The npm package @crvouga/mockingbird-service-microsoft version 0.14.0 contains malicious code. Any computer with this package installed or running is considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine. However, removal of the package alone may not eliminate all malicious software introduced by it.
CVE-2026-129353 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-600L router firmware versions 2.17 and 2.17b02. The flaw exists in the authenticationcgi_main function of the authentication.cgi file, where manipulation of the id/password argument can trigger the overflow. This vulnerability is remotely exploitable without authentication. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-129352 is a critical stack-based buffer overflow vulnerability in TRENDnet TEW-657BRM version 1.00.1. It arises from improper processing of the /usr/sbin/upgrade_flash.cgi file, allowing remote attackers to manipulate argument boundaries and cause a buffer overflow. The product has been end-of-life for over 15 years, and the vendor has not confirmed the vulnerability but plans to notify customers. Exploit code is publicly available.
CVE-2026-129351 is a critical out-of-bounds write vulnerability in the TRENDnet TEW-657BRM version 1.00.1. It affects the sprintf function in the /setup.cgi file of the mini_httpd component. The vulnerability can be exploited remotely and public exploit code has been disclosed. However, the product has been end-of-life (EOL) for over 15 years and is no longer supported by the vendor.
The npm package 'testpackage83' version 1.0.0 contains malicious code that downloads and executes an untrusted binary from an unverified HTTP source during installation and runtime. This binary is fetched from a suspicious IPv4 address and masquerades as a patched Chromium executable. The package executes this binary via puppeteer-core, potentially allowing arbitrary code execution on the user's machine.
CVE-2026-129456 is a use-after-free vulnerability in FRRouting's bgpd component involving the Tunnel Encapsulation attribute (type 23). A BGP neighbor can send crafted UPDATE messages that cause reference count imbalances, leading to freed memory being accessed and freed again. This results in bgpd aborting and dropping all BGP sessions. The issue requires an established BGP session and is triggered when "soft-reconfiguration inbound" is configured. The vulnerability affects versions 10.4.0 through before 10.4.4 and 10.5.0 through before 10.5.4. Fixed versions 10.4.4 and 10.5.4 are available.
A high-severity vulnerability exists in Kingston FURY CTRL RGB Control Software up to version 2.0.66.0. The flaw involves an exposed IOCTL interface in the NTIOLib_X64.sys library's IOCTL Handler component, which lacks sufficient access control. Exploitation requires local access and can lead to complete compromise of confidentiality, integrity, and availability.
The Multi Step for Contact Form 7 WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'multipart field name (array key)' parameter in all versions up to and including 2.9.1. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Save every step' option enabled on the target form and the Database for Contact Form 7 companion plugin active with its 'Expandable' table option enabled, both disabled by default.
The BuddyForms plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'buddyforms_form_content' parameter in all versions up to and including 2.10.6. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Exploitation requires a form configured with the public_submit option, which is enabled by default in the plugin's bundled Post Simple template. The vulnerability has a medium severity rating with a CVSS score of 5.4.
A vulnerability in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to version 3.5 allows unrestricted file upload via the DiyFileUpload function in /ws.asmx. This flaw permits remote attackers to upload arbitrary files without restriction. Public exploit code is available, but the vendor has not responded or issued a fix.
The Lightbox & Modal Popup WordPress Plugin (FooBox) versions up to and including 2.8.7 are vulnerable to stored DOM-based cross-site scripting (XSS) via the 'img alt attribute inside .wp-caption container' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Exploitation requires subscriber-level access if bbPress 2.6.20 is installed with a public forum and approved topics, or contributor-level access otherwise.
A security vulnerability in sox_ng up to version 14.8.1 affects the VOC Decoder component, specifically the read_samples_voc function in src/voc.c. This flaw allows an out-of-bounds write, which can be triggered remotely. The vulnerability has a medium severity with a CVSS score of 5.5. A patch identified by commit 0b40408b has been released by the vendor, who responded promptly and professionally. Exploit code has been publicly disclosed, but no confirmed exploitation in the wild is reported.
A path traversal vulnerability exists in Mereithhh VanBlog up to version 0.54.0 in the fs.readFileSync function within local.provider.ts of the Custom Page Handler component. This vulnerability allows remote attackers with high privileges to manipulate the file path argument, potentially leading to unauthorized file access. A public exploit has been disclosed. Upgrading to version test-20261013 resolves the issue.
A cross-site scripting (XSS) vulnerability exists in sergix44 XBackBone up to version 3.8.2 in the MediaController::getRawById function. This vulnerability allows remote attackers to inject malicious scripts. Public exploit code is available, but the fix is pending acceptance of a pull request.
The FV Player 8 WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'fv_player_videos' parameter affecting all versions up to and including 8.1.9. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts into pages, which execute when viewed by others. Exploitation requires the 'Allow visitors to upload videos to their profile' setting to be enabled, as this setting controls access to the vulnerable save functionality.
Kroki versions before 0.36.0 have a reflected cross-site scripting (XSS) vulnerability in the /dbml/svg endpoint. This flaw allows unauthenticated attackers to inject JavaScript via crafted DBML table URL, header color, or TableGroup color parameters. When a user opens the crafted SVG link and clicks the table header, the injected JavaScript executes in the context of the Kroki origin.
The gateio-ws package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This package is part of a campaign involving typosquatting and is designed to exfiltrate environment variables and other data, raising significant privacy and security concerns.
The PyPI package demo-pingtest-xyz version 0.0.1 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-risk package resembling pentest or testing tools but with unauthorized data exfiltration functionality.