CVE-2026-66050 NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field...

CVE-2026-66050 NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field...

CVE-2026-66050 NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field...

Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management RMM tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming...

MAL-2026-11084 Malicious code in express-self-destruct1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efe4bb7647313d9772c059e46a877ab095ada0910845e5605fbb317ab2b01fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-91467

Name of the Vulnerable Software and Affected Versions macOS Sonoma versions prior to 14.8.8 Description A correctness issue exists where an attacker with physical access to a device may be able to silently persist an Apple Account on a device that has been erased. Recommendations Update macOS...

PT-2026-64959

Name of the Vulnerable Software and Affected Versions NitroShare Desktop versions prior to 0.3.5 Description The LAN file transfer server contains a path traversal issue that allows unauthenticated attackers on the same network to write arbitrary files. This occurs because the server fails to...

monitor v0.31.0

BetterDB Monitor The monitoring layer that Valkey deserves. BetterDB persists what Valkey throws away - slowlogs, command patterns, client activity, anomaly signals - so you can debug what happened at 3am, not just what's happening now. Built for Valkey 8.x with native support for COMMANDLOG,...

GHSA-QQ9H-G4JM-XGF3 Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

Am I affected You are affected if all of the following hold: - You run a better-auth version below 1.6.22, or a 1.7.0-beta below 1.7.0-beta.10. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist a...

CVE-2026-66004

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

MAL-2026-11049 Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

Class06-Security-Vulnerability-Demo

Class04: Fixing Cross-Origin Vulnerabilities and Business Logi...

Persistnux — Updated!

Persistnux A comprehensive Linux persistence detection tool for Digital Forensics and Incident Response DFIR investigations. Overview Persistnux is a bash-based tool designed to identify known Linux persistence mechanisms used by attackers to maintain access to compromised systems. It performs...

SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3208-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3208-1 advisory. - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. -...

monitor semantic-cache-v0.12.0

BetterDB Monitor The monitoring layer that Valkey deserves. BetterDB persists what Valkey throws away - slowlogs, command patterns, client activity, anomaly signals - so you can debug what happened at 3am, not just what's happening now. Built for Valkey 8.x with native support for COMMANDLOG,...

Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

MAL-2026-11031 Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

MAL-2026-11035 Malicious code in streak-bucket-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ac54ede0c029cfc28fa42ff5bdbd04ea17ebb610987c50a9108912588a82c The package advertises pure calendar/streak math but its main entry index.mjs schedules an async routine on module import via...

Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...