Critical Severity Threats

Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid through Rollout 524.

Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially lead to remote code execution and full compromise of the server. This issue affects TeamDavid through Rollout 524.

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in a denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.

Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication. This issue affects TeamDavid through Rollout 524.

Google released Chrome version 151.0.7922.108/.109 to patch 41 critical and high-severity vulnerabilities, including over two dozen memory safety bugs such as use-after-free and out-of-bounds write flaws. The update addresses six critical issues affecting components like WebGL, Aura, Skia, Views, and the ANGLE graphics engine. No active exploitation in the wild has been reported. Users are advised to update promptly to mitigate risks.

CVE-2026-16030 is an authentication vulnerability in the MStore API WordPress plugin versions before 4.21.0. The plugin fails to properly verify the cryptographic signature of tokens used for phone-based login. This flaw allows unauthenticated attackers who know a registered user's phone number to forge authentication tokens and take over that user's account, including accounts with administrator privileges.

CVE-2026-15215 is a privilege management vulnerability in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1. It allows users with the Shop Manager role to install and activate arbitrary plugins via a nonce-protected AJAX action without proper capability verification. This flaw can lead to remote code execution by unauthorized users.

The express-chai npm package version 3.7.9 contains malicious code that impersonates an Express logger middleware. It fetches a remote JSON payload from a base64-obfuscated URL and executes code from the payload with full access to the Node.js require function and application context, enabling arbitrary code execution during middleware setup.

The gpt-terminal-cli npm package version 1.0.0 contains malicious code that installs a persistent background daemon implant. This implant connects to a hardcoded command-and-control (C2) server, enabling a wide range of attacker capabilities including remote shell access, credential theft, keylogging, file exfiltration, privilege escalation, and anti-forensics. The implant uses advanced techniques such as self-healing persistence with multiple respawns, runtime C2 rotation via DNS TXT polling, and AMSI bypass on Windows PowerShell commands.