A vulnerability in fastify versions 5.8.0 through 5.12.7 causes the server to crash when a streaming response exceeds a configured nonzero handlerTimeout. This occurs because Fastify attempts to send an error response after headers have already been sent, triggering an uncaught exception that terminates the Node.js process and disrupts other requests. The issue affects availability and can be triggered remotely without authentication. The default handlerTimeout of 0 is not affected. The vulnerability is fixed in version 5.12.8.
The persona-ai-sdk package version 1.0.0 on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised machine. Removing the package does not guarantee full remediation, as the attacker may have established persistent control over the system.
WSO2 Open Banking AM contains an open redirect vulnerability (CWE-601) that allows attackers to craft URLs redirecting users to arbitrary external domains. This flaw arises from insufficient validation of user-supplied input used in redirection URLs. Exploitation can facilitate phishing attacks by redirecting users to malicious sites. The vulnerability affects multiple versions prior to specific fixed releases. A medium severity CVSS 3.1 score of 5.4 is assigned.
A vulnerability identified as PHP2Shell affects multiple WAGO devices, specifically the CC100 model. Exploitation of this flaw could allow an attacker to gain control over the PHP process via the web interface, leading to unauthorized access, data manipulation, or disruption of device functionality. Public exploit code is available, but no confirmed exploitation in the wild has been reported. No patch or official remediation guidance has been provided yet.
@fastify/reply-from versions up to 12.8.0 contain a path traversal vulnerability due to improper validation of backslash dot-segments in proxy paths. This allows unauthenticated requests to bypass intended upstream path restrictions and access unintended resources. The vulnerability is fixed in version 12.8.1 by normalizing paths and rejecting unsafe segments before URL construction.
ManageEngine Eventlog Analyzer and ManageEngine Log360 versions prior to 13062 contain an authenticated remote code execution vulnerability via the Log Forward option. This vulnerability is due to an OS command injection flaw (CWE-78).
@fastify/multipart versions 5.3.0 through 10.1.6 have a vulnerability where a parser error is not propagated to the file stream if a request body ends inside a file part without a closing boundary. This causes the file stream to be destroyed silently, leading to hanging requests and potential resource exhaustion. The issue is fixed in version 10.1.7.
Chainalysis, a blockchain analytics company, disclosed a data breach resulting from an AI-driven cyberattack using offensive agentic techniques to gain unauthorized access to its systems and internal tools. The breach did not compromise investigation content, transaction or query results, clear-text passwords, or other credentials. However, some non-sensitive customer data, including user IDs, full names, email addresses, and organization role labels, was accessed. The company is investigating the full scope and has not disclosed the number of affected individuals. Chainalysis is actively patching vulnerabilities and strengthening security, recommending users enable MFA and be vigilant for suspicious authentication prompts.
@fastify/secure-session versions 7.5.0 through 8.4.1 have a vulnerability where, if configured with the signed cookie option, the plugin decrypts session cookies even when their signature verification fails. This allows an attacker who possesses an unexpired encrypted session cookie to bypass signature checks by stripping the obsolete signature and continue using the session. The attacker cannot forge session data, extend expiry, or survive encryption key rotation. The issue is fixed in version 8.4.2.
The RubyGems package 'intercom-react-native-example-e2e-tests' version 1.0.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. No further technical details or exploit information are provided.
CVE-2025-12544 is a cross-site scripting (XSS) vulnerability in the WSO2 API Manager Publisher portal. It arises from improper validation of uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. Exploitation can lead to browser redirection, UI manipulation, or information disclosure, though session hijacking is mitigated by httpOnly cookie flags. The vulnerability affects multiple versions prior to specific fixed releases and has a medium severity rating.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include remote code execution, denial of service, information disclosure, use-after-free, and heap buffer overflow issues. The vulnerabilities affect the xfreerdp client and related components, potentially impacting connections to RDP servers such as Microsoft Windows, xrdp, and VirtualBox. Red Hat has issued an important security update for FreeRDP on Red Hat Enterprise Linux 7 Extended Lifecycle Support to address these issues.
@fastify/cors versions 8.2.0 through 11.3.x have a vulnerability where using the non-default onSend hook option causes the application to crash on CORS preflight OPTIONS requests. This happens because the plugin calls reply.send inside the onSend hook, triggering an uncaught ERR_HTTP_HEADERS_SENT error that can terminate the Node.js process. The issue is fixed in version 11.4.0, which disallows onSend as a hook option and fails registration with a clear error instead of crashing at runtime.
@fastify/http-proxy versions 9.0.0 through 11.6.5 contain a path traversal vulnerability due to improper handling of URL-decoded route parameters in the rewritePrefix option. This allows an unauthenticated attacker to bypass path restrictions and potentially perform server-side request forgery or authorization bypass on the upstream service. The issue is fixed in version 11.6.6, and upgrading is required as no other workaround exists.
CVE-2026-2613 is a high-severity SQL injection vulnerability in the Admin REST API of WSO2 API Manager. It allows an administrator user to inject crafted input into SQL statements due to insufficient input sanitization. This blind SQL injection can be used to infer sensitive database information and potentially disrupt database availability. Multiple versions of WSO2 API Manager prior to specific patch releases are affected.
@fastify/http-proxy versions 11.6.0 through 11.6.2 contain a path traversal vulnerability due to improper normalization of backslashes before percent-decoding the request path. This allows an unauthenticated remote attacker to access resources outside the intended proxy prefix on upstream servers that treat backslashes as path separators. The vulnerability impacts confidentiality but not integrity or availability. The issue is fixed in version 11.6.3.
CVE-2026-18800 is a vulnerability in WSO2 API Manager where misconfigured Event Publisher output adapters log irrelevant properties, potentially including sensitive user credentials or confidential information. An attacker with access to the 'wso2carbon' log files could retrieve this sensitive data, possibly leading to unauthorized access. The issue affects multiple versions of WSO2 API Manager prior to specific fixed releases. The vulnerability has a medium severity rating with a CVSS score of 4.4.
Multiple security vulnerabilities have been identified and fixed in GIMP (GNU Image Manipulation Program), including heap and stack buffer overflows, integer overflows, and out-of-bounds writes in various image file parsers and plugins. These flaws could lead to arbitrary code execution or remote code execution when processing crafted image files such as PSD, TIF, ICO, FITS, APNG, and SGI formats. The update addresses these issues to prevent potential exploitation.
The RubyGems package 'shoaib-unity' version 1.0.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. No CVSS score or detailed technical exploit information is provided.
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.