CVE-2026-86840 Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. Th...

CVE-2026-86840

Bifrost's vtoken-minting and slpx pallets contain an improper authorization flaw: a signed account can supply any registered channel_id when minting tokens without being verified as authorized for that channel. This lets an attacker inflate a channel's recorded mint volume , causing protocol comm...

MAL-2026-10487 Malicious code in @outsmartly/metaobjects (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede306bb744e7248af8ac267412edc6cb95f6720dc3fd6f6766b7c3ce915853 On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller...

New PixRevolution Malware Steals Brazil’s PIX Transfers in Real Time

Researchers have discovered PixRevolution, a new Android banking trojan targeting Brazil’s PIX system. Unlike automated scams, this malware uses live operators to watch your screen and divert funds instantly...

Hackers commit highway robbery, stealing cargo and goods

There’s a modern-day train heist happening across America, and this time, some of the bandana-masked robbers are sitting behind screens. According to new research, a group of cybercriminals has been attacking trucking, freight, and logistics companies for months, impersonating brands and even...

Microsoft Warns of 'Payroll Pirates' Hijacking HR SaaS Accounts to Steal Employee Salaries

A threat actor known as Storm-2657 has been observed hijacking employee accounts with the end goal of diverting salary payments to attacker-controlled accounts. "Storm-2657 is actively targeting a range of U.S.-based organizations, particularly employees in sectors like higher education, to gain...

EUVD-2020-23318

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2020-35652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in respjsipdiversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0....

CVE-2019-14054

Improper permissions in XBLSEC region enable user to update XBLSEC code and data and divert the RAM dump path to normal cold boot path in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, MSM8998,...

Glastonbury ticket hijack vulnerability fixed

The Glastonbury ticket website was vulnerable to a relatively simple attack that that allowed ticket theft and data leakage. What’s the issue? An attacker could scrape collaborative ticket buying information e.g. on Reddit to gather people’s details, use a flaw in the registration process and...

Die Hard 2. Or how not to hack airplanes

How could I criticise possibly the best action movie series of all time? Well, it’s to help dispel myths about hacking planes. TV shows and films help set a narrative that is hard to shift around aviation cyber, giving the travelling public a misleading view of their security when flying. So let’...

Information leakage vulnerability in Dual Open Assistant Micro Divergence Edition

Dual Open Assistant Micro Diversion is an app diversion soft. Dual Open Assistant Micro Diversion Edition suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

US hospital forced to divert ambulances after cyberattack

The Idaho Falls Community Hospital fell victim to a cyberattack on Monday May 29, 2023. As a result, the hospital had to divert ambulances to other nearby hospitals and close some of its clinics. The hospital is keeping the public updated through its website and Facebook page. "Our commitment to...

Cisco ASA-X With FirePOWER Services Authenticated Command Injection Exploit

This Metasploit module exploits an authenticated command injection vulnerability affecting Cisco ASA-X with FirePOWER Services. This exploit is executed through the ASA's ASDM web server and lands in the FirePower Services SFR module's Linux virtual machine as the root user. Access to the virtual...

Phishers Swim Around 2FA in Coinbase Account Heists

Threat actors are making their way around two-factor authentication 2FA and using other clever evasion tactics in a recently observed phishing campaign aimed at taking over Coinbase accounts to defraud users of their crypto balances. Attackers are using emails that spoofed the popular...

The 4-phase approach smart companies take to mitigate DDoS attacks

Distributed denial of service DDoS attacks have been a significant feature of the cyber threat landscape over the past two decades. The 2021 DDoS Threat Landscape Report reveals that attacks today are constantly evolving in complexity, volume, size, and frequency. The only constant in DDoS attack...

diversion (>=0.2.0, <=0.4.6), push-it (>=0.1.0, <=0.1.4) +1 more potentially affected by CVE-2020-8823 via sockjs (>=0.0.4, <=0.2.1)

sockjs NPM version =0.0.4, =0.2.0, =0.1.0, =0.0.0pre25, =0.0.0pre31 Source cves: CVE-2020-8823 Source advisory: OSV:GHSA-HH8V-JMH3-9437...

UBUNTU-CVE-2020-35776

A buffer overflow in respjsipdiversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses...

PT-2021-11857 · Sangoma +1 · Asterisk +1

Name of the Vulnerable Software and Affected Versions: Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 Description: A buffer overflow in the res pjsip diversion.c file allows a remote attacker to crash Asterisk by deliberately misusing SIP 181 responses. Recommendations: For versio...

CVE-2020-35652

An issue was discovered in respjsipdiversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is...