CVE-2026-66420

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

Watchfire Controller Software

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and gain full control of the controller. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b53f3137f847d7234a065286565e0112a828bb14dd580d6ea46a9c262397294 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-12989

CVE-2026-12989 describes a lack of authentication in Ghost Robotics' Vision 60 mobile app (APK v5.5.0). An unauthenticated attacker on the device’s internal Wi‑Fi can access the web administration interface and HTTP API, bypassing authorization to view real‑time camera feeds, control robot moveme...

CVE-2026-17523

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation LPE. This allows the attacker to gain root privileges and take full control o...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

MAL-2026-11032 Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06bb8071b2894038268bb513310437eed2c6ffc3aa534c8fae8b8273d7f56a9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11014 Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5db4f6fb4cd8bc8073e03771776ba865f51f852120bd44162573774905ccf22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11009 Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd65d988f18a0f4c26e80ba1051269692e38e3461369a9cc62a0314755b06aee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle WebLogic Server - Remote Command Execution

Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See...

CVE-2026-16247 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

EUVD-2026-45903

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

CVE-2026-16247 Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

CVE-2026-16247

The CVE affects _connect.BRAIN prior to version 5.06. During setup, LogPathConfig.exe is executed and deletes/recreates %ProgramData% permissions, granting the Windows group Everyone full control instead of restricting access to %ProgramData\Bizerba_connect.BRAIN or %ProgramData\Bizerba\BCT. Star...

CVE-2026-16246 Insecure permission assignment due to execution of LogPathConfig.exe during setup

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2. Starting with BRAIN2 3.09, the setup no longer executes thi...

CVE-2026-16246

In BRAIN2, versions prior to 3.09 run LogPathConfig.exe during setup, granting the Everyone group full control over %ProgramData% (not restricted to %ProgramData%\Bizerba\BRAIN2). Starting with 3.09, the setup no longer executes this tool, mitigating the issue for the main installer. However, the...

MAL-2026-10815 Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf6ed48efe682ebb1ee6a19edd4529a25aed3c46f8fb6686228de074a424a4a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10836 Malicious code in @gocortexio/npmgremlinbox-malware-install-execution (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a5a537b1738692165e905b11697bdac7455cccde5bf8b788767642d26c33b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10838 Malicious code in @gocortexio/npmgremlinbox-mpl-1-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b711dafb2bb4c7dfab16c8144346191d7e09f630cfa91e7dd9e3b9b9960151 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...