ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScript functions still trigger the UPDATE_SECURITY check and are not affected.)
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes
orchestration solution designed for edge device deployments and is built
from the edge capabilities of Red Hat OpenShift Container Platform.
MicroShift is an application that is deployed on top of Red Hat Enterprise
Linux devices at the edge, providing an efficient way to operate
single-node clusters in these low-resource environments.
This advisory contains the RPM packages for Red Hat build of MicroShift
4.19.43. Read the following advisory for the container images for this
release:
https://access.redhat.com/errata/RHSA-2026:54555
Security Fix(es):
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
(CVE-2026-39820)
All Red Hat build of MicroShift 4.19 users are advised to use these updated
packages and images when they are available in the RPM repository.
An unauthenticated arbitrary file upload vulnerability exists in the Zoo extension for Joomla by yootheme.com, versions 1.0.0 through 4.1.63. The vulnerability arises because the image element accepts arbitrary files when the client-supplied Content-Type is within the image MIME group. This can allow attackers to upload dangerous files without authentication.
An open redirect vulnerability (CWE-601) exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The vulnerability occurs in the CommentController::twitterAuthenticate() function where the referer request parameter is passed directly to setRedirect() without validation, allowing redirection to untrusted sites. This issue has a medium severity with a CVSS score of 5.1.
An unauthenticated SQL injection vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The flaw occurs in the ItemController::element() method where the filter_type request parameter is directly interpolated into an SQL query without proper quoting or escaping, allowing attackers to manipulate the query structure.
This is a malware campaign involving the Shadow HVNC and Shadow Loader kits, which are noted for robust license protection mechanisms. The campaign is identified by multiple file hashes and an IP address associated with the malware. There is no detailed technical information or evidence of active exploitation in the wild. The campaign's impact relates to potential unauthorized remote access or payload delivery through these malware tools. No patches or vendor advisories are available for remediation.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.18.53. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:54545
Security Fix(es):
* js-yaml: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.
CVE-2026-67363 is a high-severity vulnerability in the Balbooa Forms extension for Joomla versions 1.0.0 through 2.4.3.1. It allows unauthenticated attackers to tamper with payment amounts by exploiting the stripeCharges and payAuthorize endpoints, which accept client-controlled charge totals without verification. This flaw enables attackers to purchase items at arbitrary prices, including very low amounts, and to forge line items, quantities, and shipping details. The endpoints lack authentication and CSRF protections, increasing the risk of exploitation.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.19.43. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:54555
Security Fix(es):
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
* js-yaml: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5)
package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops instead of the npm registry. On `npm install`, npm fetches a tarball from this host over unauthenticated plain HTTP with no integrity hash, and installs its contents into the consumer's node_modules. The domain operator can serve arbitrary, mutable bytes on each fetch, meaning any code shipped from that host runs inside the installer's dependency tree. The main module's header additionally self-identifies the package as a 'Security Research Testing Purpose' artifact, and the package description is a bare 'NPM', consistent with a hijack-vector proof-of-concept rather than a functional utility. The auto-execute condition is satisfied: any default `npm install` of this package resolves and installs the attacker-controlled tarball without user opt-in.
## Source: ghsa-malware (5b1bef8caf5ddc16dd3678dd285bba97e31d6b6ec8844b04c441a430c163f621)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The de-morgan npm package version 2.1.3 declares dependencies pointing to a non-official, HTTP-hosted URL (http://pack.nppacks.com/npm/de-morgan) for its code. This URL is attacker-controlled and mutable, allowing the installed package to execute arbitrary code fetched from this external source during npm install. The package's visible source appears benign but the actual installed code depends on the remote content, posing a risk of malicious code execution.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4)
The package advertises itself as text helpers for AI pipelines (toText/normalizeText) but src/index.js unconditionally invokes a dropper at module top level on require()/import. The dropper downloads a platform-specific installer from https://anymeetvia.com/download/{win|mac-x86_64|linux}/install1[.ps1] into the OS temp directory, chmods it 0755 on macOS/Linux, and executes it via powershell -File on Windows or bash on Unix, then calls process.exit. There is no version pinning, no hash or signature verification, and the download endpoint is an author-controlled domain unrelated to the advertised functionality. The remote installer content is not present in the package and can be changed by whoever controls anymeetvia.com at any time. The README and module.exports document only the text-helper API; the dropper is undocumented.
