Security Intelligence Center · Sectrend

Daily Security Intelligence 2026-07-17 ~ 07-19 | CSSA 2 · CVE 4 · Poisoning 11 · Sectrend

Sun, 19 Jul 2026 09:00:00 +0800

[CSSA Exclusive Early Warning] QwenPaw Console Malicious Plugin Upload Leading to Remote Code Execution（10.0 Critical）

An attacker can exploit the plugin upload interface, which lacks strict validation, to submit archive files carrying malicious code. Because the server lacks file type allowlist enforcement and sandboxed isolation during loading, it will directly deserialize or dynamically execute the uploaded content, thereby triggering underlying command injection. This vulnerability is network-reachable and requires no prior authentication; successful exploitation results in full control over the host environment, leading to the compromise of core assets and disruption of business continuity.

Remediation: It is recommended to enforce strict file extension allowlist validation on the upload interface and disable parsing of dangerous file types. Combined with storage isolation strategies that place files outside the web directory, a sandbox mechanism should be introduced to block the loading of malicious code.

[CSSA Exclusive Early Warning] hermes-agent exploited via unverified plugin auto-loading leading to loss of server control（10.0 Critical）

An attacker can exploit the code-pulling module, which lacks integrity verification, by triggering a public interface to clone a malicious repository into the plugin directory. This vulnerability stems from the auto-loading mechanism's lack of cryptographic signature verification and sandbox isolation. Combined with the absence of network access controls in the attack chain, the vulnerability is network-reachable and requires only a crafted malicious request to achieve underlying command execution. Affected systems face threats including sensitive data theft, credential leakage, and persistent backdoor implantation.

Remediation: It is recommended to introduce strong authentication mechanisms to restrict external interface calls, enforce digital signature verification and hash comparison on dynamically pulled code files, disable unnecessary auto-loading functionality, and use network access control lists to strictly limit the range of trusted source addresses.

[CVE-2026-53412] Zoom Windows Client Improper Input Validation Leading to Account Takeover（9.8 Critical）

A critical security flaw exists in the Zoom Windows desktop client, Zoom Windows VDI client, and Zoom Windows Meeting SDK due to improper input validation (CWE-20). An unauthenticated attacker can carry out an account takeover via network access. The vulnerability allows an attacker to remotely exploit the network interface without any user interaction, thereby gaining full control of the victim's Zoom account. This vulnerability affects all users of unpatched Zoom Windows-related components. An attacker only needs to launch the attack over the network to exploit the vulnerability, requiring no local privileges and enabling full remote exploitation.

Remediation: Enable multi-factor authentication (MFA) to enhance account security.authentication (MFA) to enhance account security.; Monitor network traffic for abnormal unauthorized access attempts targeting Zoom services.

CVE-2026-53412

[CVE-2026-44181] Jupyter Enterprise Gateway Server-Side Template Injection Vulnerability Leading to Remote Code Execution（9.8 Critical）

In Jupyter Enterprise Gateway versions 2.0.0rc2 and above but below 3.3.0, the Kubernetes manifest rendering module contains a Server-Side Template Injection (SSTI, CWE-1336) security flaw due to improper handling of environment variables (KERNEL_XXX). By injecting Jinja2 template expressions into environment variables, an attacker can execute arbitrary Python code and operating system commands within the Enterprise Gateway service. This vulnerability allows an attacker to steal Kubernetes service account tokens and secrets, and subsequently gain full control of the Kubernetes cluster by scheduling privileged Pods or Pods with hostPath volume mounts. This issue has been fixed in version 3.3.0.

Remediation: Immediately upgrade Jupyter Enterprise Gateway to version 3.3.0 or latery to version 3.3.0 or later; Strictly restrict Kubernetes service account permissions by following the principle of least privilege; Monitor the Enterprise Gateway service for anomalous process creation and resource access behavior

CVE-2026-44181

[CVE-2023-49899] Affected Devices Allow Remote Command Execution Due to Missing Validation of Communication Channel Origin（9.8 Critical）

Affected devices contain a source validation error (CWE-346) security flaw caused by improper validation of the origin of communication channels. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device. The vulnerability allows an attacker to launch an attack over the network, achieving full control of the affected system without any user interaction or privileges. The vulnerability affects all devices that have not patched this flaw; an attacker only needs to send a specially crafted network request to trigger exploitation, resulting in complete system takeover.

