A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument _display_name results in path traversal. The attack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development.
The 3.30 release is based on Eclipse Che 7.121 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2.
Users still using the v1 standard should migrate as soon as possible.
https://devfile.io/docs/2.2.0/migrating-to-devfile-v2
Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates.
https://access.redhat.com/support/policy/updates/openshift#crw
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin.
The URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased.
The query-string path is unaffected, since URLSearchParams.set encodes its own values.
This issue affects ash_typescript: from 0.15.0 before 0.18.0.
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.21.31. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:60477
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of
Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
All Red Hat build of MicroShift 4.21 users are advised to use these updated
packages and images when they are available in the RPM repository.
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files.
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists via `InputFilter` and `htmlspecialchars` were implemented.
Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.
The miniOrange Oauth Client (free) extension for Joomla contains an improper access control vulnerability that allows unauthenticated attackers to uninstall arbitrary installed extensions. This issue affects only the free versions of the miniOrange plugins and arises from a missing authentication check. The vulnerability has a high severity score of 8.8 CVSS 4.0 and can lead to significant impact by enabling attackers to disrupt Joomla installations by removing extensions without authorization.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859)
The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx `to` field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached `spawn('node', ['-e', <code>])`. Execution is wired to two auto-triggers: pyproject.toml overrides setuptools `build_py` and `develop` with pyservercheck._setup_cmd.BuildPy/Develop, whose `run()` calls _run_main_js_now() -> subprocess.run(['node', main.js]) during `pip install` / `pip install -e.`; and BuildPy also writes a `pyservercheck.pth` file containing `import pyservercheck._hooks; pyservercheck._hooks.ensure_once()`, which Python auto-executes at every interpreter startup, invoking run_js() again. The `.main_js_ran` marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run.
## Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a)
Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.
The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pybitjs
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- malware
- abuses-pth
- c2-in-blockchain
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.
The npm package 'ux-metrics-client-interaction-subscriber' version 45.0.0 contains malicious code delivered via a self-referential dependency pointing to an external non-registry URL. Installing this package results in arbitrary code execution on the installer's machine due to unverified code fetched from https://repo.securityctrl.com. The package's index.js is inert, making the manifest the primary attack vector. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system must be rotated from a separate, secure machine.
This update for broot fixes the following issues:
Changes in broot:
- v1.59.0 (CVE-2026-72847 boo#1275994)
* new shell_command verb attribute: run a command through a shell (sh -c / cmd /C) so &&, ; and pipes work, without leaving broot - Fix #1145
* fix invalid official Mac binary (duplicate linked dylib) with new build chain - Fix #1194
* Sixel graphics support for image preview, auto-detected: works in iterm2, Windows Terminal 1.22+ and Sixel-capable Unix terminals (foot, mlterm, xterm built with Sixel, recent WezTerm). Kitty remains the preferred protocol when available. Note: this requires broot to be compiled with sixel feature (eg cargo install broot --features sixel) - Fix #568
* High-Res images in Rio terminal (detect it to enable the Kitty image protocol) - Fix #1179
* fix iTerm2 3.6.10 and later not displaying Hi-Res images, the version being compared as text
* fix content-exact match line number off-by-one when the match starts at the first byte of a line (broot jumped to the line above)
* new :no_action internal, doing nothing, which can be used to disable a key - Fix #328
* fix: detect a duplicate broot server name instead of silently overtaking the running server - Fix #1065
* fix preview transformers extension matching not working with double extensions such as .tar.gz - Fix #1195
* strip escape sequences from displayed names to prevent OSC injections - Fix #1188
* fall back to numeric uid/gid instead of ???? when the user or group name can't be resolved, which is always the case on statically linked musl builds - Fix #1075
* fix panic on a content regex matching the empty string at the end of a line ending with a control char (eg cr/$/ on a CRLF file)
* fix Windows paths (containing backslashes) being mangled by the launcher's eval when using :cd and similar; also fixes escaping of paths containing a single quote - Fix #1100
* fix br failing on Windows/PowerShell when the temp path contains a space (e.g. a space in the Windows username) - Fix #788
* JPEG XL images are no longer previewed: the decoder had out-of-bounds bugs and the fix needs a more recent rustc (if you need it, tell me and I'll try to make it opt-in)
* rustc minimal version changed from 1.83 to 1.85, and edition 2024
- v1.58.0
* change the way possible verb completions are listed, making it more readable when there are more than what fits the screen
* fix argument of :select and :show being ignored in a --cmd sequence - Fix 1176
- v1.57.0
* help: verb 'keys' and 'description' columns now searchable - Fix #1163
* fix :print_path / :print_relative_path adding a trailing empty line when printing a multi-item staging area - Fix #1062
* Skin: attributes (bold, underlined, etc.) of the "selected_line" entry now applied - Fix #1156
* if no Wezterm version is found, broot now assumes it's recent enough to support kitty protocol for image - Fix #509
- v1.56.4
* fix compilation on non unix platforms (1.56.3 isn't available on those systems)
- v1.56.3
* fix control characters sometimes remaining in the terminal after broot exit
* nushell: rename br module to avoid conflict in last nushell version - Fix #1138
* :open_stay on the staging area opens every staged file through the system opener - Fix #444
- v1.56.2
* {file-root-relative} argument - Fix #1142
* fix :clear_stage (or other operations closing the stage panel) often closing broot - Fix #1143
- v1.56.1
* fix a typo in a verb in default conf
- v1.56.0
* impacted_panel verb argument, allows the effect of a verb to be on another panel (eg to scroll the preview panel without removing the focus from the tree) - Fix #1119
* focus_panel_left and focus_panel_right internals - Fix #1115
* Major Feature: merge staged files to issue a single command: when a verb argument has a space-separated or comma-separated flag, a single external command is run even when the selection is multiple - Fix #465 The default verbs.json file has an example of a zip verb building an archive from all staged files.
- v1.55.0
* activate Kitty Graphics Protocol to display Hi-Res images in iTerm2
* Tokyo Night skin ( https://github.com/Canop/broot/blob/main/resources/default-conf/skins/tokyo-night.hjson )
* matches related to several name patterns joined with and/or in a composite pattern are merged instead of having just the first one shown
* nushell integration: switch $nu.temp-path to $nu.temp-dir - #1116
- v1.54.0
* fix crash on rendering B&W images with Kitty image protocol
* don't match directories when a composite pattern has a content pattern, even negated (eg /js$/&!c/;: it's clear the user wants to match js files not containing a semicolon)
- v1.53.0
* fix some cases of the verb not removed from the input on execution (with a risk of accidental double execution)
* add the :filesystems (short :fs) verb and state on windows (it was already present on linux and mac).
* improve the generation of preview pattern from
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
A reflected cross-site scripting (XSS) vulnerability exists in the All Video Share extension for Joomla by mrvinoth.com. Versions 1.0.0 through 4.4.99 do not properly escape various user-supplied inputs, allowing injection of malicious scripts that are reflected back to users. This vulnerability has a medium severity rating with a CVSS score of 5.3.
An authenticated, privileged blind SQL injection vulnerability exists in the DP Calendar extension for Joomla versions 5.5.0 through 10.11.2. The flaw occurs when saving an article with the content plugin, requiring update permissions on articles. This vulnerability can allow an attacker with appropriate privileges to execute unauthorized SQL commands on the backend database.
A critical vulnerability (CVE-2026-26897) exists in the EcoOnline EHS Android application version 0.2.499. This flaw allows a remote attacker to obtain sensitive information and execute arbitrary code by exploiting the AndroidManifest.xml component. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and no user interaction needed.