A vulnerability in @sd-jwt/decode version 0.19.0 and earlier allows tampered disclosures in SD-JWT presentations to be silently dropped instead of causing rejection. This leads to a reduced claim set being accepted without error, enabling a malicious holder or an on-path attacker to omit claims without detection. The issue violates RFC 9901 requirements for disclosure validation and can cause relying parties to make incorrect authorization decisions if they default to allow when claims are missing.
CVE-2026-111048 is a high-severity cross-site scripting (XSS) vulnerability in FOSSBilling versions 0.1.0 through 0.8.8. It affects the admin/support/note_create endpoint where the note parameter is stored without sanitization and rendered unsafely via innerHTML in the admin ticket list. A staff user with support.manage_tickets permission can inject malicious scripts that execute in the context of other staff members viewing the ticket notes, potentially allowing theft of CSRF tokens and unauthorized administrative actions. The issue is fixed in version 0.8.9.
Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.
To remediate this issue, users should redeploy from the latest version of awslabs/virtual-engineering-workbench.
CrewAI versions prior to 1.15.17 contain a server-side request forgery (SSRF) vulnerability due to flaws in its SSRF guard and HTTP client. These components incorrectly validate URLs by checking opposite content, allowing malicious URLs to bypass protections and perform SSRF attacks, such as via the ScrapWebsiteTool. The issue is fixed in version 1.15.17.
The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.
By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.
The Private Internet Access (PIA) Firefox extension has an authentication vulnerability due to an unguarded onAuthRequired handler. This flaw allows leakage of PIA proxy credentials when a user visits a malicious website that issues a Basic authentication challenge. Although fixed in version 3.2.5, the vulnerability was reintroduced in later versions up to 4.0.5.
The npm package 'bfvkjmeikpwhqxc' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
A malicious file identified by the SHA-256 hash 9ed487498235f289a960a5cc794fa0ad0f9ef5c074860fea650e88c525da0ab4 was observed by OffSeq Mirage honeypot sensors on November 2, 2026. This file was detected twice in attacker activity originating from infrastructure in France. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file is likely a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 2ddf902d0e9c4d8f28598df149c4ad3fee4d966b5c2b1e8eff5cb2677ddb3130 was observed twice in attacker activity on November 2, 2026. The attack involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools into a target environment. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This indicator should be matched against files in environments and security feeds to detect potential compromise.
Red Hat has issued a security advisory for a kernel update addressing two vulnerabilities in the Linux kernel's ethtool component. The fixes cap profile updates at a defined limit (CVE-2026-63987) and require exact CDB reply length (CVE-2026-63996). These updates are rated as having moderate security impact. Systems running affected Red Hat Enterprise Linux 9.8 versions should apply the update and reboot to ensure protection.
The 'internal-renderers' npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package 'pandafortunerush' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by its installation, as full control of the computer may have been granted to an attacker.
The URL 'oast.pro' has been observed in attacker activity involving ingress tool transfer (T1105) on 2026-11-02. This URL was seen in attacker payloads used for tool download, callback, or exploitation targeting. The activity originated from attacker infrastructure located in France. Security teams are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
The npm package @levvicode/eslint-config contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'justinofficial' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by it.
The npm package @maulenv/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'nachles' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package 'aytidaoffc' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @levvicode/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of the malicious software, as full control may have been granted to an external attacker.