CVE-2025-67274

An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints...

This Week in Spring - January 26th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! As I write this, I cannot believe we're nearly at the end of the month! Time sure flies. Spring AI 2.0.0-M2 is available now Spring Modulith 2.1 M1, 2.0.2, and 1.4.7 released In last week's installment of A Bootiful Podcast ,...

CVE-2025-67274

An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints...

CVE-2025-67274

CVE-2025-67274 affects continuous.software aangine v.2025.2. An issue in the excel-integration-service template download module, the integration-persistence-service job listing module, and the portfolio-item-service data retrieval module endpoints allows a remote attacker to obtain sensitive info...

CVE-2025-67274

An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints...

CVE-2025-67274

An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data retrieval module endpoints...

Malicious code in overstock-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 387cbf7de757b1668d6c0f2c9f81f9beab4f35af6f362c2ee434509070af2e34 The package overstock-component-library was found to contain malicious code. Source: ghsa-malware...

Malicious code in overstock-component-library-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3047a2aa0008e3dd53a44ed19238f41540af1763edd48a5db147506a32e6bf77 The package overstock-component-library-v3 was found to contain malicious code. Source: ghsa-malware...

CVE-2026-24140

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings function accepts arbitrary key-value pairs without...

CVE-2026-24140 MyTube has Mass Assignment via Settings Management

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings function accepts arbitrary key-value pairs without...

Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls

Fortinet has officially confirmed that it's working to completely plug a FortiCloud SSO authentication bypass vulnerability following reports of fresh exploitation activity on fully-patched firewalls. "In the last 24 hours, we have identified a number of cases where the exploit was to a device th...

Malicious code in ntwsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 101f5ffdce019ee61ce0775bc9de5dba96de50e5e03e8fd70ac1b30b28cf13e0 The package ntwsc was found to contain malicious code. Source: ghsa-malware ef0dd5d822ddc7c0a00339f31b43d1a99cf79532857cdd157bf1eeb4b2a31ea2 Any...

MAL-2026-487 Malicious code in ntwsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 101f5ffdce019ee61ce0775bc9de5dba96de50e5e03e8fd70ac1b30b28cf13e0 The package ntwsc was found to contain malicious code. Source: ghsa-malware ef0dd5d822ddc7c0a00339f31b43d1a99cf79532857cdd157bf1eeb4b2a31ea2 Any...

Malicious code in a4wu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65f0ae226eb7aef794335d5c42f8f82348461976fcd5188fdb74129e54e36f5a The package a4wu was found to contain malicious code. Source: ghsa-malware dbda459fa895bbd7a94bd12494e3092b3964f21d8a480826313bdb3f7302904b Any...

PT-2026-4538

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings function accepts arbitrary key-value pairs without...

Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations

Cybersecurity company Arctic Wolf has warned of a "new cluster of automated malicious activity" that involves unauthorized firewall configuration changes on Fortinet FortiGate devices. The activity, it said, commenced on January 15, 2026, adding it shares similarities with a December 2025 campaig...

Malicious code in dotenv-expanded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e36cd005779e12b645b7ec5f6e65df1edae7c6d86736507cd1feacec1ef7cf The package dotenv-expanded was found to contain malicious code. Source: ghsa-malware 8c545865cdbec4a05b0f51103dd3560d60c3f43b818465e4a935a47bf84078d...

Malicious code in weaviate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229f83d7066881287b7035e8e71dc5ed74531480ab19cbf47ebd72990bc1525 The package weaviate-js was found to contain malicious code. Source: ghsa-malware bb063c82675f5933564b46d7e49a2c2a7aac395d9a399b1264e3de0aafb29905 An...

Malicious code in replicate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84c6cb090eb31f1b2c516b45419d7833bca83f5546d22444032d28a07d27f40 The package replicate-js was found to contain malicious code. Source: ghsa-malware 658bf1d6aa22bb672e5ae9724e34b94ee7ff73e7cd4381ff4a6a8c9c2d1267fa A...

Malicious code in aws-crt-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82067e17b63298c1e09a6b616010b7a8ebf7f607510795f98428f8e5305994ab The package aws-crt-nodejs was found to contain malicious code. Source: ghsa-malware 40ddba391f5ca6a4fa75fe5e5440dfd1f57833b391d8db3c2e5918aef284a294...