CVE-2026-84295 is a critical improper authentication vulnerability in Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.6 and 2025.0.3. An unauthenticated remote attacker could exploit this flaw to gain access to sensitive information, including administrative credentials. The vulnerability has a CVSS score of 10.0, indicating a severe impact on confidentiality, integrity, and availability. Fixed versions 2024.0.6 and 2025.0.3 are available to remediate this issue.
RT-Labs P-Net versions before 1.0.3 contain a vulnerability where the RPC session allocated for requests naming unknown interface or object UUIDs is not released and no timeout is started. This leads to exhaustion of available sessions when repeated requests with different activity UUIDs are made, causing the device to stop responding to new RPC requests until restarted. This can be exploited remotely without authentication to cause a denial of service.
CVE-2026-115794 is a low-severity vulnerability in RT-Labs P-Net versions before 1.0.3. It involves improper handling of a length parameter in the application alarm callback, where the data length derived from a received alarm frame is not validated against the actual frame length. This can cause the callback to receive an excessively large length value, potentially leading to out-of-bounds reads if the application copies that many bytes. Exploitation requires an established Application Relationship and adjacent network access. Applications that do not use the alarm data are not affected. The issue is fixed in version 1.0.3.
CVE-2026-115795 is an out-of-bounds read vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs because the software does not verify the presence of a complete block header before reading subsequent blocks in DCP Set and Identify requests. This can lead to reading memory beyond the buffer boundary or processing a block with an incorrect length, potentially causing a crash or limited memory disclosure. Exploitation requires adjacent network access.
CVE-2026-111736 is a high-severity vulnerability in RT-Labs P-Net before version 1.0.3. It involves a NULL pointer dereference in the function pf_fspm_cm_read_ind() when processing an implicit read request lacking a valid target AR UUID for a user-specific record index, provided the application has registered a read callback. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the affected device.
RT-Labs P-Net versions before 1.0.3 contain a resource management vulnerability where Application Relationships (AR) and RPC sessions are not released after rejecting RPC requests with incorrect endianness data representation. This leads to session exhaustion, causing the device to stop responding to new RPC requests until restarted. The flaw allows a remote unauthenticated attacker to cause a denial of service.
CVE-2026-84294 is a high-severity vulnerability in Progress Software WS_FTP Server affecting versions prior to 2024.0.6 and 2025.0.3 on Windows. It involves improper limitation of pathname in the Ad Hoc Transfer component, allowing an authenticated user to access files outside the intended directories. This vulnerability has been fixed in versions 2024.0.6 and 2025.0.3.
CVE-2026-111735 is an integer underflow vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs in the pf_cpm_c_data_ind() function when processing a received cyclic data frame in specific consumer states. A crafted short frame causes a 16-bit arithmetic underflow in the offset calculation, leading to out-of-bounds memory reads. This can result in a denial of service crash or disclosure of memory contents. The issue is fixed in version 1.0.3.
CVE-2026-111734 is an out-of-bounds read vulnerability in RT-Labs P-Net before version 1.0.3. The vulnerability arises because the function pf_eth_recv() does not properly validate the length of received Ethernet frames before reading fields such as EtherType, VLAN tags, and PROFINET FrameID. Specifically, the VLAN tag processing loop lacks an upper bound, which can cause the function to read beyond the end of the receive buffer when processing truncated frames or frames composed solely of VLAN tags. This can lead to a denial of service via a crash or unintended disclosure of memory contents.
CVE-2026-111733 is a high-severity vulnerability in RT-Labs P-Net versions before 1.0.3. It involves a NULL pointer dereference triggered by handling an implicit read request without a valid target AR UUID for certain record indices. This flaw allows a remote unauthenticated attacker to cause a denial of service by crashing the device. The issue is fixed in version 1.0.3.
CVE-2026-111732 is a critical out-of-bounds write vulnerability in RT-Labs P-Net versions before 1.0.3 when built with the PNET_OPTION_AR_VENDOR_BLOCKS option enabled. The vulnerability arises because the software parses a data length from a field in the ARVendorBlock request that is not defined as part of the block and uses this length to copy data into a fixed-size buffer without proper bounds checking. This can be triggered by a crafted Connect request, potentially causing a crash or arbitrary code execution. The vulnerable option is disabled by default.
CVE-2026-111731 affects RT-Labs P-Net versions before 1.0.3 and causes an infinite loop when processing a specific read request. The flaw occurs when handling a read request for the PDPortDataCheck record with subslot 0, where the loop over ports never advances, leading to a denial of service. This can be triggered remotely without authentication, causing the device to stop responding.
CVE-2026-111730 is a high-severity out-of-bounds write vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs due to improper validation of the LengthPeerStationName field in a CheckPeers block, allowing an attacker to write up to 15 bytes beyond a fixed-size buffer. Exploitation requires establishing a session with adjacent network access. The vulnerability can lead to denial of service or potentially arbitrary code execution. A fix is available in version 1.0.3.
The npm package '789bet-vip-login' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package '789bet-vip-online-login' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but due to potential full control by an attacker, removal may not eliminate all malicious components. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package '789bet-vip' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by attackers.
The npm package '789bet-login-th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, clean machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package '789bet-entrance' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.
The npm package '789bet-slot' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious components, as attackers may have established persistent control.
The m98vip npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.