Replay against the ArduPilot firmware signature mechanism recovers keys and bypasses authentication
Within the same secure-command session, an attacker can capture and resend a previously valid SECURE_COMMAND_SET_PUBLIC_KEYS command. Because the receiver does not track and enforce the highest accepted command sequence number, an old key overwrites the newly replaced key, and new commands signed with the retired key pass verification. The flaw can be triggered remotely without authentication, elevating privileges and damaging system integrity.
Component
ArduPilot is a widely used open-source autopilot software stack for unmanned aircraft. Its architecture sends flight-control commands securely over the MAVLink protocol and relies on the AP_SIGNED_FIRMWARE module for firmware integrity checks and secure command-set verification, so the aircraft executes only digitally signed trusted commands and stays operationally safe and confidential in complex electromagnetic environments.
When handling secure commands, record the highest valid sequence number for the current session and strictly reject repeated or older signed commands before applying a state change, preventing key rollback and authentication failure from replay.
CSSA Exclusive Early Warning
10.0 Critical
Dart SDK misvalidates certificates on Windows, bypassing the TLS trust chain and enabling man-in-the-middle attacks
On Windows, SecurityContext enumerates the system certificate stores and incorrectly adds non-root entries from stores such as CA, TRUST, and MY into X509_STORE as independent trust anchors. It also enables X509_V_FLAG_PARTIAL_CHAIN, so path building stops early and issuer verification is ignored. The mechanism entirely ignores the Disallowed control list and the disabled-property metadata of Windows certificate contexts, so revoked or restricted certificates can still establish a trusted connection. An attacker can use this logic flaw for a man-in-the-middle attack, stealing sensitive traffic or tampering with data in transit and seriously breaking confidentiality and integrity.
Component
The Dart SDK is the core runtime for the Dart language. Its dart:io library provides system-level networking, file-system, and process management, building an efficient cross-platform I/O layer. It uses the BoringSSL engine for encrypted connections, and the security-context module manages certificate stores and trust policy during the TLS handshake so client-server exchange meets the expected security standard for modern distributed applications.
Delegate certificate-chain validation to Windows CryptoAPI for standard policy checks, strictly separate root and intermediate roles, and filter invalid or restricted certificates according to system store attributes so operating-system trust revocation and enhanced key-usage limits are honored.
CSSA Exclusive Early Warning
10.0 Critical
chrome-devtools-mcp uses SharedWorker and AudioWorklet to bypass network isolation, leaking sensitive data and executing code
An attacker can issue cross-origin requests from a Blob SharedWorker, or load an external module through AudioWorklet, and bypass the network controls enforced by --allowedUrlPattern and --blockedUrlPattern. Underlying Puppeteer does not apply Fetch interception to shared workers, and the audio service is independent of the page network context, so a malicious script can break isolation, read protected endpoint response bodies and inject them into the DOM, or run arbitrary code at an excluded origin, seriously damaging confidentiality and integrity.
Component
chrome-devtools-mcp is a Model Context Protocol server built on Puppeteer for standardized browser automation and debugging. It wraps the Chrome DevTools Protocol and uses URL allowlists or blocklists to define the reachable network boundary, providing constrained access for automated tests, crawler proxies, and remote debugging so business logic stays inside the preset trusted domain.
Upgrade the Puppeteer library to fix the session-isolation flaw and enforce a unified Fetch interception mechanism at the application layer. Also redact logs so status-check interfaces do not print raw command-line arguments that contain authentication tokens and other sensitive data, removing the side-channel leak in the architecture.
Before SEPPmail Secure Email Gateway 15.1.1, the sender or recipient replacement-rule module does not properly escape dynamic code-execution instructions and has an eval-injection flaw (CWE-95). When an active rule uses replacement data taken from the message and the search condition matches, attacker-controlled replacement text may be evaluated as Perl code. The SEPPmail gateway has a remote code execution flaw when processing certain mail: an unauthenticated remote sender can trigger it with a crafted message and run operating-system commands in the mail-processing worker context. Every SEPPmail Secure Email Gateway user who has not updated to 15.1.1 is affected. The attacker needs no authentication and can attack remotely, and the worker context is confirmed to run as root, so the impact is severe.
Component
SEPPmail Secure Email Gateway is an enterprise secure email gateway that filters spam and malware and protects organizational communications.
Risks
Complete system control: Because the exploit context is root, attackers can run arbitrary operating-system commands on the victim system and fully control the server
Unauthenticated remote attack: Attackers need no credentials and only have to send a crafted malicious message, so the barrier is very low
Lateral movement and persistence: With root, attackers can install backdoors, steal sensitive data, or pivot to other systems on the internal network
Upgrade SEPPmail Secure Email Gateway to 15.1.1 or later immediately
Review and disable unnecessary sender/recipient replacement rules, especially those that substitute dynamic data
Monitor mail-processing worker behavior for abnormal Perl execution or system-command invocation
CVE-2026-122051
CVSS
10.0 Critical
2026-11-05
Command injection in Edimax BR-6208AC enables remote code execution
In Edimax BR-6208AC firmware 1.32, an unknown function in /goform/mp lacks input validation and has a command-injection flaw (CWE-74). Performing a specific operation lets an attacker inject and run arbitrary system commands, threatening device integrity and security. The router has a remote code execution flaw in a specific interface interaction: a crafted request can fully control the device or disrupt the network. Every Edimax BR-6208AC user running firmware 1.32 is affected. A remote request is enough, no user interaction is required, and exploit code is public.
Component
Edimax BR-6208AC is a dual-band wireless broadband router that provides network connectivity and data forwarding.
Risks
From ordinary user to administrator: If the attacker exploits this flaw, they can obtain root on the router
Complete system control: Attackers can run arbitrary commands on the router and, according to privileges, change configuration, view/change/delete data, or install a malicious backdoor
No-user-interaction attack: Through a remote network request (T1190), the attacker only needs to send a crafted packet to the device, with no user click or interaction
Apply an access control list (ACL) on the router management interface to restrict source IPs
Block remote management requests from untrusted sources
Package Poisoning
10
Package Poisoning
npm2026-11-05
data-sync-utils@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
f889355cfd49d83127eb850f824b85a5
Package Poisoning
npm2026-11-05
filipt@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
25a01077b1d3ddbd101435ccb18d75ac
Package Poisoning
npm2026-11-05
kvarzo-8f3a2-testmetest@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
2dff649fae05502e488e5b1868a8b1c2
Package Poisoning
npm2026-11-05
mock-datas-lib@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
2c7d6979786fdce2211c6b82498ad788
Package Poisoning
npm2026-11-05
that-fetch@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
03cc490da7ea2f8e9a051b80a642bbb4
Package Poisoning
npm2026-11-05
doghack-afterglow@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
36c4d8ca30e76851f965dea1488063aa
Package Poisoning
npm2026-11-05
heheheshsds@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
bc26a7854578e26033c1d9dc7d5b7646
Package Poisoning
npm2026-11-05
nannnnnnnnn@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
7e92ce10ac4efc6188b2dbfb0bf532fd
Package Poisoning
npm2026-11-05
thththtbhthhth@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
ed282c9ecbfded34060cb1510ecb4a7d
Package Poisoning
PyPI2026-11-05
rcp-ndcg@9999.0.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
