Malicious code in tinkoff-boxy-mobile-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490 On require of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments...

Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...

Malicious code in bigops-api-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acd531683a48496b0b96d04fb0264b4e49f46d43a099af7172bd259c20bf7bcc On require of the package, index.js loads runtime.js which selects a platform-specific endpoint from a list of Cloudflare Workers subdomains...

CVE-2026-49004

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

EUVD-2026-53123

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-49004

CVE-2026-49004 describes misconfiguration and command injection in the built-in PostgreSQL service on the mobile device (ZTE NX799J/Red Magic 11 Air). The service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGR...

Malicious code in @adminide-stack/yantra-mobile (npm)

npm/@adminide-stack/yantra-mobile is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11552 Malicious code in @adminide-stack/yantra-mobile (npm)

npm/@adminide-stack/yantra-mobile is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

EUVD-2026-52574

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profi...

CVE-2026-66310

Microsoft Edge for Android is affected by CVE-2026-66310, described as external control of a file name or path that allows an unauthorized local attacker to disclose information. The vulnerability is labeled with CVSS v3.1 base score 7.7 (HIGH), with attack vector LOCAL, all else equal; no user i...

CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-68945

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

CVE-2026-2346

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

CVE-2026-2346 IDOR in Menulux Software's Mobile App

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

CVE-2026-2346 IDOR in Menulux Software's Mobile App

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

CVE-2026-2346

CVE-2026-2346 affects Menulux Software’s Mobile App up to version 12.05.2026, with an IDOR authorization bypass via a user-controlled key. The CVSS v3.1 score is 9.8 (CRITICAL), from vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack with no privileges required and no ...

EUVD-2026-52263

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

CVE-2026-2346

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026...

A week in security (July 27 – August 2)

Last week on Malwarebytes Labs: Fake Fortnite rewards are stealing players’ accounts Fake Flash Player installs AtlasRAT Malwarebytes for Windows, now available on the Microsoft Store Hims & Hers sued over alleged health data privacy failures Hidden prompt turns Microsoft Copilot into an AI worm...