CVE-2026-69263

CVE 2026-69263 Cosa CVE 2026-69263 è un bypass della patch che ad agosto 2025 aveva corretto la vecchia vulnerabilità RCE. La patch ha introdotto una denylist che bloccava l'installazione di pacchetti arbitrari. Come Poiché npm legge la configurazione dalle variabili d'ambiente, impostare la...

EUVD-2024-1216

Malicious code in bioql PyPI...

CVE-2025-32966

DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8...

Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API method, this could expose the application to DoS, SS...

A week in security (January 17 — 23)

Last week on Malwarebytes Labs: CISA calls for urgent action against critical threats Red Cross begs attackers to “Do the right thing” after family reunion service compromised Update now! Chrome patches critical RCE vulnerability in Safe Browsing Combatting SMS and phone fraud: UK government issu...