CVE-2026-111730 is a high-severity out-of-bounds write vulnerability in RT-Labs P-Net versions before 1.0.3. The flaw occurs due to improper validation of the LengthPeerStationName field in a CheckPeers block, allowing an attacker to write up to 15 bytes beyond a fixed-size buffer. Exploitation requires establishing a session with adjacent network access. The vulnerability can lead to denial of service or potentially arbitrary code execution. A fix is available in version 1.0.3.
The npm package '789bet-vip-login' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package '789bet-vip-online-login' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but due to potential full control by an attacker, removal may not eliminate all malicious components. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package '789bet-vip' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by attackers.
The npm package '789bet-login-th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, clean machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package '789bet-entrance' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.
The npm package '789bet-slot' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious components, as attackers may have established persistent control.
The m98vip npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
The npm package 'm98th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The m98bet npm package contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, secure machine. Removal of the package alone does not guarantee eradication of all malicious software introduced by it.
The npm package '789bet' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected machine. Removal of the package alone may not eliminate all malicious software introduced by its installation.
CVE-2026-112256 is a critical vulnerability in OpenText Advanced Authentication Server that allows acceptance of extraneous untrusted data alongside trusted data. This flaw leads to accessing functionality not properly constrained by access control lists (ACLs), potentially enabling unauthorized actions. The vulnerability affects versions from 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0. Fixed versions are 6.4.3.9, 6.5.0.11, and 6.6.2.0. The CVSS 4.0 score is 9.2, indicating a critical severity level.
A path traversal vulnerability exists in the MasterStudy LMS plugin for WordPress versions before 3.7.50. Authenticated users with Subscriber-level privileges can exploit this flaw by supplying directory traversal sequences in a specific AJAX parameter, allowing them to import arbitrary WXR XML files. This enables attackers to publish posts with attacker-controlled content under their identity without proper capability checks or nonce verification.
A missing authorization vulnerability exists in Cozmoslabs Profile Builder up to version 4.0.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability does not impact confidentiality or availability but can affect data integrity.
The MasterStudy LMS plugin for WordPress versions before 3.7.50 has a missing authorization vulnerability. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without proper capability or nonce validation. Exploitation can lead to an uncaught PHP fatal error that may disclose the absolute filesystem path of the plugin if PHP error display is enabled.
A Missing Authorization vulnerability (CWE-862) exists in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons up to version 3.4.2. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact with low confidentiality impact and no integrity or availability impact.
A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers with limited privileges to exploit incorrectly configured access control levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3. No patch or official fix information is currently provided.
A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw could enable unauthorized access to certain functions or data within the affected software.
A missing authorization vulnerability exists in the miniOrange Page Restriction WordPress plugin up to version 1.6.1. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.
A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact primarily on integrity without affecting confidentiality or availability.