Remediation: Strictly validate the origin and identity of all inbound communication channelsthe origin and identity of all inbound communication channels; Implement network-layer access control lists (ACLs) to restrict trusted sources; Monitor anomalous command execution logs and deploy an intrusion detection system

CVE-2023-49899

[CVE-2023-49900] Unauthenticated Remote Code Execution Vulnerability via SetParameter Command（9.8 Critical）

In the affected component, the SetParameter command contains an OS command injection security flaw (CWE-78) due to improper sanitization of user-supplied input. An unauthenticated remote attacker can exploit this vulnerability to achieve remote code execution. The vulnerability allows an attacker to launch an attack directly over the network without requiring any user interaction or privileged credentials, resulting in complete control of the affected system. The vulnerability affects all unpatched instances of the relevant service; an attacker only needs to send a specially crafted SetParameter request to exploit it, leading to full system takeover.

Remediation: Immediately update the component to the officially released patched versionte the component to the officially released patched version; Apply strict filtering and monitoring of SetParameter command requests at the firewall or WAF level; Enforce strict whitelist validation and special-character escaping on all input data

CVE-2023-49900

[Package Poisoning] agentto@0.5.36 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 08011aa6b7f86bb8d5968017e69ba3fc

[Package Poisoning] channel-worker@2.5.39 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 287e020b33ecef4ea61c8c11d5f96fa2

[Package Poisoning] codeam-cli@2.61.1 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: c2d417f5b21993e689c4ee7f70fdc61f

[Package Poisoning] isite@2026.7.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 045515e313d28302f4177d865ad089c0

[Package Poisoning] netcontrol-agent@1.0.5 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: ad2ec3ee89dc4809c90e0a88df970bb2

[Package Poisoning] patchwork-os@1.1.0-beta.3.canary.414 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: f14edeae46b6994bdbd4330119765c52

[Package Poisoning] phantomx-tool-client@1.0.8 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: a1e857a3ae67383242674482e809c15b

[Package Poisoning] airflow-provider-spirit@0.0.1 (pypi)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: f30a8a03278a36f099ab4f3df297b91c

[Package Poisoning] darkglitch@1.2.0 (pypi)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: fa94b3faf1d48c41e07aada064153bc7

[Package Poisoning] dde-common@0.0.1 (pypi)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 15c39fb5942de814f4ee0b3df71f769e

[Package Poisoning] trongridme@0.0.1 (pypi)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 8b51a89c45e815662701fb76fa012f91

Daily Security Intelligence 2026-07-16 | CSSA 1 · CVE 2 · Poisoning 3 · Sectrend

Thu, 16 Jul 2026 09:00:00 +0800

[CSSA Exclusive Early Warning] QwenPaw Console Malicious Plugin Upload Leading to Remote Code Execution（10.0 Critical）

An attacker can exploit the plugin upload endpoint, which lacks strict validation, by submitting a crafted archive file containing malicious code. Due to the absence of a file type allowlist and sandbox isolation on the server side, the uploaded content is directly deserialized or dynamically executed, thereby triggering underlying command injection. This vulnerability is network-reachable and requires no prior authentication. Successful exploitation results in complete control over the host environment, leading to the compromise of core assets and disruption of business continuity.

Remediation: It is recommended to enforce strict file extension allowlist validation on the upload endpoint and disable parsing of dangerous file types. Combined with storage isolation strategies that place files outside the web-accessible directory, a sandbox mechanism should be introduced to prevent malicious code from being loaded.

[CVE-2026-61740] LightRAG API Key Bypass Vulnerability Leading to Unauthorized Access（9.8 Critical）

In LightRAG prior to version 1.5.4, when deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS not set, the X-API-Key protection mechanism can be bypassed. Because lightrag/api/auth.py falls back to a hardcoded DEFAULT_TOKEN_SECRET, the /auth-status and /login endpoints can generate guest JWTs, and combined_dependency in lightrag/api/utils_api.py accepts a valid guest token before checking the API key. A remote unauthenticated attacker can invoke endpoints protected by combined_auth, including document read, upload, delete, graph structure modification, and query endpoints. This vulnerability has been fixed in version 1.5.4.

