The MatchPoint Android app improperly validates TLS certificates due to a TrustManager that accepts any certificate and a permissive hostname validator. The app also permits unencrypted HTTP traffic. This misconfiguration allows an attacker who can intercept network traffic to read and modify communications, including sensitive credentials and personal data.
The MatchPoint APK contains embedded API keys, credentials, and configuration parameters that can be extracted via reverse engineering. The vendor clarifies that some of these elements, such as Google Maps and Firebase keys, are project identifiers rather than authentication secrets. The security impact varies depending on the specific capabilities and restrictions of the exposed elements. No known exploits are reported in the wild, and no patches or fixes have been indicated.
An Insecure Direct Object Reference (IDOR) vulnerability exists in the MatchPoint API due to reliance on the actingasuser HTTP header without verifying the requester's authorization. This flaw allows attackers to manipulate sequential identifiers to access and modify sensitive personal, banking, and financial data, private messages, QR codes for physical access, and third-party accounts, including changing passwords and transferring virtual balances.
The MatchPoint Android app stores user credentials in plain text within an SQLite database and SharedPreferences. This insecure storage allows an attacker with local device access or access to backups to retrieve usernames and passwords, potentially leading to unauthorized account access on the platform.
A static credential embedded in a mobile application for the MatchPoint platform returns an 'autorizado' token that grants unauthenticated access to API services. This vulnerability allows attackers to bypass authentication controls and access protected API endpoints without valid credentials.
A SQL injection vulnerability exists in the push notification handler of the MatchPoint Android app. This component processes messages from Firebase Cloud Messaging and constructs SQL queries by concatenating untrusted data. An attacker who can interact with this component could manipulate these queries to access sensitive information stored locally on the device, including credentials. The impact is limited to the affected device and does not extend beyond it.
The Images.ashx endpoint in MatchPoint lacks authentication and authorization controls, allowing unauthenticated remote attackers to download profile photos by enumerating predictable identifiers. This vulnerability could enable attackers to collect user photos, potentially linking them to identities when combined with other platform weaknesses.
CVE-2025-71458 is a high-severity SQL injection vulnerability affecting FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0. The flaw exists in the /linkinfo endpoint, allowing unauthenticated remote attackers to inject SQL via the source_se and dest_se query parameters. Exploitation can lead to blind SQL injection attacks that expose stored cloud storage credentials and token provider client secrets. Fixed versions 3.13.3 and 3.14.1 address this issue.
Multiple vulnerabilities have been identified in the Berkeley Internet Name Domain (BIND) software used for DNS services. These include denial of service issues via crafted DNSSEC replies, malformed DNS64 responses, and unbounded processing of crafted DNS messages, as well as an arbitrary code execution vulnerability via GSS-TSIG UDP message replay. Red Hat has issued an important security advisory with fixes for these issues in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The advisory also includes a new root trust anchor key for DNSSEC.
CVE-2026-63774 is a critical SQL Injection vulnerability in Subnet Solutions PowerSYSTEM Center 2024. It arises from insufficient input validation in the report designer component, allowing an authenticated user to execute unauthorized SQL commands. This flaw affects versions from 6.0.x through 6.2.x and 7.0.x through 7.1.x. The vulnerability has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability. No public exploits or patches are currently documented.
CVE-2026-63017 is an incorrect authorization vulnerability in Subnet Solutions PowerSYSTEM Center 2020. It allows a low-privileged, authenticated user to access resources that should be restricted to administrators. The flaw affects multiple versions of the product up to 7.1.x. The vulnerability has a critical severity with a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability.
A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.
Microsoft Threat Intelligence has observed threat actors employing an agentic AI offensive framework to rapidly search public GitHub repositories for exposed secrets such as credentials, application keys, and AI inference-related API keys. These secrets are then used for malicious activities including cloud resource discovery, credential and data exfiltration from Azure Key Vaults and Storage Accounts, and abuse of Azure AI services. The AI framework accelerates the attack chain by automating scanning, analysis, and follow-on attacks, reducing the need for manual operator involvement. Microsoft recommends organizations scan their code repositories for exposed secrets, remove them, and immediately rotate any compromised credentials. GitHub provides secret scanning and push protection features to help detect and prevent secret exposure. Organizations are also advised to migrate away from secret-based authentication to managed identities to reduce risk. This activity highlights the evolving threat landscape where AI tools enhance the speed and scale of attacks.
The URL http://phubotnet.duckdns.org/main_sh4 was observed in attacker activity between 2026-11-05 and 2026-11-06 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in South Korea. The URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.
The URL http://phubotnet.duckdns.org/main_x86 was observed in attacker activity by OffSeq Mirage honeypot sensors on two occasions between 2026-11-05 and 2026-11-06. This URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen as part of attacker payloads, such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from South Korea (KR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
OffSeq Mirage honeypot sensors detected an attacker URL (http://phubotnet.duckdns.org/main_mips) twice between November 5 and 6, 2026. The URL is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was observed originating from attacker infrastructure in South Korea. This URL was used in attacker payloads, including tool downloads, callbacks, or exploitation targets. Organizations are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
The talk-lang package on npm contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The plain-lang npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.
A security vulnerability identified as CVE-2026-111079 affects the 'goose' component in Red Hat Enterprise Linux 10.2. The issue involves a shell history and environment leak via terminal integration. Red Hat has issued an important security update to address this vulnerability. The update is available for multiple architectures including x86_64, s390x, ppc64le, and aarch64. Users are advised to apply this update after ensuring all previous errata are installed.