The npm package @adminide-stack/yantra-help-browser version 12.0.194 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The npm package @adminide-stack/forms-core version 5.1.9-alpha.3 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised machine due to the possibility of persistent malicious software.
The npm package 'cdeops' version 13.5.31 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @adminide-stack/user-activity-browser versions 1.1.3-alpha.114 and 0.0.16-129 contains malicious code. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control over the computer. Immediate removal of the package and rotation of all secrets and keys stored on the affected system are strongly advised.
The npm package @adminide-stack/health-api-server version 0.0.18-alpha.465 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package @adminide-stack/client-redux version 0.0.16-18 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @adminide-stack/utils version 0.0.16-130 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
CVE-2026-122192 is a vulnerability in AWS Firecracker versions 0.23.0 through 1.16.1 where improper handling of a failed memory remap can allow a guest user with root privileges to read or modify the Firecracker VMM process memory. This occurs via balloon or virtio-mem discard requests on microVMs restored from snapshots using the File memory backend if the host fails to create the replacement mapping. The issue is fixed in Firecracker version 1.16.2 and later.
CVE-2026-76806 is a path traversal vulnerability in the open-source time-tracking app solidtime prior to version 0.16.0. The vulnerability arises from improper validation of project ID values read from uploaded ZIP imports, allowing directory traversal outside the intended temporary sandbox. This can lead to creation of directories at arbitrary writable host paths and disclosure of host filesystem layout information. The flaw affects any registered user able to create an organization and perform a specific import API call. The issue is fixed in version 0.16.0.
CVE-2026-97705 is a high-severity vulnerability in the moleculer microservices framework for Node.js. It involves an infinite loop in the TCP transporter parser due to improper handling of a signed packet length. A remote unauthenticated attacker can supply a negative packet length, causing the event loop to block and services to become unresponsive until restarted. This issue affects versions prior to 0.14.36 and 0.15.2 and requires the TCP transporter to be enabled and reachable. The vulnerability is fixed in moleculer versions 0.14.36 and 0.15.2.
CVE-2026-121933 is a critical vulnerability in Linksys E5350 version 1.0.00.037 affecting the Setup Wizard component. The flaw allows remote attackers to bypass authentication by manipulating the wizard_router_pwd argument in the save_settings function of /wizard/apply.cgi. Exploit code has been published, but no vendor response or patch is currently available.
Zulip versions from 8.0 up to but not including 12.2 contain a missing authorization vulnerability that allows restricted guest users to access profile information of other users without sending a message. This occurs when the organization setting restricts guests from viewing other users, but saving or editing a direct message draft does not verify sender access to draft recipients. The issue is fixed in version 12.2.
Zulip versions from 11.0 up to but not including 12.2 had a missing authorization check in the GET /json/users endpoint when web-public channels were enabled. This flaw allowed unauthenticated users to access every user's custom profile field values by using the include_custom_profile_fields=true parameter. The issue was resolved in version 12.2.
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.
OmniAuth versions prior to 2.2.0 have an origin validation error that allows remote unauthenticated clients to supply a forged Host header. This can lead to host header injection risks in applications that do not have fixed full_host configurations or framework-level host validation, such as Rails host authorization. The issue is resolved in OmniAuth version 2.2.0.
CVE-2026-113780 is a critical out-of-bounds write vulnerability in the Espressif IoT Development Framework (esp-idf) affecting versions prior to 5.5.6, between 6.0.0 and before 6.0.4, and between 6.1.0 and before 6.1.1. The flaw allows a local unprivileged application to write into trusted execution environment (TEE) memory, breaking isolation boundaries and potentially enabling code execution, denial of service, or system crashes. The issue is fixed in esp-idf versions 5.5.6, 6.0.4, and 6.1.1.
A stack-based buffer overflow vulnerability exists in the lwIP DNS resolver component of Espressif's ESP-IDF framework versions 5.2.3 through certain pre-fixed versions. The flaw occurs when multiple DNS records are cached and copied into a single-element buffer without bounds checking, allowing an attacker controlling DNS responses to overwrite adjacent stack memory. This can lead to a device reboot or potential control flow hijacking if stack protection is not enabled. Fixed versions are available starting from 5.3.7, 5.4.5, 5.5.6, and 6.0.3.
bitcoinjs-lib versions from 2.3.0 up to but not including 5.2.1, 6.0.0 up to 6.1.8, and 7.0.0-rc.0 up to 7.0.2 contain a vulnerability in Merkle root validation. The library's fastMerkleRoot function pads odd Merkle-tree levels by hashing the final node with itself but does not detect adjacent duplicate hashes, allowing a peer to append duplicate transactions without changing the Merkle root or block identifiers. This can cause consumers relying on block-root validation, such as explorers or SPV clients, to process duplicated transactions or reject valid blocks. The issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.
CVE-2026-121932 is a critical OS command injection vulnerability in Linksys E5350 version 1.0.00.037. It affects the system function in /wizard/apply.cgi, where manipulation of the ping_ip or traceroute_ip arguments allows remote attackers to execute arbitrary OS commands. The exploit code is publicly available, and the vendor has not responded to disclosure attempts.