PT-2026-24923

A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file save up athlete.php. This manipulation of the argument a name causes cross site scripting. It is possible to initiate the attack remotely...

CVE-2026-3984: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file saveupathlete.php. This manipulation of the argument aname causes cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2026-31817

A flaw was found in OliveTin. When the saveLogs feature is enabled, an attacker can exploit a directory traversal vulnerability by manipulating the UniqueTrackingId field in the StartAction API request. This allows the attacker to write files to arbitrary locations on the filesystem, potentially...

A week in security (March 2 – March 8)

Last week on Malwarebytes Labs: One click on this fake Google Meet update can give attackers control of your PC Beware of fake OpenClaw installers, even if Bing points you to GitHub Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets Windows File Shredder: When deleting a file...

One click on this fake Google Meet update can give attackers control of your PC

A phishing page disguised as a Google Meet update notice is silently handing victims’ Windows computers to an attacker-controlled management server. No password is stolen, no files are downloaded, and there are no obvious red flags. It just takes a single click on a convincing Google Meet fake...

Fake Zoom and Google Meet Pages Trick Users Into Installing Monitoring Tool

Fake Zoom and Google Meet pages trick users into installing a monitoring software on Windows systems through phishing links and fake updates...

A week in security (February 23 – March 1)

Last week on Malwarebytes Labs: Public Google API keys can be used to expose Gemini AI data Inside a fake Google security check that becomes a browser RAT Fake Zoom and Google Meet scams install Teramind: A technical deep dive How to understand and avoid Advanced Persistent Threats The Conduent...

Fake Zoom and Google Meet scams install Teramind: A technical deep dive

UPDATE February 27, 2026 : We have added more clarity around the abuse of legitimate commercial products, and of Teramind's stealth mode. Important note: Teramind, the software vendor referenced in this article, has stated they are not affiliated with the threat actors described, did not deploy t...

CVE-2021-33506

jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrictroomcreation is set by default. This can allow an attacker to circumvent conference moderation...

Fake Microsoft Teams and Google Meet Downloads Spread Oyster Backdoor

The Oyster backdoor also known as Broomstick is targeting the financial world, using malicious search ads for PuTTY, Teams, and Google Meet...

WordPress plugin Employee Spotlight – Team Member Showcase & Meet the Team 安全漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin...

CVE-2025-13403: Missing Authorization

The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employeespotlightcheckoptin function in all versions up to, and including, 5.1.3. This makes it possible f...

CVE-2025-66399

Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters including newlines that are...

The vulnerability of the Jitsi Meet Electron software, related to insufficient verification of data authenticity, allows a perpetrator to execute arbitrary code.

The vulnerability of the Jitsi Meet Electron software lies in the insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-64754

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available...

CVE-2025-64754

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available...

CVE-2025-64754 Jitsi Meet has DOM Redirect on Microsoft OAuth Flow

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available...

CVE-2025-64754

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available...

CVE-2025-64754 Jitsi Meet has DOM Redirect on Microsoft OAuth Flow

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available...

CVE-2025-64754

Jitsi Meet (open‑source video conferencing) contains a DOM/OAuth flow vulnerability affecting versions prior to 2.0.10532, where an attacker could hijack the Microsoft account OAuth authentication window. The issue is fixed in 2.0.10532. No workarounds are documented. Remediation: upgrade to 2.0....