Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.
The miniOrange Oauth Client (free) extension for Joomla contains an improper access control vulnerability that allows unauthenticated attackers to uninstall arbitrary installed extensions. This issue affects only the free versions of the miniOrange plugins and arises from a missing authentication check. The vulnerability has a high severity score of 8.8 CVSS 4.0 and can lead to significant impact by enabling attackers to disrupt Joomla installations by removing extensions without authorization.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859)
The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long run of tab whitespace and a trailing eval(atob('...')) that decodes to a two-stage loader. The decoded loader queries public Ethereum RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for the latest transaction from the hardcoded sender 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 pair from the tx `to` field, fetches XOR-obfuscated stage-2 code from http://<decoded-ip>:443/0x/cls and /0x/ls, eval()s it, and re-launches it via a detached `spawn('node', ['-e', <code>])`. Execution is wired to two auto-triggers: pyproject.toml overrides setuptools `build_py` and `develop` with pyservercheck._setup_cmd.BuildPy/Develop, whose `run()` calls _run_main_js_now() -> subprocess.run(['node', main.js]) during `pip install` / `pip install -e.`; and BuildPy also writes a `pyservercheck.pth` file containing `import pyservercheck._hooks; pyservercheck._hooks.ensure_once()`, which Python auto-executes at every interpreter startup, invoking run_js() again. The `.main_js_ran` marker is advisory and can be removed to force re-execution. The C2 destination is rotatable by publishing a new Ethereum transaction from the sender address, so the fetched payload is fully attacker-controlled at each run.
## Source: kam193 (4b365b9df06973db4f112bdbf2ad704dcc91c1b7b3eaceddb06a8e884c3f760a)
Package embeds obfuscated, JS-based malware downloading further remote stages. The code is triggered during building the package and on every Python startup (via PTH file). The next-stage IP is delivered via a blockchain.
The payload and embedded IoCs are consistent with campaigns attributed to Lazarus APT/PolinRider.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-pybitjs
Reasons (based on the campaign):
- obfuscation
- Downloads and executes a remote malicious script.
- malware
- abuses-pth
- c2-in-blockchain
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.
The npm package 'ux-metrics-client-interaction-subscriber' version 45.0.0 contains malicious code delivered via a self-referential dependency pointing to an external non-registry URL. Installing this package results in arbitrary code execution on the installer's machine due to unverified code fetched from https://repo.securityctrl.com. The package's index.js is inert, making the manifest the primary attack vector. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system must be rotated from a separate, secure machine.
This update for broot fixes the following issues:
Changes in broot:
- v1.59.0 (CVE-2026-72847 boo#1275994)
* new shell_command verb attribute: run a command through a shell (sh -c / cmd /C) so &&, ; and pipes work, without leaving broot - Fix #1145
* fix invalid official Mac binary (duplicate linked dylib) with new build chain - Fix #1194
* Sixel graphics support for image preview, auto-detected: works in iterm2, Windows Terminal 1.22+ and Sixel-capable Unix terminals (foot, mlterm, xterm built with Sixel, recent WezTerm). Kitty remains the preferred protocol when available. Note: this requires broot to be compiled with sixel feature (eg cargo install broot --features sixel) - Fix #568
* High-Res images in Rio terminal (detect it to enable the Kitty image protocol) - Fix #1179
* fix iTerm2 3.6.10 and later not displaying Hi-Res images, the version being compared as text
* fix content-exact match line number off-by-one when the match starts at the first byte of a line (broot jumped to the line above)
* new :no_action internal, doing nothing, which can be used to disable a key - Fix #328
* fix: detect a duplicate broot server name instead of silently overtaking the running server - Fix #1065
* fix preview transformers extension matching not working with double extensions such as .tar.gz - Fix #1195
* strip escape sequences from displayed names to prevent OSC injections - Fix #1188
* fall back to numeric uid/gid instead of ???? when the user or group name can't be resolved, which is always the case on statically linked musl builds - Fix #1075
* fix panic on a content regex matching the empty string at the end of a line ending with a control char (eg cr/$/ on a CRLF file)
* fix Windows paths (containing backslashes) being mangled by the launcher's eval when using :cd and similar; also fixes escaping of paths containing a single quote - Fix #1100
* fix br failing on Windows/PowerShell when the temp path contains a space (e.g. a space in the Windows username) - Fix #788
* JPEG XL images are no longer previewed: the decoder had out-of-bounds bugs and the fix needs a more recent rustc (if you need it, tell me and I'll try to make it opt-in)
* rustc minimal version changed from 1.83 to 1.85, and edition 2024
- v1.58.0
* change the way possible verb completions are listed, making it more readable when there are more than what fits the screen