Remediation: Immediately upgrade LightRAG to version 1.5.4 or laterG to version 1.5.4 or later; Ensure the AUTH_ACCOUNTS environment variable is properly configured at deployment time; Monitor API access logs to detect anomalous unauthenticated request behavior

CVE-2026-61740

[CVE-2026-62378] RustFS Console PDF Preview Stored XSS Vulnerability Leading to Administrator Credential Leakage（9.0 Critical）

In RustFS Console versions 0.1.7 through 0.1.10, the components/object/preview-modal.tsx and components/object/pdf-viewer.tsx components of the web administration console contain a Stored Cross-Site Scripting (Stored XSS, CWE-79) vulnerability due to insufficient extension-based PDF preview path validation. An attacker can upload a file containing malicious HTML content disguised with a .pdf extension; when an administrator previews the file in the console, the malicious script is executed. This vulnerability is a regression of CVE-2026-27822 and directly results in the exposure of sensitive administrator credentials including AccessKeyId, SecretAccessKey, and SessionToken. The vulnerability affects all RustFS Console users who have not updated to the patched version (fixed in 0.1.10). An attacker only needs to induce an administrator to access or preview the malicious file to trigger the vulnerability and steal high-privilege credentials.

Remediation: Immediately upgrade RustFS Console to version 0.1.10 or later to apply the official patchon 0.1.10 or later to apply the official patch; Enforce strict content-type validation on uploaded files, relying not only on file extensions but also verifying file magic numbers; Enable sandbox isolation in the preview feature to prevent execution of any script code

CVE-2026-62378

[Package Poisoning] selparsecss-selector@1.1.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 7b26c27085e26ae23da8d6bf7429d00b

[Package Poisoning] pylogora@0.7.8 (pypi)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: c00b8275ed32a1a3de7b753688d74e78

[Package Poisoning] qwen-asr-pvt@0.0.6 (PyPI)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 50ec8bbc99da8482a31b1bd86b739a23

Daily Security Intelligence 2026-07-15 | CSSA 1 · CVE 2 · Poisoning 6 · Sectrend

Wed, 15 Jul 2026 09:00:00 +0800

[CSSA Exclusive Early Warning] Remote Code Execution via Deserialization of Unvalidated Data in the sglang Framework（10.0 Critical）

This vulnerability stems from the message queue module directly invoking the built-in deserialization function to process raw byte streams when unpacking subscribed data, with no security boundary controls such as authentication, hash signatures, or format filtering applied to the communication channel. An attacker needs only to obtain the publish endpoint address of the target cluster to deliver a crafted malicious serialized payload over the network. Once the malicious data is received through the socket, it triggers the underlying interpreter to execute arbitrary system commands. This attack path has a low barrier to exploitation and is remotely exploitable. A successful intrusion would result in the hijacking of computational logic across all connected nodes, leading to cascading security consequences including service disruption, data exfiltration, and lateral movement.

Remediation: It is recommended to fully abandon unsafe deserialization protocols in favor of type-safe data formats. Mutual authentication and digital signature verification should be enforced at communication entry points, strict allowlists should be configured to block anomalous structures, and the runtime environment should be isolated according to the principle of least privilege to completely prevent the loading of malicious code.

[CVE-2026-62422] YouTrack Authentication Bypass via Direct Database Access Leading to Administrator Privileges（10.0 Critical）

Prior to JetBrains YouTrack versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, a vulnerability exists that allows authentication bypass and acquisition of administrator privileges through direct database access. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), enabling an unauthenticated attacker to directly access the database over the network and obtain the highest level of privileges. Because the attack vector is NETWORK with LOW complexity, requiring no user interaction (UI:N) and no privileges (PR:N), an attacker can fully compromise the affected system, resulting in severe impact to confidentiality, integrity, and availability. This vulnerability affects all YouTrack instances that have not been updated to the secure versions listed above; a successful exploit allows the attacker to completely take over the application server and its underlying data.

