Importing a malicious Python package through a DB-GPT API triggers remote code execution and full server compromise
Attackers abuse the unauthenticated /api/v1/serve/awel/flow/import endpoint to upload a ZIP that contains a crafted dbgpts.toml and __init__.py. During metadata parsing the system dynamically loads and runs the module via importlib. With no sandbox and broken authentication, attackers need no privileges to run arbitrary OS commands in the server process context and seize host control.
Component
DB-GPT is an enterprise generative-AI platform for data interaction. Its core components rely on a RESTful API architecture for natural-language database queries and automated workflow orchestration, with multi-source data connections and visual workflow building.
Remove automatic import of Python-type flow packages or restrict imports to JSON declarative definitions only; enforce strict API authentication and authorization; and use an independent sandbox or container isolation when handling untrusted input to block code-execution paths.
CSSA Exclusive Early Warning
10.0 Critical
Missing authentication on VoltAgent core MCP routes enables unauthorized execution and loss of system control
Attackers can reach unprotected Model Context Protocol (MCP) execution endpoints over the network—including Streamable HTTP, SSE connections, and message-send interfaces. Legacy auth policy left these critical routes unprotected and defaults allow anonymous access, so malicious users can enumerate and invoke registered tools or agents without credentials, then abuse Workspace tools with host interaction to run arbitrary commands, fully control the server, and severely damage confidentiality, integrity, and availability.
Component
VoltAgent is a modern AI-agent platform whose core components automate orchestration and execution of agents, toolchains, and workflows through standardized interfaces. A modular design supports multiple transport protocols for task scheduling and resource coordination in complex business scenarios, aiming for efficient, scalable multi-agent collaboration.
Type
Missing Authentication for Critical Function (CWE-306)
Explicitly add all MCP execution-related routes to the protected-path list at the code level, enforce authentication checks, switch the default security policy to private mode, and harden sandbox isolation to prevent local-process escape.
CSSA Exclusive Early Warning
10.0 Critical
MemOS authentication logic flaw enables unauthorized remote full takeover of system privileges
Attackers exploit is_internal_request returning True when INTERNAL_SERVICE_SECRET is unset. Without any credentials they bypass authentication and are treated as a fully privileged internal service account, enabling unauthorized arbitrary API access and loss of data confidentiality and integrity.
Component
MemOS is a distributed operating system based on memory-computing architecture. Its core components use APIs for inter-service communication and resource scheduling, providing unified memory management and task orchestration across heterogeneous hardware with multi-node collaboration.
Require that the internal service secret exists and is non-empty, verify request headers with constant-time comparison, and deny access or raise a security warning when configuration is missing.
CVE Intelligence
3
CVE-2026-116366
CVSS
10.0 Critical
2026-10-30
ClickHouse Server remote code execution enables arbitrary code execution
A critical issue was found in ClickHouse Server that, under certain conditions, may allow an unauthenticated user with network access to execute arbitrary code on ClickHouse Server. The flaw stems from an integer overflow or wraparound (CWE-190). Attackers need no authentication to attack over the network, directly threatening integrity and availability. All unmitigated ClickHouse Server instances are affected; network access alone suffices with no user interaction for remote control.
Component
ClickHouse is a column-oriented DBMS for online analytical processing (OLAP), supporting high-performance data query and analysis.
Risks
Complete system control: Attackers can run arbitrary code on ClickHouse Server and fully control the server
Unauthenticated remote attack: No credentials are needed—only network reachability
Service disruption and data exposure: Malicious code execution may crash the service, tamper with data, or leak sensitive information
In the Radius Xenia M2M Platform, the password-recovery function of the web management UI insufficiently validates user input and has an SQL-injection flaw (CWE-89). Unauthenticated remote attackers can supply crafted SQL to input fields. Successful exploitation may allow unauthorized access to sensitive information, enumeration of database structure, or modification of database records. All unpatched Radius Xenia M2M deployments are affected. Attackers need no authentication to strike remotely, directly threatening backend database security and integrity.