## Source: ghsa-malware (157801df9aca5cfc352c39f3fae51f04dd16ee810064ea6d95d4cd99f98931ff)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package 'setup-codex' version 1.0.0 contains malicious code that exfiltrates sensitive host information. It collects host identity data, shell command outputs, and file contents, then sends this data via HTTPS POST to a hardcoded third-party webhook at hooks.zapier.com. This behavior is not part of any legitimate setup functionality and represents credential and host reconnaissance exfiltration.
CVE-2026-75987 is a deserialization vulnerability in SPLWare esProc affecting the ObjectInputStream.readUnshared function in the file src/main/java/com/scudata/parallel/SocketData.java. It allows remote attackers to perform deserialization manipulations. The vulnerability is rated medium severity with a CVSS score of 6.9.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (69a832d2eb4042899a17a745bac70590844ba320f3e181580314687c664e5159)
The package's package.json declares a preinstall script that runs index.js automatically on `npm install`. index.js shells out via child_process.exec to collect the installer's hostname, current working directory, username, a package marker, and the machine's public IP (fetched via curl to ifconfig.me). The aggregated output is hex-encoded with xxd and split into DNS labels queried via nslookup against subdomains of snurkeburk.com, a DNS-tunnel exfiltration channel that bypasses egress HTTP filtering. Installing this package causes host identifiers and public IP to leave the machine to an attacker-controlled DNS namespace.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a)
On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for `data/telethon_market_userbot.session` for approximately 10 minutes and POSTs the file to a hardcoded webhook.site endpoint (https://webhook.site/d6ea9c5b-4a85-4e59-9397-2bb5f9407c87). Telethon session files contain live authentication material granting full access to the associated Telegram account. The exfiltration destination is bound to a variable literally named `evil_server_url` with a Russian-language comment identifying it as the attacker's server. The package name mimics the popular `deepface` ML library but ships no machine-learning code; author metadata is a placeholder (`asdqwdasdqwdasd`) with a disposable email at playboot.com.
## Source: kam193 (92f87cc2da145e4ab765c912a3a9cfb36ed6e8d21231fd511aa032edcd4b3e2b)
During import, package exfiltrates the sensitive file with the Telegram session token.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-deepface-weights
Reasons (based on the campaign):
- files-exfiltration
- target:telegram
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558)
On import, deepface_weights starts a daemon thread that polls every 10 seconds for the file `data/telethon_market_userbot.session` in the current working directory. When found, it POSTs the session file together with the local `os.getlogin()` value to the hardcoded endpoint https://webhook.site/730d2d03-5c78-4e0a-88df-9d8466b7e8aa. A Telethon `.session` file holds authenticated Telegram credentials, so exfiltration enables full takeover of the associated Telegram account. Package metadata is placeholder (author email `rozuvu@example.com`, description `Minimal example Python package`) and the name resembles the unrelated `deepface` face-recognition library, but the package ships none of that functionality — the stealer is its only behavior. Source comments in Russian label the destination as the attacker's server.
## Source: kam193 (a9b6a1255b998e6497198b80ffff88e0612a2d839c6f1b9859664436f96e5fce)
During import, package exfiltrates the sensitive file with the Telegram session token.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-deepface-weights
Reasons (based on the campaign):
- files-exfiltration
- target:telegram
On 5 May 2026, a Jamf Protect deployment blocked a download attempt from jacksonvillemma[.]com, four days after the operator's previous MacSync C2 was publicly disclosed. The new C2's TLS certificate was issued within 24 hours of that disclosure. Analysis revealed a Stage 2 zsh loader containing a static api-key value observed across four distinct C2 domains spanning December 2025 to May 2026. URI-pattern pivoting through any.run identified eleven additional candidate C2 domains dating back to February 2026, suggesting parallel infrastructure operation rather than sequential rotation. The loader exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.