Threats affecting pkg:npm/@almela/obx

The Payment Integration Wompi WordPress plugin versions up to 4.0.1 does not verify the authenticity of incoming payment notifications by default. This is due to the callback checksum relying on a merchant secret that is empty until manually configured. As a result, an unauthenticated attacker can forge payment notifications and mark arbitrary orders as paid.

The Payex Payment Gateway for Woocommerce WordPress plugin versions up to 1.2.10 contains an authentication flaw. It does not properly verify the authenticity of incoming payment notifications because it relies on a validation secret that is empty by default. This allows unauthenticated attackers to forge payment confirmations and mark any order as paid.

GROWI, a product by GROWI, Inc., has been reported to contain multiple vulnerabilities. No specific details about the nature, impact, or affected versions of these vulnerabilities have been provided.

A vulnerability in Psono Server CE and EE versions 4.0.33 through 7.2.3 allows an authenticated attacker with a write-enabled but read-disabled API key to access encrypted secret data via the bulk-secret-read endpoint when URL_PREFIX is configured. This occurs due to incorrect authorization logic that compares request paths without considering the URL prefix, causing the endpoint to authorize requests with write scope instead of read scope. The default configuration without URL_PREFIX is not affected. The issue is fixed in version 7.2.4.

A Server-Side Request Forgery (SSRF) vulnerability exists in esaqa GmbH Psono Server CE and EE versions 0.1.0 through 7.2.3. The flaw allows an authenticated attacker to specify a host for Duo device configuration, causing the server to connect to that host over HTTPS on port 443 without an allowlist or explicit timeout. The vulnerability enables internal DNS and service reachability probing but requires TLS certificate validation and does not allow arbitrary protocol or port access. Unresponsive targets may also tie up server workers until OS timeouts occur. The issue is fixed in version 7.2.4.

Psono Server CE & EE versions 3.1.0 through 7.2.3 contain an authentication bypass vulnerability due to improper handling of WebAuthn challenges. An attacker with the user's password and a captured valid WebAuthn assertion can replay the assertion multiple times to bypass the WebAuthn second factor. This flaw is fixed in version 7.2.4.

Psono Server versions 1.0.0 through 7.2.3 have a missing authorization vulnerability in file-repository operations. An authenticated user with read-only access can exploit this flaw to upload or overwrite repository objects by abusing the file-transfer credential direction enforcement. This could lead to unauthorized data modification and storage consumption. The issue is fixed in version 7.2.4.

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.

The Analytics Insights – Google Analytics Dashboard for WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 6.3.12. This vulnerability arises from insufficient input sanitization and output escaping of the Page Title, allowing unauthenticated attackers to inject malicious scripts that execute when a user views the affected page.

The h13t0ry-hello-demo package on PyPI version 0.1.0 contains malicious code that initiates a reverse shell upon import. This behavior allows an attacker to execute arbitrary commands on the victim's machine, posing a significant security risk.

An untrusted pointer dereference vulnerability exists in the firmware of certain ASUS motherboards. A user with kernel-level privileges can supply an arbitrary memory address via an I/O command, which may lead to tampering with system information or cause a system crash. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

A cross-site scripting (XSS) vulnerability exists in the Saruf-Ratul HR-Payroll-Management-System in the chat.php file due to improper handling of the ID argument. This flaw allows remote attackers to execute script code in the context of the affected application. The vulnerability has a low severity score and an exploit has been published. The project uses rolling releases, so specific affected or fixed versions are not available, and no vendor response or patch has been issued yet.

A cross-site scripting (XSS) vulnerability exists in the chat.php file of the MD-MAFUJUL-HASAN Online-Payroll-Management-System up to commit a8902bf64575e325f6d6bf93a55f7bd273ec58cd. The vulnerability arises from manipulation of the ID argument and can be exploited remotely. The project has not yet responded to the issue report, and no fixed versions or patches are currently available. The vulnerability has a low severity score of 3.5 (CVSS 3.1).

Mistral Vibe versions prior to 3.0.3 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by defining git filter drivers in an untrusted repository's .git/config file. When the application is started with the --worktree option, git worktree add applies .gitattributes and runs filter commands before verifying the trusted folder, enabling execution of attacker-controlled commands with user privileges.

Fclairamb ftpserverlib versions through 0.32.4 have a vulnerability where file contents and directory listings can be transmitted in cleartext despite mandatory encryption settings. This occurs because the TransferOpen function only checks the transferTLS flag set by the PROT command, not whether the actual data connection uses TLS. An attacker on the network path can read or modify transferred data when a client sends PROT P after PASV or PORT commands.

A high-severity security vulnerability (CVE-2026-116620) exists in Tencent RapidJSON up to version 1.1.0. The flaw is in the GenericStringStream<UTF8<char>>::Take function within the Regex Parser component, causing an out-of-bounds read. This vulnerability can be exploited remotely. Public exploit details have been disclosed, but the vendor has not yet responded or provided a patch.

An out-of-bounds read vulnerability exists in llama.cpp before commit b2731 within the llama_model_loader component. This flaw allows attackers to craft GGUF model files with arbitrary 64-bit tensor offsets that cause the process to read memory outside the mapped model file. Exploitation can lead to process crashes or unintended memory disclosure by loading adjacent process memory as model weights.