The URL https://api.ipify.org has been observed in attacker activity linked to CVE-2021-41773. This URL was seen six times on 2026-11-09 as part of attacker payloads involving ingress tool transfer (T1105) techniques. The activity originated from attacker infrastructure in Great Britain. The URL is associated with exploitation attempts or tool downloads related to the referenced CVE.
Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries
Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Reflected XSS.This issue affects Broadcast Live Video: from n/a through 7.3.14.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
The npm package dsh-ungate version 0.2.3 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to temporary files in cleartext during file transfer operations. This vulnerability allows local attackers with limited privileges to access sensitive information. The issue is fixed in version 2025.0.5.
CVE-2026-115339 is a vulnerability in Progress Software WS_FTP Server on Windows prior to version 2025.0.5. It involves insufficient resource limits that could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition by exhausting server resources.
Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
CVE-2026-115336 is a vulnerability in Progress Software WS_FTP Server on Windows where incorrect quota accounting allows authenticated users with upload and delete permissions to exceed storage quotas. This flaw affects versions from 2025.0.0 up to but not including 2025.0.5. Exploitation could lead to denial of service by exhausting storage resources. The issue is fixed in version 2025.0.5.
The focashi npm package version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious subscription targets are obfuscated or dynamically fetched, and the attack leverages the victim's own WhatsApp session. The code does not steal credentials, maintain persistence, or execute arbitrary remote code.
Progress Software WS_FTP Server versions prior to 2025.0.5 have insufficient protection for communications when unencrypted connections are used. This vulnerability could allow a network attacker to intercept sensitive information or modify requests. The issue is addressed in version 2025.0.5.
The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.
FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 runs all processes with root privileges, lacking privilege separation. This design flaw means that compromising any single service grants full administrative control over the device.
The @liauto/darwin-arm64 npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone may not eliminate all malicious software introduced by its installation.
The @liauto/cli npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package @liauto/linux-x64 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
The npm package @liauto/linux-arm64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a separate, trusted machine. Removal of the package does not guarantee elimination of all malicious software introduced by it.