---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf)
Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package (reusing its description, repository URL github.com/srounet/Pymem, and author identity Fabien Reboia <srounet@gmail.com>) republished under a confusable name. The top-level pymem/__init__.py contains a one-line loader that reverses a bytes literal, base64-decodes it, zlib-decompresses it, and passes the result to exec(). This runs unconditionally on `import pymem`, handing full in-process code execution to a payload deliberately hidden behind three stacked transforms. The multi-layer obfuscation around an exec target has no legitimate purpose in a library import path; combined with the typosquat cover story that reuses the upstream author's identity, the package's function on install/import is to run attacker-chosen code inside any process that imports it.
## Source: kam193 (82eb1f11c9b56a2f2c3e97530db43ef94784a2c75697223828403927b0528477)
During import, the obfuscated code downloads and executes an executable. The remote executable did not exist during analysis, but the repository used to host it overlaps with previous campaign 2026-07-yt-api-dlp
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-pymem-win
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote executable.
- clones-real-package
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter.
A security bypass vulnerability was discovered in `@angular/common` when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical `HttpClient` configuration with `withRequestsMadeViaParent()`.
The `HttpTransferCache` utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via `TransferState` (serialized as JSON in `<script id="ng-state">`). Following the remediation of [CVE-2026-50170](https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x), `HttpTransferCache` automatically skips caching requests that contain authentication headers or credentials (`Authorization`, `Cookie`, `withCredentials`, etc.).
However, when a child `HttpClient` delegates to a parent client via `withRequestsMadeViaParent()`, the child's `TransferCache` interceptor evaluates whether the request is eligible for caching **before** delegating to the parent client's interceptor chain.
If an outgoing request originates as anonymous from the child client, the child `TransferCache` marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an `Authorization` header or API token), the parent `TransferCache` correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child `TransferCache` still stores the response in `TransferState` based on its initial pre-delegation evaluation.
### Impact
Successful exploitation allows sensitive, user-specific information belonging to an authenticated user to be leaked to unauthenticated or unauthorized users. This occurs when:
1. During SSR, a child `HttpClient` initiates an unauthenticated request that is subsequently authenticated by a parent interceptor.
2. The authenticated response body is cached into the SSR-rendered HTML page (`TransferState`).
3. The rendered HTML page is stored by a shared caching layer (e.g., CDN, edge cache, or reverse proxy) or served across user sessions.
4. Subsequent visitors requesting the same page receive the cached HTML containing the previous user's private data.
### Attack Preconditions & Vulnerable Configurations
An application is affected only if **all** of the following conditions are met:
* **SSR and Hydration Enabled:** The application uses Server-Side Rendering with hydration enabled (e.g., via `provideClientHydration()`).
* **Hierarchical `HttpClient` with Delegation:** The application configures a child `HttpClient` using `withRequestsMadeViaParent()`.
* **Parent-Level Authentication Injection:** Authentication credentials (such as `Authorization` headers, session cookies, or custom API tokens filtered via `withHttpTransferCacheOptions`) are attached by an interceptor in the **parent** injector chain rather than on the initial child request.
* **Shared HTML Caching:** The SSR HTML responses are cached by a shared caching layer (CDN, reverse proxy, or application-level HTML cache).
#### Vulnerable Code Pattern Example
```ts
// Parent Injector / Application Config
export const appConfig: ApplicationConfig = {
providers: [
provideHttpClient(
// Parent interceptor attaches sensitive Authorization header
withInterceptors([
(req, next) => next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } }))
])
),
],
};
// Child Injector / Feature or Component Config
const childClient = createEnvironmentInjector(
[
// Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs
provideHttpClient(withRequestsMadeViaParent()),
],
parentInjector
).get(HttpClient);
// Request originates without auth headers -> marked cacheable by child TransferCache
childClient.get('/api/user/profile').subscribe();
```
### Patches
The issue is resolved by updating `@angular/common` to run root interceptors in the terminal request chain so that delegated clients leave inherited root interceptors to the parent chain, preventing duplicate execution and ensuring `HttpTransferCache` evaluates cache eligibility after parent request interceptors run.
* `22.1.1`
* `21.2.20`
* `20.3.28`
### Workarounds & Mitigations
For applications that cannot immediately upgrade to a patched version, use one of the following mitigations:
1. **Attach Credentials Before or Within the Child Client:** Ensure authentication headers (e.g., `Authorization`) are attached directly when constructing the request or via an interceptor configured directly on the child `HttpClient`, rather than relying solely on parent interceptors.
2. **Apply Explicit Cache Filters on the Child Client:** Configure `withHttpTransferCacheOptions` with a filter on the child client that explicitly excludes endpoints returning user-specific or sensitive data:
```ts
provideClientHydration(
withHttpTransferCacheOptions({
filter: (req) => !req.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30)
The package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied verbatim from @tailwindcss/forms) but its sole main module src/index.js is a heavily obfuscator.io-obfuscated Node loader with no CSS-plugin functionality. On require(), the module executes top-level code that installs a createRequire and publishes require, module, and global into named globals (global.r, global.m, global.i, plus several _H/_t_u/_t_s handles) and imports spawn from node:child_process — a stager shape that hands arbitrary execution primitives to code assembled from the rotating string array. It also enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io) and an Etherscan-like indexer, calls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, and pulls the transaction list for a hardcoded 42-character Ethereum address 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, using the returned data as C2 signalling. Results are POSTed with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. A CSS plugin has no legitimate reason for obfuscation, node:child_process, or Ethereum RPC traffic; the cover story does not match the shipped code, and the payload runs the moment a developer requires the package.
Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.
A path traversal vulnerability exists in the SP Property extension for Joomla versions 1.0.0 through 4.1.3. The flaw is due to improper limitation of a pathname to a restricted directory in the gallery image management controller, which lacks directory confinement checks. This vulnerability was assigned CVE-2026-78085 and has a medium severity rating with a CVSS 4.0 score of 6.9.
CVE-2026-78302 is a high-severity stored cross-site scripting (XSS) vulnerability in the SP Property extension for Joomla by joomshaper.com. Versions 1.0.0 through 4.1.3 are affected. The flaw arises from unescaped output in multiple template files across frontend views and administrator list tables, allowing unauthenticated attackers to inject malicious scripts. This vulnerability can lead to significant impacts due to high attack vector and complexity ratings.
CVE-2026-78374 is a medium severity vulnerability in the T4 Page Builder extension for Joomla by joomlart.com. Versions 1.0.0 through 2.2.0 are affected. The vulnerability allows unauthenticated attackers to send emails via an open mail relay through the front-end JSON editor's contact AJAX endpoint. This endpoint lacks authentication, CSRF protection, captcha enforcement (if no captcha plugin is enabled), and rate limiting. Attackers can fully control the recipient, subject, and HTML body of the email, which is sent from the site's configured sender identity.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the SP Property extension for Joomla versions 1.0.0 through 4.1.3. The vulnerability affects the property booking and agent contact form submission endpoints, which process POST requests without verifying Joomla session anti-CSRF tokens. This could allow an attacker to perform unauthorized actions on behalf of a logged-in user.
CVE-2026-78084 is a medium severity vulnerability in the SP Property extension for Joomla by joomshaper.com. Versions 1.0.0 through 4.1.3 are affected. The issue involves missing access control and lack of CSRF token validation in the gallery image management controller, allowing unauthorized users to perform file removal with arbitrary paths or upload unverified file types.
Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data.
## Impact
- `Cstruct.filter_map` writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped.
- `Cstruct.tail ~rev:true` removes two bytes instead of one and raises an exception for single-byte views.
- `Cstruct.cuts ~rev:true` may compare input against the wrong data, split at incorrect positions, and construct results using offsets outside the requested view.
- `Cstruct.find` and `Cstruct.find_sub ~rev:true` may return slices from the wrong location when operating on non-zero-offset views.
These are a set of logical indexing and bounds-calculation errors (CWE-682), and not direct memory-safety vulnerabilities. However, affected operations may return corrupted data, raise an unexpected exception, split input incorrectly, or return bytes outside the requested Cstruct view but still within its backing buffer.
In security-sensitive parsers, this could cause validation bypasses, denial of service, or unintended disclosure of adjacent buffer contents.
## Workarounds
Users unable to upgrade cstruct should backport the corresponding source changes. There is no configuration-based mitigation since these are buggy library calls.
## References
Discovered via [Scrutineer](https://github.com/alpha-omega-security/scrutineer) and Deepseek GLM-5.3 Flash running locally.
## Timeline
- 2026-09-04: reported via GitHub to ocaml/security-advisories repository
- 2026-09-05: reported via email to security@ocaml.org
- 2026-09-05: patch proposed and reviewed
- 2026-09-05: release cstruct 6.3.0
- 2026-09-10: published advisory
An unauthenticated SQL injection vulnerability exists in the SP Property extension for Joomla versions 1.0.0 through 4.1.3. The vulnerability arises from unsafe concatenation of user-supplied parameters into SQL queries in the property search and map filtering features, allowing attackers to perform blind SQL injection attacks to extract sensitive database information.
A vulnerability in the SP Property extension for Joomla versions 1.0.0 through 4.1.3 allows unvalidated email destination and form manipulation in booking requests. This occurs because booking inquiries rely on client-submitted hidden fields for recipient routing, which can be manipulated to insert sensitive information into sent data. The issue is tracked as CVE-2026-78303 with a medium severity rating and a CVSS score of 6.9.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.70. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:62548
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/
Security Fix(es):
* unbound: Unbound Cache poisoning (CVE-2025-5994)
* sqlite: Integer Truncation in SQLite (CVE-2025-6965)
* podman: Podman kube play command may overwrite host files (CVE-2025-9566)
* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)
* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)
* kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)
* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)
* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)
* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)
* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
* samba: vfs_worm does not block directory modification (CVE-2026-2340)
* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833)
* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)
* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.
The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
Panorama is impacted by this vulnerability.
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.19.46. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:63047
Security Fix(es):
* net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of
Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814)
* net/mail: golang: net/mail: Denial of Service via pathological email
address parsing (CVE-2026-42499)
All Red Hat build of MicroShift 4.19 users are advised to use these updated
packages and images when they are available in the RPM repository.
CVE-2026-69294 is a vulnerability in Microsoft Windows 10 Version 1809 and later versions that allows an authorized local attacker to obtain sensitive information through error messages generated by Microsoft COM. The flaw involves the generation of error messages containing sensitive data, which could lead to information disclosure. This issue has been officially fixed in multiple Windows 10 builds.
CVE-2026-69299 is a use-after-free vulnerability in Microsoft COM on Windows 10 Version 21H2 that allows an authorized local attacker to elevate privileges. The flaw affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue. No known exploits are reported in the wild.