China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Loader component of Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page. Chromium security severity: Low...

redis-RCE-poc

Redis Authenticated RCE via RedisBloom TDigest Heap Overflow...

PT-2026-64102

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image. MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImaging MapBuffer src/map.c. The per-row spacing strid...

PT-2026-64138

Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...

PT-2026-64115

Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...

CVE-2026-9066: Improper Neutralization of Input During Web Page Generation

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

GHSA-Q8WF-6R8G-63CH Next.js: Denial of Service in the Image Optimization API using SVGs

Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints. - If you are using...

CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

CVE-2026-13078

Summary of technical details (CVE-2026-13078) : The vulnerability affects MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook. This hook allows JavaScript executed via the server to read arbitrary files from the host filesystem using the mon...

CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

SUSE-SU-2026:22900-1 Security update for jq

This update for jq fixes the following issues - CVE-2026-43896: unbounded recursion in jvobjectmergerecursive can lead to C stack exhaustion and a process crash bsc1265075. - CVE-2026-44777: uncontrolled recursion in ordinary module loader when two valid modules include each other can lead to sta...

PT-2026-63559

Name of the Vulnerable Software and Affected Versions Next.js versions 15.5.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured. Malicious content within...

CVE-2026-60776

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: AOL Generic Loader. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...

Integer Overflow

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader VipsForeignLoadNsgif, which can miscompute...

Integer Overflow

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader VipsForeignLoadNsgif, which can miscompute image dimensions...

Heap-based Buffer Overflow

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader VipsForeignLoadTiff, which can miscount the...

Integer Overflow

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader VipsForeignLoadVips, whi...

Heap-based Buffer Overflow

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the bundled libvips TIFF loader VipsForeignLoadTiff, which can...