The @smart-dev-wa/baileys npm package version 1.0.0 contains malicious code that automatically subscribes the user's authenticated WhatsApp account to a specific WhatsApp Channel without user consent. This behavior contradicts the package's README claim of no auto-follow functionality. The malicious action occurs when an application using this library creates a WhatsApp socket connection. No credentials or session keys are exfiltrated, and no install-time payload or persistence mechanisms are present. The primary harm is unauthorized use of the victim's account to inflate subscriber counts for the attacker's chosen channels.
Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link.
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an unsafe URL in the Editor content, which runs when the user interacts with it.
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in an openUrl quick action, which runs when a user clicks the action.
CVE-2026-62854 is a cross-site scripting (XSS) vulnerability in FreeScout versions prior to 1.8.225. It allows a user with permission to edit mailbox signatures to inject scriptable content by combining uploaded files and nested tag fragments that bypass sanitization. The malicious script executes with the victim's privileges when they open the mailbox reply editor or new-ticket page. This vulnerability is fixed in FreeScout version 1.8.225.
Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.
ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.
The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.
Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.
CVE-2026-118515 is a high-severity vulnerability in the Symfony Serializer component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. It allows an attacker to craft a request that causes the application to treat arbitrary files on the server as uploaded files without actual upload, potentially exposing or moving sensitive files. This occurs because the DataUriNormalizer only handles specific types, and subclasses like UploadedFile can be instantiated with attacker-controlled paths, bypassing normal upload checks.
CVE-2026-123859 is a SQL injection vulnerability in the Snowflake Connector for Python and its Universal Core variant. When identifier escaping is disabled via a non-default configuration, the write_pandas() function fails to escape DataFrame column names before embedding them in SQL statements. This allows crafted column names to inject additional SQL commands, potentially enabling unauthorized reading, modification, or deletion of data accessible to the Snowflake role used by the application. Exploitation requires attacker-controlled column names passed to this functionality. Fixed versions 4.8.1 and 5.2.0 are available and users must upgrade manually.
CVE-2026-123855 is a high-severity OS command injection vulnerability in JetBrains Toolbox App versions before 3.6.1. The flaw allows command injection via enterprise configuration URLs. It was fixed in version 3.6.1.
CVE-2026-123853 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via project-controlled JVM options of the build process. The flaw is due to inclusion of functionality from an untrusted control sphere (CWE-829).