Malicious code in requests-cache-utils (PyPI)

The requests-cache-utils PyPI package version 1.0.0 is a malicious package that overrides the setup.py install command to execute code during installation. This code downloads and executes a remote infostealer malware that targets browser d

radar.offseq.com

Malicious code in donutautosellsrc (PyPI)

During installation, the donutautosellsrc package fetches code hidden within an image containing a Python application with a native extension module. This native module is obfuscated and functions as an infostealer, collecting sensitive inf

radar.offseq.com

CVE-2026-81655: CWE-94 Improper Control of Generation of Code ('Code Injection')

CVE-2026-81655 is a code injection vulnerability (CWE-94) in the Ad Inserter WordPress plugin before version 2.8.19. The plugin fails to restrict access to a settings page, making it accessible to any logged-in user depending on configurati

radar.offseq.com

CVE-2026-100741: CWE-95: Improper Neutralization of Directives in Dynamically Ev

This vulnerability arises from improper neutralization of directives in dynamically evaluated code (eval injection) within the JScript event-script dispatcher of hMailServer. An attacker can inject arbitrary JScript by sending a password co

radar.offseq.com

CVE-2026-96896: CWE-862 Missing Authorization in Malcure Malware Shield — Remova

CVE-2026-96896 is a missing authorization vulnerability (CWE-862) in the Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin versions prior to 19.9.7. The plugin fails to perform an authorization check on a specific AJAX acti

radar.offseq.com

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module

The vulnerability in vm2 before version 3.12.2 arises from improper authorization checks in the NodeVM external-module resolver when a custom resolver is configured with `require.external` and `context: 'host'`. The resolver records allowed

radar.offseq.com

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. (CVE-

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which

radar.offseq.com

CVE-2026-85984: CWE-287 Improper Authentication in cyberlord92 miniOrange OTP Lo

CVE-2026-85984 is an authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress, affecting all versions up to and including 5.5.5. The issue arises from a missing password-intent

radar.offseq.com

CVE-2026-100740: Out-of-bounds Write in D-Link DIR-895L

This vulnerability involves an out-of-bounds write in the tunnel_set_params function within tunnel.c of the L2TP Control Channel Parser on the D-Link DIR-895L device. The flaw allows remote attackers to manipulate parameters leading to memo

radar.offseq.com

CVE-2026-82901: CWE-434 Unrestricted Upload of File with Dangerous Type in theme

CVE-2026-82901 is a critical vulnerability in the Ultra Addons for Contact Form 7 WordPress plugin (versions up to 3.5.50) caused by improper validation of uploaded file types in the 'uacf7_wpcf7_mail_components' function. This weakness (CW

radar.offseq.com

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

x47.c is a Windows-based botnet sold by a threat actor named WraithTools, leveraging AI (xAI Grok) to maintain persistence and select predefined actions such as startup entries and scheduled tasks. It provides a command-and-control panel wi

radar.offseq.com

CVE-2026-96533: CWE-918 Server-Side Request Forgery (SSRF) in Testimonials Widge

CVE-2026-96533 is a Server-Side Request Forgery (SSRF) vulnerability in the Testimonials Widget WordPress plugin versions up to 4.0.4. The plugin does not validate user-supplied URLs before fetching them server-side and storing the response

radar.offseq.com

GestSup versions before 3.2.61 contain a remote code execution vulnerability in

CVE-2026-100389 describes a remote code execution vulnerability in GestSup's basic IMAP connector prior to version 3.2.61. The flaw is due to improper handling of email attachments where blocked file extensions, specifically PHP files, are

radar.offseq.com

Improper Neutralization of Special Elements used in an OS Command ('OS Command I

The Wikimedia Foundation Mediawiki ExternalData Extension contains an OS Command Injection vulnerability (CVE-2026-100382) due to improper neutralization of special elements in OS commands. This flaw allows an attacker to inject and execute

radar.offseq.com

CVE-2026-18143: CWE-434 Unrestricted Upload of File with Dangerous Type in Addif

CVE-2026-18143 is an arbitrary file upload vulnerability in the Request a Quote for WooCommerce plugin for WordPress, present in all versions up to and including 2.9.2. The vulnerability exists because the afrfq_submit_quote_via_popup() fun

radar.offseq.com

Offensive Security for Cyber Resilience – OffSeq

European offensive-security company providing red team operations, threat intelligence, security audits, continuous monitoring and NIS2 compliance support.

