Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information CVSSv3.1 8.8 (HIGH)
Trail of Bits released MuTON and mewt, mutation testing tools designed for blockchain smart contracts and general-purpose code. MuTON provides first-class support for TON languages (FunC, Tolk, Tact) while mewt is language-agnostic, supporting Solidity, Rust, Go, and others. The tools use Tree-sitter for parsing, implement mutant prioritization, and persist results to SQLite to address historical limitations of regex-based mutation testing.
An improper access check allows unauthorized access to webservice endpoints. CVSSv3.1 8.8 (HIGH)
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. CVSSv3.1 8.8 (HIGH)
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers. CVSSv3.1 9.1 (CRITICAL) · EPSS 15th percentile
Kaspersky GReAT discovered CrystalX RAT, a MaaS platform actively promoted on Telegram and YouTube since January 2026, offering spyware, stealer, keylogger, clipper, and prankware capabilities. The malware targets Windows systems, exfiltrates credentials from Steam/Discord/Telegram and Chromium browsers via ChromeElevator, logs keystrokes, injects malicious browser extensions for crypto-wallet hijacking, and provides full remote access with VNC. Dozens of victims have been observed primarily in Russia, with active development and no geographic restrictions on the MaaS offering.
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile
Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Cloud Discovery Service, Recording Service, Routing Service, Queueing Service, Observability Collector) allows Serialized Data External Linking, Data Serialization External Entities Blowup.<p>This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.1.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.</p> CVSSv3.1 9.1 (CRITICAL) · EPSS 14th percentile
Elastic Security Labs disclosed a supply chain compromise of the axios npm package (versions 1.14.1 and 0.30.4), affecting ~100M weekly downloads. A compromised maintainer account published backdoored versions that deployed a unified cross-platform RAT (Windows/macOS/Linux) via a malicious postinstall hook in a decoy dependency (plain-crypto-js). The implant shares identical C2 protocol, command set, and beacon behavior across all three platforms, with attribution overlap to WAVESHAPER/UNC1069 (DPRK-linked).
Elastic Security Labs disclosed a supply chain compromise of the Axios npm package (versions 1.14.1, 0.30.4) where attackers injected a malicious transitive dependency (plain-crypto-js@4.2.1) that executes during npm install to deploy cross-platform RATs. The attack leverages a consistent post-install execution pattern across Linux, Windows, and macOS to retrieve and execute remote payloads, with Elastic releasing behavioral detection rules targeting the delivery chain rather than static indicators.
Elastic Security Labs disclosed a supply-chain compromise of the Axios npm package (versions 1.14.1, 0.30.4) that injected a malicious transitive dependency (plain-crypto-js@4.2.1) triggering post-install execution of cross-platform RATs. The attack leverages Node.js process spawning native OS shells to retrieve and execute remote payloads, with platform-specific backdoors (Python on Linux, PowerShell on Windows, Mach-O on macOS) establishing C2 beacons and executing arbitrary commands. Elastic released behavioral detection rules targeting the delivery chain rather than static indicators, covering process ancestry, network retrieval, and detached execution patterns across all three platforms.
Elastic Security Labs disclosed a supply chain compromise of the axios npm package (versions 1.14.1 and 0.30.4), affecting ~100M weekly downloads. A compromised maintainer account published backdoored versions that deployed a unified cross-platform RAT (Windows/macOS/Linux) via a malicious postinstall hook in a decoy dependency (plain-crypto-js). The three stage-2 implants share identical C2 protocol, command set, and beacon behavior, with attribution overlap to WAVESHAPER/UNC1069 (DPRK-linked).
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-Control-Allow-Private-Network: true) to inject a JavaScript snippet via the API. The injected snippet executes in Electron's Node.js context with full OS access the next time the user opens SiYuan's UI. No user interaction is required CVSSv3.1 9.6 (CRITICAL) · EPSS 39th percentile
SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset Field” enabled. The vulnerable code accepts arbitrary http(s) URLs without extensions as images, stores the attacker-controlled string in coverURL, and injects it directly into an <img src="..."> attribute without escaping. In the Elec CVSSv3.1 9.0 (CRITICAL) · EPSS 39th percentile
APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. Prior to version 2.0.1, the edit_user endpoint (POST /api/auth/edituser/<pk>) allows Any user who can reach that endpoint and submit crafted permission to escalate their own account (or any other account) to superuser by including "is_superuser": true in the request body. The root cause is that CustomUserSeri CVSSv3.1 8.8 (HIGH)
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0. CVSSv3.1 9.8 (CRITICAL)
A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_adduser_to_session of the file /cgi-bin/account_mgr.cgi. This manipulation of the argument read_list causes stack-based buffer overflow. It is possible to initiate the attack remo CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile
A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function Webdav_Upload_File of the file /cgi-bin/webdav_mgr.cgi. The manipulation of the argument f_file leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. CVSSv3.1 8.1 (HIGH) · EPSS 14th percentile
The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejec CVSSv3.1 9.8 (CRITICAL)
A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability affects the function UPnP_AV_Server_Path_Del of the file /cgi-bin/app_mgr.cgi. Executing a manipulation of the argument f_dir can lead to stack-based buffer overflow. The attack can be executed remotely. The ex CVSSv3.1 8.8 (HIGH) · EPSS 49th percentile
Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template CVSSv3.1 8.1 (HIGH)
An arbitrary file overwrite vulnerability in InTouch Contacts & Caller ID APP v6.38.1 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure. CVSSv3.1 8.4 (HIGH)
An arbitrary file overwrite vulnerability in Zora: Post, Trade, Earn Crypto v2.60.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure. CVSSv3.1 9.8 (CRITICAL)
SpecterOps announces expansion of BloodHound Enterprise to model attack paths in macOS environments via Jamf device management platform integration, alongside Okta and GitHub. The research demonstrates how device management platforms introduce attack primitives—privilege escalation within the management plane, fleet-wide code execution, and hybrid attack paths spanning identity and device management systems—that were previously invisible to directory-centric attack path analysis.