Remediation: Immediately upgrade JetBrains YouTrack to version 2026.1.13757 or later to remediate this vulnerability2026.1.13757 or later to remediate this vulnerability; Restrict direct network access to the YouTrack database port, ensuring the database is accessible only from the internal network or trusted application-layer services; Deploy a network intrusion detection system (IDS) to monitor for anomalous access attempts targeting the database port

CVE-2026-62422

[CVE-2026-62390] Apache Kylin SQL Injection Vulnerability Leading to Remote Code Execution（9.8 Critical）

Prior to Apache Kylin version 5.0.4, the backend API for refreshing the table catalog contains a SQL injection (CWE-89) security flaw due to improper neutralization of special elements in SQL commands. An attacker can inject SQL statements by crafting malicious requests, threatening the integrity and confidentiality of the backend database. Apache Kylin is vulnerable to injection in certain API call scenarios, which can be triggered remotely over the network, resulting in data leakage, tampering, or remote code execution. This vulnerability affects all Apache Kylin versions from 4.0.0 through 5.0.3. The vulnerability can be exploited remotely without user interaction or authentication, posing an extremely high risk.

Remediation: Immediately upgrade Apache Kylin to version 5.0.4 or later to remediate this vulnerabilityersion 5.0.4 or later to remediate this vulnerability; Implement strict input validation and parameterized query mechanisms for backend APIs; Monitor anomalous SQL execution logs and database access behavior

CVE-2026-62390

[Package Poisoning] chain-sdk-js@1.0.3 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 9c4f3a87ef9184d08c281dccf0a8272a

[Package Poisoning] assertion-utils-js@2.4.3 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: d9f31b77bef62ba94bfb2ac161c74627

[Package Poisoning] ethereum-lib-utils@1.3.7 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: b4b500d2a8c8341e344a7a8fb3a527f6

[Package Poisoning] postcss-selector-minify@2.0.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 2c3f89fc0615ee4ad3d7385ff61d559c

[Package Poisoning] http-ws-listener@1.0.5 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: bc830ecdabf64d37a4e318224d5468fb

[Package Poisoning] tronwe@0.0.1 (pypi)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 4bb2f0c91b2f00460a65f7c8a95e0474

Daily Security Intelligence 2026-07-14 | CSSA 1 · CVE 2 · Poisoning 9 · Sectrend

Tue, 14 Jul 2026 09:00:00 +0800

[CSSA Exclusive Early Warning] Envoy Gateway Route Hijacking and Directory Traversal via Unescaped Path Variable Injection（10.0 Critical）

The flaw originates in the mcp_json_rest_bridge extension filter, where the substitution logic for simple template variables during upstream request path construction does not percent-encode slashes and dots. The rewritten path is written directly into the upstream protocol headers, bypassing secondary normalization checks. Because the pre-processing path sanitization stage only applies to the original request line, an unauthenticated downstream client can inject relative path sequences through JSON tool call parameters, triggering routing cache invalidation and forcing the routing table to re-match. An attacker can exploit this to break out of predefined access boundaries, bypass upstream routing rules, or induce backend services to resolve unintended directory structures. Network nodes deploying this component are exposed to risks of business logic tampering and sensitive resource disclosure.

Remediation: To address this type of path traversal vulnerability, strict character allowlist validation should be enforced at the path concatenation stage. Template variables without explicitly declared wildcards should be subject to single-segment matching rules, and special delimiters and consecutive dots must be escaped or blocked. Additionally, standardized normalization logic must be introduced before the final path assignment, combined with a defense-in-depth strategy to reject request payloads containing illegal traversal sequences.

[CVE-2026-59515] Sergey AIWU ai-copilot-content-generator SQL Injection Leading to Blind SQL Injection（9.3 Critical）

In Sergey AIWU ai-copilot-content-generator version 1.5.4 and earlier, the SQL command processing module improperly neutralizes special elements, resulting in an SQL injection (CWE-89) security vulnerability. An attacker can craft malicious input to trigger blind SQL injection, thereby illegally accessing or manipulating the backend database and threatening data confidentiality and system integrity. This vulnerability affects all AIWU users who have not updated to a version beyond 1.5.4. The attack can be launched remotely over the network, requires no user interaction, has low exploit complexity, and can result in high confidentiality impact.

