Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the file upload process. An attacker can execute arbitrary JavaScript code in the context of an administrator's browser by uploading a crafted SVG file and tricking the administrator into viewing it. By...

EUVD-2026-49188

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

CVE-2026-59688

The CVE-2026-59688 entry describes an OS Command Injection in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF. An authenticated user with high privileges can execute arbitrary OS commands on the affected appliance via the backup restore functi...

CVE-2026-59688

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...

CVE-2026-59687 Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...

CVE-2026-59686

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-14856 Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

EUVD-2026-49115

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

CVE-2026-14837

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

CVE-2026-14837 SSH Enablement Signature Verification Bypass

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

CVE-2026-14837 SSH Enablement Signature Verification Bypass

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

A week in security (July 20 – July 26)

Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...

EUVD-2026-49066

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

CVE-2026-12394

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

CVE-2026-12394

The MemberGlut WordPress plugin (versions before 1.1.5 ) is vulnerable to an unauthenticated privilege escalation due to a broken access control flaw. The plugin fails to validate the user role selected during front-end registration, which allows an unauthenticated attacker to register an account...

Malicious code in kalipto-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...

CVE-2026-61096

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

MAL-2026-11082 Malicious code in edu-npm-helper-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48359fa2dbbcd9c21e22de20140343078cd697b1bdfa5f3c59ce5ee77b4865b0 No suspicious code patterns, lifecycle hooks, network destinations, or credential-access behaviors were identified in this package version. Nothing i...

Malicious code in txs-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c934ab0c25791138fe4673ea55529933cc40e3aab0f03a660820712181cd20d No concrete installer-harm signals were identified in this version. Package name suggests transaction-building functionality, but without verified...