JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.
Affected versions:
Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually causing GC thrash and OutOfMemoryError.
Affected versions:
Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.
Affected versions:
Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.
Affected versions:
Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.
Affected versions:
micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.
micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
micrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the portalAuth parameter of the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple stack overflows in the formSetDebugCfgr function via the enable, level, and module parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the IPMacBindRuleIp parameter of the formIPMacBindModify function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the picCropName parameter of the formCropAndSetWewifiPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
The package `embiggen` version 0.11.97 contains a malicious `.pth` file (`embiggen-setup.pth`) that executes a Bun-based credential stealer on every Python startup via CPython's `site.py` exec() mechanism. The payload downloads the Bun runtime from the official GitHub release page, then runs an obfuscated JavaScript stealer that exfiltrates environment variables, .env files, SSH keys, and cloud credentials to an attacker-controlled GitHub repository. This is part of the Hades/Miasma campaign (also called Shai-Hulud), attributed to the TeamPCP threat actor.
Novel finding: `gpsea/_index.js` (same campaign) embeds CBRN-level dangerous-content text to trigger AI safety refusals in LLM-based security scanners, causing them to skip the file entirely.
C2 IP: 20.207.73.82
Sentinel file: /tmp/.bun_ran
MITRE ATT&CK: T1546.018
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (fde146ce352fe0581926c899cde5be769d4b7e0e04210bec5555889b4fe66636)
The package was found to contain malicious code or consuming dependency that contains malicious code
## Source: kam193 (51ebfbf23c315702e5792c88fdc20449c798cebdbbdde4462cd98e3b7625618f)
Versions 0.11.97 were compromised.
Compromised packages start an obfuscated infostealer. The infostealer is a heavily obfuscated JavaScript code executed using Bun runtime on Python startup. It collectes all kinds of sensitive data, including API keys, credentials to package repositories, cryptocurrency assets, password manager data. Infostealer actively queries online services to collect additional secrets as well as attempts to gain persistence and spread further by publishing infected packages using collected credentials. Data are exfiltrated likely using Github. The code seems to threaten to wipe the user's data if it detects invalid GitHub tokens. Cleanup should be done with caution.
It seems to be related to the recent Mini Shai Hulud campaign.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-compr-woodpecker
Reasons (based on the campaign):
- compromised-package
- exfiltration-env-variables
- exfiltration-cloud-tokens
- exfiltration-credentials
- abuses-pth
- obfuscation
- infostealer
- The package contains code to detect if it is running in a sandbox environment.
- exfiltration-crypto
- files-exfiltration
- destructive-actions
Bulletin ID: AWS-2025-028 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/11/10 10:15 AM PDT Description: Amazon Aurora PostgreSQL a fully managed relational database engine that's compatible with PostgreSQL. We identified CVE-2025-12967, an issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users. Impacted versions: - AWS JDBC Wrapper <2.6.5 - AWS Go Wrapper <2025-10-17 - AWS NodeJS Wrapper <2.0.1 - AWS Python Wrapper <1.4.0 - AWS ODBC driver <1.0.1
CVE-2026-7762 is a critical heap-based buffer overflow vulnerability in the Morse Micro HaLowLink 2 dot11ah.ko kernel driver affecting versions prior to 2.11.13. An unauthenticated attacker within radio range can exploit this by sending a crafted 802.11ah beacon or probe response frame with a malformed S1G Capabilities Information Element, causing a kernel panic or potentially remote code execution. The vulnerability arises because the driver copies up to 255 bytes into a 15-byte buffer without proper length validation. Exploitation requires no authentication or user interaction and can occur during normal scanning.
Nextcloud is an open source content collaboration platform. From versions 17.0.0 to before 17.0.15, 18.0.0 to before 18.1.12, 19.0.0 to before 19.1.16, 20.0.0 to before 20.1.11, and 21.0.0 to before 21.0.4, a user with READ and CREATE permission, but no UPDATE permission for a team folder can rename files in the team folder. This issue has been patched in versions 17.0.15, 18.1.12, 19.1.16, 20.1.11, and 21.0.4.
