Malicious code in in-app-marketing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d475c46e8eda7ca153485336dce8c0b7d3bf8e3ea31a871232bc815438bc140c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

A week in security (March 16 – March 22)

Last week on Malwarebytes Labs: Could your face change what you pay? NYC wants limits on biometric tracking That "job brief" on Google Forms could infect your device A DarkSword hangs over unpatched iPhones Your tax forms sell for $20 on the dark web Researchers found font-rendering trick to hide...

PT-2026-27127

Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters, causing the application to become unresponsive o...

Kalcaddle Kodbox 操作系统命令注入漏洞

Kalcaddle Kodbox is a private cloud storage and online collaborative office platform developed by Kalcaddle Corporation. Version 1.64 of Kalcaddle Kodbox contains a vulnerability related to operating system command injection. This vulnerability stems from incorrect operations on the...

(Pwn2Own) Samsung Galaxy S25 Samsung Account Cross-Site Scripting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary script on affected installations of Samsung Galaxy S25. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Samsung Account application. The issue results from the lack of proper validati...

CVE-2019-25602 GSearch 1.0.1.0 Denial of Service via Search Input

GSearch 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting an excessively long string in the search bar. Attackers can paste a buffer of 2000 characters into the search field, click search, and select any result to trigger an...

CVE-2026-4540

creationtimestamp| type| source ---|---|--- 2026-03-22 07:15:59+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4540 2026-03-22 09:00:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116272006923873264 2026-03-22 09:00:30+00:00| seen|...

CVE-2019-25589

creationtimestamp| type| source ---|---|--- 2026-03-22 04:30:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhmplbwmsf2o...

CVE-2026-4533

creationtimestamp| type| source ---|---|--- 2026-03-22 04:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116270945248453980 2026-03-22 04:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mhmpkg6ayh2w 2026-03-22 06:31:48+00:00| seen|...

CVE-2019-25583

creationtimestamp| type| source ---|---|--- 2026-03-22 04:20:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhmozezqxk2d...

CVE-2026-4532

creationtimestamp| type| source ---|---|--- 2026-03-22 04:15:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhmoqglzas2d...

CVE-2019-25585

creationtimestamp| type| source ---|---|--- 2026-03-22 04:10:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhmohi6e6t27...

CVE-2019-25584 RarmaRadio 2.72.3 Server Field Buffer Overflow Denial of Service

RarmaRadio 2.72.3 contains a buffer overflow vulnerability in the Server field of the Network settings that allows local attackers to crash the application by supplying an excessively long string. Attackers can paste a malicious payload exceeding 4000 bytes into the Server field via the Settings...

jetAudio 安全漏洞

JetAudio is a multimedia player software developed by the JetAudio company. The Basic version of JetAudio 8.1.7.20702 contains a security vulnerability. This vulnerability stems from a denial-of-service vulnerability in the URL processing mechanism, which could allow local attackers to cause the...

EUVD-2019-19888

RealTerm Serial Terminal 2.0.0.70 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Port field. Attackers can paste a buffer of 1000 characters into the Port input field and click the open button to trigg...

CVE-2019-25553

creationtimestamp| type| source ---|---|--- 2026-03-21 15:31:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhle2cenw42v...

CVE-2019-25548

BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers can paste a buffer of 100,000 'A' characters into the search field and trigger a search operation to cause the...

CVE-2026-XNU-AIO-KEVENT-UAF

XNU AIO Kevent Use-After-Free CVE-2026-XXXX Kernel panic...

EUVD-2026-14012

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the verifyrole function in AuthTrails.php explicitly whitelisting the wcfmvendor role alongside subscriber and...

CVE-2026-3651

The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wpajaxnopriv without proper authentication checks, capability verificatio...