Remediation: Immediately upgrade ai-copilot-content-generator to a secure version beyond 1.5.4to a secure version beyond 1.5.4; Enforce strict parameterized queries or prepared statement handling for all user input; Deploy a Web Application Firewall (WAF) to intercept common SQL injection attack patterns

CVE-2026-59515

[CVE-2026-41041] Apache Gravitino URL Path Injection Vulnerability Leading to Sensitive Information Disclosure and Data Tampering（9.1 Critical）

In Apache Gravitino versions prior to 1.2.1, the core service contains a URL path injection (CWE-177) security flaw due to improper URL encoding of user-supplied identifiers. An attacker can craft malicious requests containing special characters to bypass path validation mechanisms and directly access or manipulate unintended system resources. Apache Gravitino is susceptible to path traversal when handling metadata management requests, which can be triggered remotely without authentication, resulting in high-confidentiality data disclosure and system integrity compromise. This vulnerability affects all Apache Gravitino instances running versions from 1.0.0 up to but not including 1.2.1. Exploitation requires only that an attacker send a specially crafted request over the network, with no user interaction required and full remote controllability.

Remediation: Immediately upgrade Apache Gravitino to version 1.2.1 or later to remediate this vulnerabilityersion 1.2.1 or later to remediate this vulnerability; Deploy a Web Application Firewall (WAF) at the application layer to intercept requests containing abnormal URL encoding or path traversal patterns; Enforce strict allowlist validation and URL encoding normalization on all user-supplied identifiers

CVE-2026-41041

[Package Poisoning] cktool-core@1.0.1 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 108c862921ecd5eb172f10038b6c1f1d

[Package Poisoning] font-huge@2.5.3 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 14e0793da6850a4a1db56b2ebd6e03b5

[Package Poisoning] gamified-trading-system@3.1.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: c6088e4409ffb1648506c300189cb49e

[Package Poisoning] node-fsagent@1.2.1 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 8b19c01524bd148547bc1782dd7414fa

[Package Poisoning] lusha-iam-widgets@1.5.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 849554c57c5cb1ac8b5d68c5c5e71652

[Package Poisoning] abi-encode@1.0.1 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 56dc47f244208441031fea1020a99218

[Package Poisoning] eth-wallet-helpers@1.0.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 4c165e3589393f246b2e8072c01da400

[Package Poisoning] harpoon-package@1.2.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: b6bf38596c085b3b3782c41224552fbe

[Package Poisoning] web-pop@2.3.5 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 50591b79c574736041de5b14878d7ef5

Daily Security Intelligence 2026-07-13 | CSSA 1 · CVE 1 · Poisoning 10 · Sectrend

Mon, 13 Jul 2026 09:00:00 +0800

[CSSA Exclusive Early Warning] browser-use domain restriction bypass via non-standard protocols leading to internal state disclosure and unauthorized navigation（10.0 Critical）

An attacker can construct malicious links containing non-standard URI schemes such as javascript, file, chrome, or about, and exploit incomplete whitelist validation logic in the security watchdog module to achieve a bypass. The flaw originates from the input filtering mechanism blocking only specific data schemes while failing to cover all protocol types capable of triggering page navigation. When an automated agent visits a compromised page, cross-origin redirects or local file read operations are executed directly. The vulnerability is network-reachable and requires no additional user interaction to trigger; affected instances face risks including internal browser state disclosure, unauthorized access to sensitive paths, and failure of established domain isolation policies.

Remediation: It is recommended to replace the blacklist mechanism with a default-deny allowlist validation strategy, strictly limiting the set of permitted communication protocols and enforcing URI format validation. Developers should implement deep packet inspection and protocol header filtering at the routing resolution stage, combined with context-aware input sanitization functions to block unconventional redirect behavior.

[CVE-2026-56271] Flowise JWT Default Hardcoded Key Leads to Authentication Bypass（9.8 Critical）

In Flowise versions prior to 3.1.0 (affected versions are 3.0.13 and earlier), the enterprise edition Passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts) contains a Use of Hard-coded Cryptographic Key (CWE-321) security flaw due to the use of weak hardcoded default JWT secrets ('auth_token', 'refresh_token') as well as default audience and issuer values ('AUDIENCE', 'ISSUER'). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known default values, allowing attackers to forge valid JWTs and impersonate any user (including administrators), resulting in authentication bypass. This vulnerability affects all Flowise users who have not upgraded to 3.1.0, particularly deployments where the relevant environment variables are not properly configured. Attackers can remotely craft malicious requests over the network without any user interaction, using the known default secrets to generate valid tokens and thereby gain full control over system privileges.

