CVE-2026-14837 SSH Enablement Signature Verification Bypass

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

CVE-2026-14837

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

EUVD-2026-49115

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorize...

A week in security (July 20 – July 26)

Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...

CVE-2026-12394

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

CVE-2026-12394

The CVE-2026-12394 entry describes a vulnerability in the MemberGlut WordPress plugin (version before 1.1.5) where the front-end registration flow does not validate the user-selected role. This allows unauthenticated users to create accounts with arbitrary roles, including Administrator, leading ...

EUVD-2026-49066

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

Malicious code in kalipto-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a918c615e1b451efabe6e88b3ecb90108abea31ac6b963be88c0a667e7a31f3a The package's main entry src/server.js is a self-executing Express server that binds to 0.0.0.0 on port 3000 and exposes POST /execute, which passes...

CVE-2026-61096

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

MAL-2026-11082 Malicious code in edu-npm-helper-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48359fa2dbbcd9c21e22de20140343078cd697b1bdfa5f3c59ce5ee77b4865b0 No suspicious code patterns, lifecycle hooks, network destinations, or credential-access behaviors were identified in this package version. Nothing i...

Malicious code in txs-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c934ab0c25791138fe4673ea55529933cc40e3aab0f03a660820712181cd20d No concrete installer-harm signals were identified in this version. Package name suggests transaction-building functionality, but without verified...

MAL-2026-11091 Malicious code in txs-runner-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf4e668ad1a65cf7be8d260ba2c6ee46a31be7553bad3219775b61a5d226dfc Package [email protected] could not be fully characterized: automated tracing engaged with the package's files but its output was withheld by the...

MAL-2026-11092 Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...

Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...

MAL-2026-11088 Malicious code in sixbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91338e6d735e538b7defb669e5b213cad127a9fd64290fa32d83bb855dcf9bd sixbails is a WhatsApp Web library Baileys-family fork. On every socket creation — the package's primary documented API — a 5-second timer fires...

Malicious code in @vinnxcode/xbailsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa85bc699ec69bbebf0799696e784cee3fcd9f78f5ccc9e2cb032e9a9cb3de68 @vinnxcode/xbailsync 1.0.1 is a fork/republish of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to co-occurren...

Malicious code in fazzgram (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8799da09b9c2cf933d99463789c230da7d238000ba0fde0b311a4050353a6ead fazzgram is a Telegram Bot API wrapper. Supporting modules ApiClient.js, Dispatcher.js, LongPoller.js, WebhookServer.js, Context.js, Markup.js are...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2021-32084

The CVE-2021-32084 entry describes a vulnerability in Quest KACE Systems Deployment Appliance (SMA) 11.0.273 where API endpoints remain accessible when web console access is restricted by IP/subnet, allowing an attacker who has credentials or API keys to access the API and potentially compromise ...

EUVD-2026-48733

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic patient consent decisions, medication data,...