Threats affecting pkg:generic/zxc

The gateio-sdk package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This package is part of a campaign involving typosquatting and is designed to exfiltrate environment variables and other data, raising serious privacy and security concerns.

CVE-2026-129267 is a cross-site scripting (XSS) vulnerability in sergix44 XBackBone versions 3.8.0, 3.8.1, and 3.8.2. The flaw exists in the MediaController::getRawById function within app/Controllers/MediaController.php. This vulnerability allows remote attackers to inject malicious scripts. Public exploit code is available, but a fix is pending acceptance of a pull request.

CVE-2026-129264 is an out-of-bounds write vulnerability in the sox_ng software affecting versions 14.8.0 and 14.8.1. The flaw exists in the read_samples_voc function within the VOC Decoder component. This vulnerability can be exploited remotely and has publicly disclosed exploit code. A patch identified by commit 0b40408b has been released to fix the issue.

CVE-2026-129262 is a vulnerability in Wuxi Wubang Security Software's Wubang Five-in-One Safety Production Management Information System up to version 3.5. It involves an unrestricted file upload issue in the DiyFileUpload function of the /ws.asmx file. This flaw allows remote attackers to upload files without restriction. Public exploit code is available, and the vendor has not responded to disclosure attempts. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

CVE-2026-129261 is a critical vulnerability in Kingston FURY CTRL RGB Control Software up to version 2.0.19. It involves an exposed IOCTL interface in the NTIOLib_X64.sys driver component that lacks sufficient access control. This flaw allows a local attacker with high privileges to manipulate the IOCTL interface, potentially leading to severe system compromise. The vulnerability requires local access and high privileges to exploit.

CVE-2026-129260 is a path traversal vulnerability in Mereithhh VanBlog versions up to 0.54.0. It affects the fs.readFileSync function in the local.provider.ts file of the Custom Page Handler component. This vulnerability allows remote attackers to manipulate the file path argument, potentially accessing unauthorized files. A public exploit has been disclosed. Upgrading to version test-20261013 resolves the issue.

The Multi Step for Contact Form 7 WordPress plugin up to version 2.9.1 contains a stored cross-site scripting (XSS) vulnerability via the multipart field name parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires specific plugin options ('Save every step' and 'Expandable' table) to be enabled, which are disabled by default.

The BuddyForms WordPress plugin up to version 2.10.6 is vulnerable to stored cross-site scripting (XSS) via the 'buddyforms_form_content' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a form configured with the public_submit option, which is enabled by default in the plugin's bundled Post Simple template. The vulnerability has a medium severity with a CVSS score of 5.4.

The Lightbox & Modal Popup WordPress Plugin – FooBox up to version 2.8.7 is vulnerable to a stored DOM-based cross-site scripting (XSS) flaw via the img alt attribute inside the .wp-caption container. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users view the affected pages. Exploitation requires bbPress 2.6.20 installed with a public forum and specific conditions on topic approval, enabling subscriber-level attackers to exploit the flaw. Without bbPress, exploitation requires contributor-level access or higher.

FV Player 8 WordPress plugin versions up to 8.1.9 are vulnerable to stored cross-site scripting (XSS) via the 'fv_player_videos' parameter. This vulnerability allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the administrator to enable the 'Allow visitors to upload videos to their profile' setting, which controls access to the vulnerable save functionality.

A critical vulnerability exists in Tenda AC18 firmware versions 15.03.05.05_multi and 15.03.05.19 Build 6318. The flaw is in the Firmware Upgrade Handler component, specifically in the /cgi-bin/upgrade endpoint, where insufficient verification of the upgradeFile argument allows remote attackers to manipulate data authenticity. Public exploit code is available for this vulnerability.

Mereithhh VanBlog versions up to 0.54.0 contain a cross-site scripting (XSS) vulnerability in the Image Upload Endpoint component. The vulnerability arises from a weakness in the file packages/server/src/types/access/access.ts. This flaw can be exploited remotely through manipulation, potentially allowing an attacker to execute XSS attacks. Public exploit code is available, but the vendor has not responded to the disclosure. The vulnerability has a low CVSS score of 3.5.

The Shipo WordPress plugin versions 1.6 through 1.8.0 contain an authentication bypass vulnerability. This flaw arises because the plugin's authenticate_rest_user() function improperly trusts the LOGGED_IN_COOKIE value without verifying its cryptographic signature. Attackers can bypass intended route restrictions and impersonate any user, including administrators, via the REST API, enabling unauthorized actions such as creating new administrator accounts.

Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the dissector_socks() function. This flaw allows network-adjacent attackers to read heap memory by sending crafted SOCKS5 authentication packets with unchecked username/password lengths. The vulnerability can lead to disclosure of sensitive memory contents, including credentials logged by Ettercap.

Dokploy versions before 0.31.1 have an OS command injection vulnerability in the getComposeContainerCommand() function. Authenticated organization members can exploit this flaw by injecting shell commands via the serviceName parameter. These commands are executed as root when scheduled backups run, allowing attackers to take over the host through the mounted Docker socket.

The MemberDash WordPress plugin up to and including version 1.8.7 contains a privilege escalation vulnerability. This flaw arises from a mass-assignment issue in the user_account_manager() function, allowing authenticated users with subscriber-level access or higher to modify arbitrary user accounts, including administrators. Attackers can overwrite email addresses and passwords of any WordPress user, potentially gaining full administrative control of the site.

Ettercap versions through 0.8.5.1 have a heap out-of-bounds read vulnerability in the dissector_mountd() function. This flaw occurs because the function independently validates RPC credential and directory lengths without ensuring they do not exceed the packet boundary. An attacker on the network can exploit this by sending a crafted MOUNT MNT call, causing the program to read up to 100 bytes beyond the heap buffer and leak memory contents to the console and logs.

Frappe india-payroll versions before 16.0.4 have a missing authorization vulnerability in specific methods of tax_regime_selector.py. This flaw allows authenticated users with low privileges to access payroll data of other employees and modify tax regimes on draft salary assignments. The vulnerability affects confidentiality and integrity of payroll data.

@kolkov/angular-editor versions before 3.0.4 have a cross-site scripting (XSS) vulnerability in the toggleEditorMode() function. This function assigns source view text directly to innerHTML without sanitization, allowing attackers to inject HTML with event handlers like img onerror. When users toggle views, the malicious script executes in the application's origin.

@kolkov/angular-editor versions before 3.0.3 have a cross-site scripting (XSS) vulnerability in the refreshView() function. This function writes HTML from ngModel or reactive form controls directly to innerHTML without using Angular's DomSanitizer, bypassing the default sanitization. An attacker can inject HTML containing event-handler attributes that execute scripts in the application's origin when loaded into the editor.