LearnPress Course Wishlist Add-on versions before 4.1.2 have an insecure direct object reference (IDOR) vulnerability. This flaw allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to a REST API endpoint instead of relying on session identity. The vulnerability affects the publicly accessible load_content_via_ajax REST route, which requires only a public wp_rest nonce. Attackers can add or remove courses from any user's wishlist and check if a course is wishlisted by iterating user_id and course_id values.
A vulnerability in FRRouting (FRR) versions 8.3 through 10.5.1 exists in the bgp_notify_decapsulate_hard_reset() function, which improperly validates the length of the data field in a BGP NOTIFICATION Cease/Hard Reset message. When the data field is exactly one byte, this leads to an out-of-bounds heap read and an assertion failure, causing the bgpd daemon to crash and terminate all BGP sessions, resulting in a denial of service. This issue is fixed in versions 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2, and 10.6.0.
The npm package 'dowload_ebok_smiley_by_laurann_dohner_7okd1' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_lettre_a_ma_fille_by_maya_angelou_gt68h' contains malicious code that can fully compromise any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by this package.
The npm package 'dowload_ebok_historia_de_un_oso_by_gabriel_osorio_antonia_herrera_ti9e1' is identified as malicious software. Installing or running this package results in a fully compromised system, potentially allowing an attacker full control. Immediate removal of the package is advised, along with rotation of all secrets and keys from a separate, uncompromised device. However, removal of the package alone may not eliminate all malicious components due to the extensive control gained by the attacker.
The npm package 'dowload_ebok_frostblood_the_epic_new_york_times_bestseller_by_elly_blake_l7itq' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'dowload_ebok_les_7_habitudes_de_ceux_qui_reussissent_tout_ce_qu_by_stephen_r_covey_ff8dk' is identified as malicious software. Installing or running this package compromises the affected computer fully, potentially allowing an external entity complete control. Immediate removal of the package is advised, but it may not eliminate all malicious components. All secrets and keys on the compromised system should be rotated from a separate, secure machine.
The npm package 'dowload_ebok_gatherings_by_flora_shedden_oybwg' contains malicious code that fully compromises any computer on which it is installed or running. Installation of this package can lead to complete system compromise, including exposure of all stored secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a separate, uncompromised system due to potential persistent control by attackers.
The npm package 'dowload_ebok_il_caso_mattei_by_calia_vincenzo_sabrina_pisu_3ti3o' contains malicious code that compromises any computer on which it is installed or run. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
Starting November 11, 2026, threat actors exploited unauthorized access to ConnectWise ScreenConnect instances used by managed service providers to deploy a malicious worm called SCKit. This worm installs unauthorized remote-access clients on customer endpoints and targets IT technician workstations by hijacking authenticated ScreenConnect sessions. SCKit establishes persistence on infected devices and uses a component named RelayTrap to deliver malicious payloads to connecting technicians, enabling lateral movement and further compromise. The attack leverages a reported authentication flaw in certain RMM+ extension versions and abuses legitimate ScreenConnect functionality. Removing unauthorized clients alone does not eliminate persistence or session exposure. Mitigation involves investigating technician workstations and downstream endpoints and applying fixes for known vulnerabilities.
The npm package 'dowload_ebok_the_power_of_when_by_michael_breus_pj2mk' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a separate, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package 'dowload_ebok_irena_s_children_by_tilar_j_mazzeo_s4ksn' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of the malicious software or control established by the attacker.
The npm package 'dowload_ebok_i_giorni_del_sacro_by_franco_cardini_jbda6' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package 'dowload_ebok_how_to_exit_vim_by_chris_worfolk_3nkxo' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by the installation, indicating potential persistent control by an attacker.
The npm package 'dowload_ebok_deichmord_by_katharina_peters_dllxm' is identified as malicious software. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control. Immediate rotation of all secrets and keys stored on the affected system from a different, secure machine is strongly recommended. Removal of the package alone may not eliminate all malicious components due to possible persistence mechanisms.
The npm package 'dowload_ebok_alice_nel_paese_delle_meraviglie_by_lewis_carroll_x9gkl' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control.
The npm package 'dowload_ebok_stop_fixing_women_by_catherine_fox_y3l0z' is identified as malicious software. Installation or execution of this package results in a fully compromised system, potentially allowing an attacker full control. Immediate removal of the package is advised, but due to the extent of compromise, complete remediation may require rotating all secrets and keys from a separate, uncompromised system.
The npm package 'dowload_ebok_the_duke_s_secret_heir_by_sarah_mallory_w476t' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but full remediation may require rotating all secrets from a separate, uncompromised system due to potential persistent malicious presence.
The npm package 'dowload_ebok_shattered_destiny_episode_five_by_odette_c_bell_u4e8s' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets from a different, uncompromised computer is strongly advised.
The npm package 'dowload_ebok_bound_to_surrender_a_doms_of_genesis_novella_by_jenna_jacob_qisab' contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone is insufficient to guarantee the elimination of all malicious software introduced by its installation.