CVE-2019-6440

CVE-2019-6440: Tested products: Zemana antimalware v.2.74.2.150 & Zemana antilogger v.2.74.204.150. Fixed since v.2.74.2.664 About vulnerability: This vulnerability allowed attackers to get SYSTEM privileges on target machines without user interaction. Requirements: 1. Attacker must be able to...

Malicious code in @greenlake/context-pane (npm)

@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.0 has a postinstall script that runs node beacon.cjs on npm instal...

MAL-2026-18286 Malicious code in @ppa-web-components/ppa-navigation (npm)

@ppa-web-components/ppa-navigation is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.1, 1.0.0, 2.0.0, 99.0.1, 3.0.0, 2.0.1 has a postinstall script...

CVE-2026-22011-iOS-MDM-Profile-Delivery-over-HTTP

CVE-2026-22011 – iOS MDM Profile Delivery over HTTP Program Code Python Flask MDM server mdmserver.py - Serves enrollment profile over plain HTTP from flask import Flask, sendfile app = Flaskname @app.route'/enroll.mobileconfig' def serveprofile: Vulnerability: profile delivered without HTTPS...

SUSE CVE-2026-113866

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

Two critical RCEs in PHP core

Update 10/22: Added section detailing observations of in the wild exploitation and associated IOCs. Cisco Talos is tracking the disclosure of two unauthenticated remote code execution RCE flaws in PHP core, dubbed "php2shell", triggered by a plain HTTP request and exploitable before any applicati...

Linux Distros Unpatched Vulnerability : CVE-2026-113866

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that...

Malicious code in @securihackbot/depconf-stage-1792484738 (npm)

Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It collects os.hostname, the local username, platform/arch, Node...

DEBIAN-CVE-2026-113866

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866 Account password sent unencrypted during Exchange account setup

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866

A flaw in Thunderbird allows a network attacker to intercept user credentials during account setup. The Exchange AutoDiscover lookup incorrectly queries the domain's AutoDiscover service over unencrypted HTTP , including the user's entered credentials in the plaintext request. An attacker monitor...

EUVD-2026-105293

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866 Account password sent unencrypted during Exchange account setup

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

PT-2026-118618

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.5.1 Thunderbird versions prior to 158.0.1 Description During account setup, the Exchange AutoDiscover lookup sends an unencrypted request over plain HTTP to the domain's AutoDiscover service. A bug causes this...

CVE-2026-105036

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.120260617182218release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...

Malicious code in nested-lib (npm)

Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a JSON payload containing os.hostname, dirname, process.cwd,...

MAL-2026-17773 Malicious code in nested-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a...

CVE-2026-108160 AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and...