WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues. id: CVE-2021-24435 info: name: WordPress Titan Framework plugin =...

CVE-2022-44215

Introduction A new vulnerability has been discovered affecting Titan FTP web server catalogued as CVE-2022-44215. Titan FTP is a commertial software created by South River Technologies that implements FTP protocol for file sharing. In its HTTPS version 19.X and prior, it has been proved to be...

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained — Detect

Fingerprint / reachability check for Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor Application CWE-306, CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Titan MFT Server 26.0.0 - Unauthenticate...

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the Web

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor Application CWE-306, CWE-78 """Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +5574 more potentially affected by CVE-2026-76184 via org.eclipse.jetty:jetty-client (>=9.4.0.m0, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-client MAVEN version =9.4.0.m0, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.17.0, =0.15.0, =0.1.9, =0.1.9, =3.46.0.12 and more Source cves: CVE-2026-76184 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243510...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7670 more potentially affected by CVE-2026-19864 via org.eclipse.jetty:jetty-security (>=9.4.0.v20161208, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-security MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2026-19864 Source advisory: MEND:CVE-2026-19864...

South River Titan MFT Server 26.0.0 First-Run Command Injection

South River Titan MFT Server version 26.0.0 contains a first-run administrator setup exposure that permits an unauthenticated reachable client to create the initial administrator. The proof of concept uses the resulting access to configure a job post-transfer command that executes as the service...

Teen Hacker Finds Auth Flaw in Microsoft System With 17.3 Trillion Data Rows

A teen hacker found an authentication flaw in Microsoft’s Titan analytics service, where metadata indicated an estimated 17.3…...

Malicious code in lint-staged-ganymede-titan-gulp (npm)

Source: amazon-inspector cac0691969c683ccf6abff93d005c2db42f31a9073ea430084172a3c7938c763 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kronos-buffer-titan-zephyr (npm)

Source: amazon-inspector 792938793257953f6b2ebb196fc67715e7747e88d7f1d9dd52ccf05b0acb5b6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in juno-zenobia-kinetic-titan (npm)

Source: amazon-inspector a0cda1f7e16474f4db77e1627311d6c2a20cf414dbecf946bfc210bf918669d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jovian-izar-subscription-titan (npm)

Source: amazon-inspector 8681257e1e1eff9e0b4be2eb9aaee7190c6c99222e20e0f2d9e0508d2fee6c20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

PT-2026-94909

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.0 Description An issue exists in the camcc-sc8280xp clock driver where a warning is triggered when unused clocks are shut down. This occurs due to the introduction of sync state support in the clock and power domain...

Malicious code in jest-titan-postcss-loader-galaxy (npm)

Source: amazon-inspector 2a277d7a2ceb2b1f9af71797414949b7377311b1cbeadc87adacedba54221430 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jekyll-proxima-titan-phoenix (npm)

Source: amazon-inspector 13822966aac60c094ab317b15fa84b4d2b18ba3bd5b5e0dc25f8a04eab222a5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jabbah-titan-eslint-config-equinox (npm)

Source: amazon-inspector f920754dfd3526e4037f94d1ee2ae2205d9eae6df972819a37ff0a02087f6c79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in init-titan-rollup-sagitta (npm)

Source: amazon-inspector dcca8d6c574797e2e2e679ad497bd80547d1a272b15b1e582052f42f82f871c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in inferno-titan-4nsz (npm)

The package inferno-titan-4nsz was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in express-titan-andromeda-shelljs (npm)

Source: amazon-inspector 3db56ca2e1f597d46076e860c53c02a5d847424aeba44464086eb792744037e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in exoplanet-titan-repository-release-it (npm)

Source: amazon-inspector bb748b13772ac2b3d0e6639c132da44357b100b1af4c90f2461a77eedc3a62d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...