* fix argument of :select and :show being ignored in a --cmd sequence - Fix 1176
- v1.57.0
* help: verb 'keys' and 'description' columns now searchable - Fix #1163
* fix :print_path / :print_relative_path adding a trailing empty line when printing a multi-item staging area - Fix #1062
* Skin: attributes (bold, underlined, etc.) of the "selected_line" entry now applied - Fix #1156
* if no Wezterm version is found, broot now assumes it's recent enough to support kitty protocol for image - Fix #509
- v1.56.4
* fix compilation on non unix platforms (1.56.3 isn't available on those systems)
- v1.56.3
* fix control characters sometimes remaining in the terminal after broot exit
* nushell: rename br module to avoid conflict in last nushell version - Fix #1138
* :open_stay on the staging area opens every staged file through the system opener - Fix #444
- v1.56.2
* {file-root-relative} argument - Fix #1142
* fix :clear_stage (or other operations closing the stage panel) often closing broot - Fix #1143
- v1.56.1
* fix a typo in a verb in default conf
- v1.56.0
* impacted_panel verb argument, allows the effect of a verb to be on another panel (eg to scroll the preview panel without removing the focus from the tree) - Fix #1119
* focus_panel_left and focus_panel_right internals - Fix #1115
* Major Feature: merge staged files to issue a single command: when a verb argument has a space-separated or comma-separated flag, a single external command is run even when the selection is multiple - Fix #465 The default verbs.json file has an example of a zip verb building an archive from all staged files.
- v1.55.0
* activate Kitty Graphics Protocol to display Hi-Res images in iTerm2
* Tokyo Night skin ( https://github.com/Canop/broot/blob/main/resources/default-conf/skins/tokyo-night.hjson )
* matches related to several name patterns joined with and/or in a composite pattern are merged instead of having just the first one shown
* nushell integration: switch $nu.temp-path to $nu.temp-dir - #1116
- v1.54.0
* fix crash on rendering B&W images with Kitty image protocol
* don't match directories when a composite pattern has a content pattern, even negated (eg /js$/&!c/;: it's clear the user wants to match js files not containing a semicolon)
- v1.53.0
* fix some cases of the verb not removed from the input on execution (with a risk of accidental double execution)
* add the :filesystems (short :fs) verb and state on windows (it was already present on linux and mac).
* improve the generation of preview pattern from
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
A reflected cross-site scripting (XSS) vulnerability exists in the All Video Share extension for Joomla by mrvinoth.com. Versions 1.0.0 through 4.4.99 do not properly escape various user-supplied inputs, allowing injection of malicious scripts that are reflected back to users. This vulnerability has a medium severity rating with a CVSS score of 5.3.
An authenticated, privileged blind SQL injection vulnerability exists in the DP Calendar extension for Joomla versions 5.5.0 through 10.11.2. The flaw occurs when saving an article with the content plugin, requiring update permissions on articles. This vulnerability can allow an attacker with appropriate privileges to execute unauthorized SQL commands on the backend database.
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.68. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2026:56912
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.18.54. See the following advisory for the container images for
this release:
https://access.redhat.com/errata/RHSA-2026:57487
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url
(CVE-2026-25679)
* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive
processing of DNS SAN entries (CVE-2026-27145)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in
certificate chain building (CVE-2026-32280)
* net: golang: Go net package: Denial of Service via long CNAME response in
LookupCNAME (CVE-2026-33811)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
(CVE-2026-39820)
* net/mail: golang: net/mail: Denial of Service via pathological email
address parsing (CVE-2026-42499)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME
header (CVE-2026-42504)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.18 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll() derives the index of the peer TX queue to wake from rq->xdp_rxq.queue_index. That field is only initialized by xdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an XDP program is attached. On the plain GRO/NAPI path (veth_napi_enable_range()) xdp_rxq_info_reg() is never called, so queue_index stays 0 for every queue, as priv->rq is zero-allocated. So in a multi-queue setup with GRO enabled and no XDP program attached, every NAPI instance looks at the peer's TX queue 0. If veth_xmit() stops peer TX queue 1 because the ptr_ring is full (NETDEV_TX_BUSY), nothing ever wakes it again: the poller draining queue 1 wakes queue 0 instead. veth implements no ndo_tx_timeout, so the netdev watchdog does not kick in either, and the queue stays stopped indefinitely. Derive the index from the position of the rq within priv->rq instead, which is correct regardless of whether XDP was ever enabled. Scripts to reproduce the stall are available at https://github.com/netoptimizer/veth-backpressure-performance-testing