Threats affecting pkg:generic/zxc

The node-zserial package version 1.0.42 on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software introduced by it.

CVE-2026-129360 is an authentication bypass vulnerability in Linux Foundation Magma up to version 1.9.0. The flaw exists in the Obsidian REST component, specifically in the handling of the X-Magma-Client-Cert-Serial argument. An attacker can remotely exploit this weakness by spoofing this argument to bypass authentication controls.

CVE-2026-129359 is a medium-severity vulnerability in Linux Foundation Magma up to version 1.9.0. It involves hard-coded credentials in an unspecified function within the file orc8r/lib/go/registry/interceptors.go. The flaw can be exploited remotely without authentication. Public exploit code has been released, but no vendor response or patch is currently available.

CVE-2026-129358 is a cross-site scripting (XSS) vulnerability in Linux Foundation Magma up to version 1.9.0. The flaw exists in the handleReact function within the nms/server/main/routes.ts file of the NMS component. This vulnerability allows remote attackers to inject malicious scripts. Public exploit code is available, but no vendor response or patch has been provided.

CVE-2026-129357 is a medium-severity vulnerability in Linux Foundation Magma up to version 1.9.0. It involves missing authorization in the hostOrgMiddleware function within the Host Middleware component, allowing remote attackers to manipulate the role argument. The vulnerability has been publicly disclosed with available exploit details, but no vendor response or patch is currently known.

Zr.Admin.NET contains an authorization bypass vulnerability in the GET /workflow/instance/{instanceId} endpoint that allows authenticated low-privilege users to access other users' workflow instances by enumerating sequential instance IDs. This exposure includes sensitive approval request data such as form contents, applicant details, and approval records.

CVE-2026-129455 is an authorization bypass vulnerability in Zr.Admin.NET's FrontArticleController. Authenticated users can exploit this flaw to change the visibility and pin state of articles belonging to other users by sending a crafted PUT request with their own UserId. This allows attackers to make private articles public and subsequently access them anonymously via a GET request.

CVE-2026-129464 is a path traversal vulnerability in Zr.Admin.NET that allows any authenticated user to read arbitrary files on the server via the /common/DownloadFile endpoint's path parameter. By exploiting this flaw, attackers can access sensitive configuration files such as appsettings, potentially extracting the JwtSettings SecretKey to forge administrator tokens.

CVE-2026-129465 is an authorization bypass vulnerability in Zr.Admin.NET's SysProfileController.UpdateProfile function. It allows any authenticated user to modify other users' accounts by specifying a user-controlled UserId. Exploitation enables an attacker to change the administrator's phone number to one they control, request an SMS code, and log in as the administrator, effectively taking over the account.

CVE-2026-129466 is a missing authorization vulnerability in Zr.Admin.NET affecting the TasksController.Get method. This flaw allows any authenticated user to access scheduled task details without requiring the monitor:job permission. Attackers can leverage an unprotected endpoint to enumerate task IDs and then retrieve sensitive job parameters, API URLs, cron schedules, and stored SQL statements.

The gateio-v4 package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username during installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond data exfiltration.

CVE-2026-129356 is a race condition vulnerability in the vllm-project vllm software versions 0.30.0 and 0.31.0. It affects the Common Prefix Handler component in the file single_type_kv_cache_manager.py. The vulnerability can be exploited remotely but is considered highly complex and difficult to exploit. A public exploit exists. Upgrading to version 0.32.0 resolves the issue.

CVE-2026-129355 is a medium severity vulnerability in sigoden dufs up to version 0.46.0 affecting the WebDAV COPY Operation Handler in src/server.rs. It causes incorrect authorization, allowing remote attackers to exploit the flaw. Upgrading to version 0.47.0 mitigates the issue.

CVE-2026-129354 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-600L router version 2.17b02. The flaw exists in the hnap_main function of the HNAP Handler component, allowing remote attackers to execute a buffer overflow via crafted input. Exploit code has been published, increasing the risk of exploitation.

A critical security vulnerability (CVE-2026-129351) exists in TRENDnet TEW-657BRM version 1.00.1. The flaw is an out-of-bounds write caused by improper handling in the sprintf function within the /setup.cgi file of the mini_httpd component. This vulnerability can be exploited remotely without authentication. The product is end-of-life and no longer supported by the vendor, who has not confirmed the vulnerability's existence but plans to notify customers. The vulnerability has a maximum CVSS score of 10.0, indicating severe impact on confidentiality, integrity, and availability.

A critical stack-based buffer overflow vulnerability exists in the authenticationcgi_main function of the authentication.cgi file in D-Link DIR-600L firmware versions 2.17 and 2.17b02. This vulnerability can be remotely exploited by manipulating the id/password argument, potentially leading to complete system compromise. Public exploit code is available.

A critical stack-based buffer overflow vulnerability exists in TRENDnet TEW-657BRM version 1.00.1, specifically in the processing of the /usr/sbin/upgrade_flash.cgi file. This vulnerability can be exploited remotely by manipulating the argument boundary, potentially leading to complete compromise of confidentiality, integrity, and availability. The vendor has not confirmed the vulnerability due to the product being end-of-life for over 15 years and has indicated they will notify customers accordingly. Public exploit code is available.