offseq.com

OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gatew

OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 fail to enforce saved Gateway TLS pins within the authenticated Terminal and session Dashboard WebViews of the Control UI, despite native connections enforcing the saved Gateway fingerpr

radar.offseq.com

CVE-2026-100575: Missing Authorization in openclaw slack

CVE-2026-100575 is a missing authorization vulnerability in OpenClaw Slack affecting versions prior to 2026.8.1. The issue arises from improper enforcement of sender allowlists in multi-person direct messages, enabling unauthorized particip

radar.offseq.com

CVE-2026-100582: Missing Authorization in openclaw msteams

OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) prior to 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets. This missing author

radar.offseq.com

CVE-2026-100390: Authentication Bypass by Spoofing in tobychui zoraxy

The vulnerability in tobychui's Zoraxy product affects versions 3.2.3 through 3.3.4. The software fails to correctly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers, specifically the X-Forwarded-For header. This

radar.offseq.com

CVE-2026-100382: CWE-78 Improper Neutralization of Special Elements used in an O

This vulnerability (CVE-2026-100382) in the Mediawiki ExternalData Extension arises from improper neutralization of special elements in OS commands, classified as CWE-78 (OS Command Injection). It allows unauthenticated remote attackers to

radar.offseq.com

Malicious code in chromatitle (npm)

The 'chromatitle' npm package (version 1.0.0) advertises itself as a terminal color/title formatter but contains a malicious payload. Its main entry point immediately executes a bootstrap function that loads an obfuscated ~51KB JavaScript a

radar.offseq.com

CVE-2026-89055: CWE-862 Missing Authorization in ivole Customer Reviews for WooC

CVE-2026-89055 is an authorization bypass vulnerability (CWE-862) in the Customer Reviews for WooCommerce plugin for WordPress. The plugin fails to properly verify user authorization before allowing actions on attachments. Attackers with ac

radar.offseq.com

CVE-2026-93399: CWE-639 Authorization Bypass Through User-Controlled Key in lade

CVE-2026-93399 is an authorization bypass vulnerability (CWE-639) in the Bookly WordPress plugin (versions up to 28.2). The issue stems from the 'bookly_get_form_id' AJAX handler storing an attacker-controlled 'order_id' in the booking sess

radar.offseq.com

Hackers steal $351.6 million in Bitget crypto exchange hack

Suspected North Korean hackers compromised a critical backend wallet-service system at Bitget, enabling them to spoof transaction data and trigger authorization to transfer approximately $351.6 million from hot and warm wallets. The attack

radar.offseq.com

CVE-2026-14281: CWE-269 Improper Privilege Management in 101gen Automation Web P

CVE-2026-14281 affects the Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code WordPress plugin versions up to 4.8.6. The vulnerability arises from missing permission enforcement on the publicly accessible

radar.offseq.com

Malicious code in n8n-nodes-moonlet-helpers (npm)

The n8n-nodes-moonlet-helpers package (versions 1.0.0 and 1.0.4) masquerades as a helper node package for n8n but contains only an empty stub. Upon npm installation, its postinstall.js script performs an HTTPS GET request to a deceptive URL

radar.offseq.com

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen

The ViewSonic vCast media streaming service, part of the ViewBoard smartboard devices running Android, has three distinct vulnerabilities exploitable without authentication. CVE-2026-82989 allows remote exfiltration of JPEG images of the sc

radar.offseq.com

CVE-2026-93291: CWE-295 Improper certificate validation in Eufy Omni C20

The Eufy Omni C20 device suffers from improper certificate validation (CWE-295), which can be exploited by an attacker to conduct man-in-the-middle attacks. Successful exploitation could lead to arbitrary code execution on the device. The v

radar.offseq.com

Critical Cross-user and Cross-tenant compromise in Atlassian Rovo

An isolation failure in Atlassian Rovo's LLM-orchestrated environment caused sessions from different users and tenants to be accessible and exploitable across boundaries. Due to simple misconfigurations, attackers could discover and use oth

radar.offseq.com