CSSA Exclusive Early Warning10.0 Critical
Marzban panel missing authorization checks leading to unauthorized operations and privilege-exceeding data disclosure
The vulnerability originates from missing authentication middleware configuration on core business routes: multiple critical endpoints do not inject the administrator identity dependency, allowing an attacker to bypass basic session validation and craft HTTP requests that trigger state-changing logic directly. Exploitation vectors include unauthenticated calls to plan activation endpoints, defects in the superadmin token revocation mechanism, and authorization gaps in user information query paths. A malicious entity can, without interaction, bulk-reset target traffic quotas, silently restore disabled accounts or extract complete proxy credential configurations. Affected systems face forced overwriting of core business rules; an illegitimate actor gains long-lived highest administrative privileges and causes large-scale plaintext exposure of subscription credentials, breaking the service trust chain and the integrity of data boundaries.
Component
Marzban is an open-source panel for virtual node management and proxy traffic distribution. Its architecture combines the FastAPI framework with async…
Type
Missing Authorization (CWE-862)
Repo
Remediation- It is recommended that developers introduce a mandatory identity dependency injection mechanism uniformly at the route definition layer, ensuring every endpoint involving state changes or data reads passes strict contextual authorization checks. Token validation logic should also be restructured to eliminate early-return shortcuts for privileged accounts, the latest database security state should be synchronized forcibly, and boolean operator precedence should undergo static code review to prevent misjudged logic branches.
CVE-2026-57517CVSS 9.8 Critical2026-07-02
Control Web Panel SQL Injection Leading to Remote Code Execution
In Control Web Panel prior to version 0.9.8.1225, the user endpoint lacks filtering on the userRes POST parameter, resulting in a blind SQL injection (CWE-89) security flaw. An unauthenticated remote attacker can submit malicious input to execute arbitrary SQL queries and, using the obtained MySQL root privileges, write arbitrary files via INTO DUMPFILE, deploying a PHP webshell to an accessible roundcube log directory and achieving remote code execution as the cwpsvc account. The vulnerability affects all Control Web Panel users who have not updated to 0.9.8.1225. An attacker can launch the attack remotely without authentication, with low complexity, leading directly to complete server compromise.
Component
Control Web Panel is an open-source control panel for Linux servers providing management for websites, databases, mail and other services.
Risks
- Complete system control: An attacker can execute arbitrary code on the victim system, and depending on cwpsvc account privileges, install programs, view/modify/delete data or create new accounts with full privileges
- Unauthenticated attack: An attacker needs no credentials to trigger the vulnerability remotely and can achieve code execution simply by crafting a malicious HTTP request
- Persistent access: By writing a webshell into the log directory, an attacker gains long-term persistent access to the server
Source
Remediation- Immediately upgrade Control Web Panel to version 0.9.8.1225 or later
- Restrict access to the user endpoint and enforce strict input validation and filtering
- Monitor MySQL logs and anomalous filesystem writes, especially modifications targeting log directories
CVE-2026-24270CVSS 9.8 Critical2026-07-02
NVIDIA AIStore Authentication Bypass Leading to Denial of Service, Privilege Escalation, Information Disclosure and Data Tampering
In the NVIDIA AIStore framework, a defect in the authentication mechanism may allow an attacker to bypass authentication (CWE-290). Successful exploitation can lead to denial of service, privilege escalation, information disclosure and data tampering. The vulnerability allows an attacker to access system resources without valid credentials, seriously threatening data integrity and availability. It affects all unpatched NVIDIA AIStore deployments. An attacker can launch the attack remotely over the network and exploit the vulnerability without user interaction, with relatively low attack complexity.
Component
NVIDIA AIStore is a high-performance distributed object storage framework designed for AI workloads, supporting large-scale data storage and high-speed access.
Risks
- Privilege escalation: An attacker can bypass authentication to gain unauthorized access and then escalate privileges to control the system
- Data tampering and disclosure: An attacker can read sensitive information or modify stored data, undermining data integrity
- Denial of service: An attacker can use the vulnerability to disrupt service, affecting business continuity
- Remote attack without interaction: An attacker only needs network connectivity to trigger the vulnerability, with no action required from the target user
Source
Remediation- Restrict access to the AIStore service at the network level and allow connections only from trusted IP addresses
- Enable strong authentication mechanisms and monitor anomalous login attempts
Package Poisoningnpm2026-07-02
hardhat-compile-ethers@0.4.7 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
90c6e1e9761ce2649931596e0b0fdc0c
Package Poisoningnpm2026-07-02
svgson-lite@1.0.1 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
d2a9d6cb8c2c8d3c5d3577478191ec0c
Package Poisoningnpm2026-07-02
polymarket-toolkit@1.4.9 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
4119e0252812f38cc94095ac510b3efa
Package Poisoningnpm2026-07-02
polymarket-trading-developer-tool@0.1.1 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
7556468a534868cca255febaab3349f3
Package Poisoningnpm2026-07-02
svgcraft-core@1.0.2 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
6af27c36682b37db28802e246132b9b2
Package Poisoningnpm2026-07-02
test-pkg-pnpm@1.0.1 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
603eb62698f7fb3c333a77f61709ec19
Package Poisoningnpm2026-07-02
test-pkg-x0@1.0.0 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
db833fc0668026e75371ea47af497d35
Package Poisoningnpm2026-07-02
test-pkg-yarn@1.0.1 flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
265cdda7b2e4e7a033641a45f7c1c257