This update for hplip fixes the following issues:
Changes in hplip:
- Update to HPLIP 3.26.4
* CVE-2026-8631: Fixed privileges escalation and/or arbitrary code execution via an integer overflow in the hpcups processing path (bsc#1266023)
* CVE-2026-8632: Fixed privileges escalation and/or arbitrary code execution via operating system command injection (bsc#1266024)
- Add support for the following new printers:
* HP LaserJet Pro MFP 3106sdw
* HP LaserJet Pro MFP 3105sdw
* HP Envy 6500e series
* HP Envy 6500 series
* HP OfficeJet Pro 9730 Series
* HP OfficeJet Pro 9730e Series
* HP OfficeJet Pro 9720 Series
* HP OfficeJet Pro 9720e Series
* HP OfficeJet Pro 8130e All-in-One series
* HP OfficeJet Pro 8130 All-in-One series
* HP OfficeJet 8130e All-in-One series
* HP OfficeJet 8130 All-in-One series
* HP OfficeJet Pro 8120e All-in-One series
* HP OfficeJet Pro 8120 All-in-One series
* HP OfficeJet 8120e All-in-One series
* HP OfficeJet 8120 All-in-One series
* HP DeskJet Ink Advantage ultra 5800 All-in-One Printer series
* HP DeskJet Ink Advantage ultra 5100 All-in-One Printer series
* HP DeskJet 4300e All-in-One Printer series
* HP DeskJet Ink Advantage 4300 All-in-One Printer series
* HP DeskJet 4300 All-in-One Printer series
* HP DeskJet 2900e All-in-One Printer series
* HP DeskJet Ink Advantage 2900 All-in-One Printer series
* HP DeskJet 2900 All-in-One Printer series
- Update to HPLIP 3.25.8
- Added support for the following new Printers:
* HP LaserJet Enterprise Flow MFP 8601z
* HP LaserJet Enterprise 5501
* HP LaserJet Enterprise MFP 5601dn
* HP LaserJet Enterprise 6500dn
* HP LaserJet Enterprise 5501n
* HP LaserJet Enterprise MFP 5601
* HP LaserJet Enterprise 6500
* HP LaserJet Enterprise 5502dn
* HP LaserJet Enterprise MFP 5602dn
* HP LaserJet Enterprise 6500n
* HP LaserJet Enterprise 5502
* HP LaserJet Enterprise MFP 5602f
* HP LaserJet Enterprise 6501dn
* HP LaserJet Enterprise X50452dn
* HP LaserJet Enterprise Flow MFP 5602zfw
* HP LaserJet Enterprise 6501
* HP LaserJet Enterprise X50452
* HP LaserJet Enterprise MFP 5602
* HP LaserJet Enterprise X60257dn
* HP LaserJet Enterprise MFP X53052dn
* HP LaserJet Enterprise Flow MFP X530
* HP LaserJet Enterprise X60257
* HP LaserJet Enterprise MFP X53052
* HP LaserJet Enterprise X60357dn
* HP LaserJet Enterprise X60357
* HP LaserJet Enterprise MFP 6600dn
* HP LaserJet Enterprise Flow MFP 6600zfw
* HP LaserJet Enterprise MFP 6600
* HP LaserJet Enterprise Flow MFP 6600zfsw
* HP LaserJet Enterprise MFP X62757dn
* HP LaserJet Enterprise Flow MFP X62757zs
* HP LaserJet Enterprise MFP X62757
* DEX D50452dn
* DEX MFP D53052dn
- Fix handling of readfp() and read_filke() for ConfigParser objects,
avoiding confusing error messages (lp#2139771)
- Fix compiler warnings on SLE15
- Fix "Found No Section" error with python (lp#2095776)
- Fix PPD lookup by moving PPDs from manufacturer-PPDs/hplip-fax
to manufacturer-PPDs/hplip/fax etc (boo#1257529)
- Move more utilities from hplip-utils to hplip-base.
* hplip-base now contains all utilities that are not totally useless
and can run without the Qt GUI.
- Update fix for support of new GPG key, as the key has now been
uploaded to GPG keyservers (lp#2120738)
- This fixes CVE-2025-43023 (bsc#1266031)
- Drop dependency on cups-ppdc. It isn't necessary, as PPD
generation on target system is done by cups-driverd.
- The old and outdated 'hpijs' driver support is finally dropped
(the 'hpcups' driver is the default driver since 2009)
so that there is no need for foomatic-filters (boo#1250481)
- Continue refactoring:
* move GUI tools to "hplip-utils" subpackage
* convert "hplip" into an empty metapackage that pulls in hplip-utils
and all drivers / PPDs (except hpijs PPDs).
- Refactor package structure:
* hplip: full set of utilities. Pulls in almost all subpackages
to deliver the "traditional" hplip experience
* hplip-base: small set of basic utilities that can be run
without GUI. Includes hp-probe and hp-plugin
* hplip-cups: minimal package for printing, without PPDs or
setup helpers
* hplip-sane: scanning support (unchanged)
* hplip-driver-hpcups: hpcups.drv for generating hpcups PPDs on
the fly (requires ppdc). The functionality of this package is
similar to the old (misnamed) "hplip-hpijs" package.
* hplip-driver-hpijs: hpijs.drv for generating PPDs for the deprecated
hpijs / foomatic_rip filter. Note that this functionality was not part of
the late hplip-hpijs package, because upstream hasn't ship foomatic PPDs
since hplip 3.17.11.
* hplip-ppds-{hpcups,hpps,postscript,hpijs,fax,plugin}: static PPD
files for different printer types.
hplip-ppds-hpcups is an alternative to hplip-driver-hpcups.
* libhplip0: shared library package, used by hplip-cups and
hplip-sane
* hplip-common: configuration files and directories
Multiple vulnerabilities affecting GitLab Community Edition and Enterprise Edition versions from 12.7 up to but not including 18.10.7, 18.11 up to but not including 18.11.4, and 19.0 up to but not including 19.0.1 have been identified and fixed. These include issues related to improper resource management and authorization flaws across six CVEs including CVE-2026-1402. No known exploits in the wild have been reported. The product is not a cloud service. A patch is available for these vulnerabilities.
Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. CorsAllowedDomains: [".*"] reflects any Origin, and LocalhostIsAdmin: true promotes requests from 127.0.0.1 to mesh-system:admin. A cross-origin fetch() from a malicious page returns the admin JWT and signing material. This vulnerability is fixed in 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5.
Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.