A vulnerability exists in lmammino oidc-authorizer up to version 0.4.0 in the unwrap function of src/handler.rs. The issue involves manipulation of the jwtClaims argument leading to unsafe deserialization. This vulnerability can be exploited remotely. The vendor has not responded to disclosure attempts. The CVSS score is 5.3, indicating a medium severity risk.
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be
shut down when a specific endpoint (/internalRestart) is accessed. This
endpoint is accessible to unauthenticated users over the public
Internet. Instead of “restarting”, the server shuts completely down. As a
result, a remote attacker can trigger a persistent denial of service by
shutting down the web server without requiring authentication. Recovery
requires manual administrator intervention to restart the service. This issue affects TeamDavid through Rollout 524.
Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
The npm package rdfxvela contains embedded malicious code that includes a base64-encoded RSA private key. When users run any rx subcommand, the CLI writes this key to a temporary file and uses it to SSH into a server controlled by the package author. User passwords are also passed unescaped in remote shell commands, exposing them in process arguments and logs. The malicious access is limited to the author's infrastructure, but any system with this package installed should be considered fully compromised.
A vulnerability in the Simple Membership WordPress plugin before version 4.7.7 allows unauthenticated users to activate or extend memberships by exploiting insufficient verification of PayPal payment notifications. The plugin does not confirm that the payment notification was sent to the site's configured merchant account, enabling attackers to use payments made to arbitrary PayPal accounts they control.
The Accelerate WordPress theme up to version 1.5.3 contains a missing authorization check vulnerability in the enqueue_scripts() function. This flaw allows authenticated users with Subscriber-level access or higher to install and activate the ThemeGrill Demo Importer plugin without proper permissions. The vulnerability is classified as CWE-862 (Missing Authorization).
Apache CXF's JMS transport component is vulnerable to deserialization of untrusted data via JMS ObjectMessage bodies. This vulnerability allows an attacker who can send messages to the JMS destination to submit malicious serialized objects, potentially causing denial of service or remote code execution if a suitable gadget class is present. The issue is fixed by disabling ObjectMessage deserialization by default and providing a configuration option to re-enable it if necessary. Users should upgrade to Apache CXF versions 4.2.3, 4.1.8, or 3.6.12 to address this vulnerability.
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A use-after-free vulnerability in the Linux kernel's Amlogic crypto driver (meson_crypto_probe) was fixed. The issue occurs when partial allocation failures lead to double cleanup of resources, causing a slab-use-after-free detected by KASAN. This flaw could cause kernel memory corruption and potentially escalate privileges or cause denial of service. The vulnerability was identified and fixed in Linux kernel versions prior to 7.0.0-31.31 and related builds. A patch is available and included in official Linux kernel updates.
TinyAGI version 0.0.20 contains a file inclusion vulnerability in the collectFiles function within the Message API Endpoint component. This vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.
CVE-2026-14314 is a medium severity vulnerability in the PeproDev WooCommerce Receipt Uploader WordPress plugin up to version 2.8.0. The plugin fails to verify that an attachment requested via an access token belongs to the referenced order. This flaw allows unauthenticated attackers to forge tokens and access image attachments, including payment receipts uploaded by other customers, leading to unauthorized disclosure of sensitive information.
The npm package bigops-rx-post-message version 35.1.5 contains malicious code that downloads and executes an attacker-controlled binary during installation or require(). This binary is fetched from non-publisher infrastructure using obfuscated runtime-generated URLs and is executed without any integrity verification. The malicious executable is saved with disguised filenames in temporary directories and launched detached from the main process, enabling remote code execution on the host system.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f8f5027d945d8a05fe554b838ba2036e29a99c4296ad532b8d47a1bbaa22650e)
The package name resembles @ngrx/component-store. The main entry index.js requires./_helpers, which on module load assembles attacker-controlled hostnames via array-join concatenation (e.g. ["oob-worker.","cf99-9b3.workers.d","ev"].join("")) to reach oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, and oob-worker.cf101-adf.workers.dev, with a DNS-TXT chunked base64 fallback under *.dl.wel1.ru. A platform-specific binary is fetched, written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start /b. lib/telemetry.js hides dangerous API names by string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]). The load-time fetch-and-execute of an opaque native executable from obfuscated hosts fires on any require() of this package.
## Source: ghsa-malware (6971cd73a1bd6b15cddd886529f19aca32451e75071ece000fddd17fd74c35fb)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0)
On require(), index.js loads./_ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT covert-channel fallback that reassembles a base64 payload from numbered subdomains under sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawned detached via spawn("/bin/sh", ["-c", path + " &"]) or spawn("cmd",...). Host strings are constructed via array-split.join("") to evade static inspection, and there is no hash or signature verification. Staging paths mimic system diagnostics names to blend in.
## Source: ghsa-malware (b9e509d532bb46f434ea0a124cf22b50558357d28e0a316974709d2a7bde00dc)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
A use-after-free vulnerability was identified and fixed in the Linux kernel's RDMA rxe_mmap component. The flaw occurs when rxe_mmap() removes a rxe_mmap_info struct from a list and releases a lock while the struct's reference count is still one, leading to a race condition with concurrent operations that can free the struct prematurely. This can cause kernel crashes or a page-level use-after-free condition. Exploitation requires a precise timing window, making it difficult but possible. The vulnerability has a CVSS score of 7.8 (high severity).
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).