Component
Radius Xenia M2M is a software platform for machine-to-machine communication management, with a web UI to configure and manage M2M devices and services.
Risks
Sensitive information disclosure: Attackers can extract user credentials, configuration, and business data from the database
Database structure enumeration: Attackers can obtain the full schema to support follow-on attacks
Data tampering: Attackers can modify, delete, or insert malicious records, damaging business logic or stability
Unauthenticated remote attack: No login is required; the attack barrier is extremely low
Immediately review and patch input validation in password recovery; use parameterized queries or prepared statements
Deploy a web application firewall (WAF) to block common SQL-injection patterns
Restrict web management UI access to trusted IPs only
Regularly audit database access logs and watch for anomalous queries
CVE-2026-61826
CVSS
10.0 Critical
2026-10-31
Unauthorized access and SSRF in Bazarr Plex API enable credential theft and configuration tampering
Before Bazarr 1.5.7-beta.14, the api_ns_plex namespace in bazarr/api/plex/oauth.py lacked @authenticate on its Resource handlers and had no compensating global auth hook. Anonymous callers can POST /api/plex/oauth/logout to clear credentials or POST /api/plex/apikey to persist an attacker-chosen key with no PIN, account, or state prerequisites. Attackers can also complete PIN binding with a controlled Plex account and abuse write_config() exposed by endpoints such as POST /api/plex/select-server to inject malicious server URLs. Those URLs are later used in outbound requests that carry the configured API key (X-Plex-Token), enabling SSRF and credential leakage, persistent configuration tampering, and integration denial of service. All Bazarr users not updated to 1.5.7-beta.14 are affected. Attackers need no authentication to exploit remotely, directly changing system configuration and stealing sensitive credentials.
Component
Bazarr is a companion app for Sonarr and Radarr focused on subtitle management, with Plex API integration and configuration.
Risks
Credential leakage and SSRF: Attackers can abuse SSRF for outbound requests, steal the API key in X-Plex-Token, and reach internal network resources or third-party services
Persistent configuration tampering: Attackers can persistently change API keys and server settings so legitimate users lose service or data is maliciously controlled
Denial of service: Clearing credentials or disabling integration can fully break Bazarr–Plex integration
Unauthenticated attack: No PIN or account login is required to call sensitive APIs
Upgrade Bazarr to 1.5.7-beta.14 or later immediately to fix unauthorized access
Restrict /api/plex/ at the firewall or reverse-proxy layer to trusted IPs only
Monitor outbound connections, especially those carrying X-Plex-Token, to detect potential SSRF
Package Poisoning
11
Package Poisoning
npm2026-10-30
orderbook-volt-plugin@0.0.0-stage
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
1193b7c93be1b349b3ad07e444192ca3
Package Poisoning
npm2026-10-30
react-native-drago-callkit@0.0.0-stage
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
ec03e30d5a2aa2dbb6d5300d0f2e4bbd
Package Poisoning
npm2026-10-30
dowload_ebok_lolita_by_vladimir_nabokov_oy1gy@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
0e57ff1d2d9afbf9bf9f97d93abf9512
Package Poisoning
npm2026-10-30
dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
a59f20b7b0d0f4f93905fcedb4919a24
Package Poisoning
npm2026-10-30
dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
392d30d5fe7f753e24f4cee7d1490db1
Package Poisoning
npm2026-10-31
grizzly-baileys@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
9631f18235fb0a65d28926c55f1a2423
Package Poisoning
npm2026-10-31
neuralwhatsapp@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
9df6cae974757eda0888dfbf2d284234
Package Poisoning
npm2026-10-31
ourin-baileys@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
8110a3655353ab2a2d535dab30da8d2a
Package Poisoning
npm2026-10-31
@pcb-dp/qa-commons@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
992357036cb8860991bc5d55b81d8f4d
Package Poisoning
npm2026-10-31
dependencykfeg@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
037b063b05b6323aa5a4f85be6cf0675
Package Poisoning
npm2026-10-31
tefeest-npm-com-test@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
