CVE-2025-36065

IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 (5.2.0.00–5.2.0.12) has a session management flaw: it does not invalidate the user session after a browser closure, enabling an authenticated user to impersonate another user. The issue is classed under Insufficient Session Ex...

CVE-2025-41768 Beckhoff: XSS Vulnerability in TwinCAT 3 HMI Server

An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input during web page generation 'Cross-site Scripting'...

Malicious code in sezzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494df714262f72408f0837d726757cb6301b1b31166da85a96b278858857ed9a The package sezzle was found to contain malicious code. Source: ghsa-malware 6b28a829b2018ce361449e8c3b0ee03a5b51e6adc2383159bbf4f5421d5694a6 Any...

Malicious code in webmd-debug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5693e1af021faa1bcf410e9bdf757b9deebbae4505daa969275ef365e719227 The package webmd-debug was found to contain malicious code. Source: ghsa-malware b74e0fa5da459a8e2a346f0ad74dcf61ebdf972a7840b7f61292e46ea5aa58db An...

Malicious code in uq-global-ec-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff150b2aef330176090006c8f217913a40ee17728ec4c821c5c3310624bb0ba The package uq-global-ec-uikit was found to contain malicious code. Source: ghsa-malware...

Malicious code in telia-eventapi-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610f6e993efc4a5c573b9fb5533234a0b9d69c997461873bf02f863c643916e0 The package telia-eventapi-client was found to contain malicious code. Source: ghsa-malware...

CVE-2025-67263

Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting XSS vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these...

CVE-2025-67263

CVE-2025-67263 affects Abacre Retail Point of Sale 14.0.0.396 in the Clients module. The vulnerability is a stored XSS caused by failing to properly sanitize user-supplied input in the Name and Surname fields, which is persisted in the database. An attacker can inject HTML or script content that ...

Exploit for CVE-2025-60021

CVE-2025-60021 Roundup Vulnerability Summary CVE-2025-60...

Malicious code in ofjaaah-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c8da6b0f3c7cb67171e251f86fdcd13d4809a9e46e59259c7fca02d1e463cab The package ofjaaah-internal-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-341 Malicious code in ofjaaah-auth-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 680db6543dbee7ec4f8cfe557fc5c76a13bb684b7faeec4e6e2582c0d89ecdf7 The package ofjaaah-auth-module was found to contain malicious code. Source: ghsa-malware...

MAL-2026-345 Malicious code in private-payment-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c4346497d58e1d5eca5c47353d4491578827b6095eb0f62dc7ff4449c0758b The package private-payment-lib was found to contain malicious code. Source: ghsa-malware...

MAL-2026-343 Malicious code in ofjaaah-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c8da6b0f3c7cb67171e251f86fdcd13d4809a9e46e59259c7fca02d1e463cab The package ofjaaah-internal-utils was found to contain malicious code. Source: ghsa-malware...

Metasploit Wrap-Up 01/16/2026

Persistence, dMSA Abuse & RCE Goodies This week, we have received a lot of contributions from the community, such as h00die, Chocapikk and countless others, which is greatly appreciated. This week’s modules and improvements in Metasploit Framework range from new modules, such as dMSA Abuse...

MiracleLinux 4 : firefox-52.5.1-1.0.1.AXS4 (AXSA:2017-2476:07)

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2017-2476:07 advisory. A privacy flaw was discovered in Firefox. In Private Browsing mode, a web worker could write persistent data to IndexedDB, which was not cleared when exiting...

CVE-2026-1008

A stored cross-site scripting XSS vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected...

CVE-2026-1008

CVE-2026-1008 describes a stored XSS in Altium 365 profile text fields due to insufficient server-side input sanitization. The vulnerability allows authenticated users to inject arbitrary HTML/JavaScript payloads using whitespace-based attribute parsing bypass techniques. The payload is persisted...

CVE-2026-1008 Stored Cross-Site Scripting in Altium Live User Profile Fields

A stored cross-site scripting XSS vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected...

satellitectf

CONSTELLATION PIVOT CTF A Satellite Cyber-Physical CTF Chal...

Notepad++ Plugin Persistence

This module create persistence by adding a malicious plugin to Notepad++, as it blindly loads and executes DLL from its plugin directory on startup, meaning that the payload will be executed every time Notepad++ is launched. Module Options msf use exploit/windows/persistence/notepadppplugin msf...