r3. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability. A patch is available in version 26.7.5-r3.
A security vulnerability exists in Keycloak due to the use of pgjdbc, the PostgreSQL JDBC Driver, version 42. Versions of Keycloak prior to 26.7.5-r3 are affected. The vulnerability has a CVSS score of 5.9 and impacts confidentiality with no impact on integrity or availability. A patch is available in version 26.7.5-r3.
A security vulnerability exists in Keycloak versions prior to 26.7.5-r3 involving the MariaDB Connector/J used for Java applications connecting to MariaDB and MySQL databases. The vulnerability has a medium severity with an impact on integrity but no impact on confidentiality or availability. A fix is available in version 26.7.5-r3.
A low-severity security vulnerability affects Keycloak versions prior to 26.7.5-r3 related to the use of MariaDB Connector/J, which connects Java applications to MariaDB and MySQL databases. The vulnerability does not impact confidentiality or integrity but may cause limited availability issues. A fix is available in version 26.7.5-r3.
A security vulnerability has been identified in the Keycloak package related to its use of MariaDB Connector/J, which connects Java applications to MariaDB and MySQL databases. The vulnerability affects versions of Keycloak prior to 26.7.5-r3. It has a CVSS 3.1 base score of 5.9, indicating a medium severity level. The vulnerability does not impact confidentiality or integrity but affects availability, with a high attack complexity and no privileges or user interaction required. A fix is available in version 26.7.5-r3.
A security vulnerability affects the Keycloak package due to its use of MariaDB Connector/J to connect Java applications to MariaDB and MySQL databases. The vulnerability impacts availability but does not affect confidentiality or integrity. It is addressed in Keycloak version 26.7.5-r3.
A security vulnerability exists in the Keycloak package related to the MariaDB Connector/J used for Java applications connecting to MariaDB and MySQL databases. The vulnerability affects versions prior to 26.7.5-r3. It has a medium severity with a CVSS score of 5.9, indicating a network attack vector with high complexity and no privileges or user interaction required. The vulnerability impacts confidentiality but not integrity or availability. A patch is available in version 26.7.5-r3.