Remediation: Immediately upgrade Flowise to version 3.1.0 or latere to version 3.1.0 or later; Ensure that the JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, and JWT_ISSUER environment variables are properly set in production environments using strong random strings; Regularly audit the codebase for other hardcoded sensitive credentials or default configurations

CVE-2026-56271

[Package Poisoning] auto-debug-tool@1.0.3 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 2a023d6ed43df87753d63ebc068a7f38

[Package Poisoning] mcp-notes-server-poc-praetorian@0.1.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: d5d85acc4a9b4343617a8dec46025d45

[Package Poisoning] babel-preset-lib-client@4.9.10 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: a67af11d76aabc7d79a4122607212699

[Package Poisoning] cold-debug-elevator@1.0.1 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: d4d37c7d52d72d76f24bfc37461043b7

[Package Poisoning] cookie-sign@2.3.5 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: d87220f19a42e583f59483792eb4aa05

[Package Poisoning] kuaishou@99.9.10 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 453062dbd03878b6e084fc2da348f0ae

[Package Poisoning] notifications-broadcast@99.9.1 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 7ba71ecd60091eb69892ff4939e07440

[Package Poisoning] path-addon-extend@1.0.7 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: c6fb1b0d2997bffdd24229caf0ef36b3

[Package Poisoning] sso-users-detection@99.9.1 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 216607df2c444cf7d578fe5046f1e193

[Package Poisoning] terminal-mascot@3.5.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 5a8acfa3269f7c3b2add28ca0421bd17

Daily Security Intelligence 2026-07-10 ~ 07-12 | CSSA 1 · CVE 2 · Poisoning 17 · Sectrend

Sun, 12 Jul 2026 09:00:00 +0800

[CSSA Exclusive Early Warning] elizaOS Authentication Mechanism Flaws Enable Remote Unauthorized Access to Sensitive Endpoints Leading to Data Exposure（10.0 Critical）

This vulnerability stems from fragmented internal role definitions and broken permission validation logic. The HTTP gateway layer relies solely on a single boolean value for binary allow/deny decisions, lacking fine-grained role-based tiered interception. An attacker can craft malicious network requests to directly bypass the central authentication module, exploiting wallet signing routes marked as publicly accessible and static shared token mechanisms to launch replay attacks or cross-origin credential theft. Combined with administrator entity identifiers derived through implicit loopback trust inference, unauthorized parties can laterally traverse high-risk interfaces including configuration management, key storage, and fund operations, resulting in illegal reading and tampering of core business data and a complete collapse of the system's trust boundary.

Remediation: It is recommended to refactor a unified role enumeration and permission mapping table, enforce role-based access control policies at the API gateway layer, remove public exposure markings from non-essential interfaces, replace static shared credentials with dynamic tokens incorporating anti-replay mechanisms, strictly restrict the cross-origin resource sharing whitelist and disable credential passthrough, and establish an explicit initialization process for administrator binding along with full-chain audit logging.

[CVE-2026-59726] Ruflo Default Deployment MCP Endpoint Unauthenticated Vulnerability Leading to Remote Code Execution（10.0 Critical）

Prior to Ruflo version 3.16.3, the default docker-compose deployment exposes the MCP bridge POST /mcp and POST /mcp/:group endpoints without any authentication, resulting in an OS command injection (CWE-78) security flaw. An unauthenticated remote attacker can invoke tools/call to execute terminal_execute, thereby gaining shell access within the bridge container, reading provider API keys, and poisoning the AgentDB learning storage schema. This vulnerability has been fixed in version 3.16.3.

Remediation: Immediately upgrade Ruflo to version 3.16.3 or higher to version 3.16.3 or higher; Enforce strict authentication mechanisms on the MCP bridge endpoints; Restrict command execution privileges within the container to avoid directly exposing the terminal_execute functionality

CVE-2026-59726

[CVE-2026-55615] Langroid Neo4jChatAgent Prompt Injection Vulnerability Leading to Remote Code Execution（9.8 Critical）

Prior to Langroid version 0.65.5, the Neo4jChatAgent module contains a prompt injection (CWE-74) security flaw due to the lack of validation on LLM-generated Cypher queries, a statement-type allowlist, and a disable option. An attacker can influence prompts through direct user input or indirect content read by the agent via RAG, thereby crafting malicious Cypher queries. This vulnerability allows an attacker to read or destroy all graph data; if APOC or dbms.security procedures are enabled on the server, the attacker can also achieve operating system command execution and filesystem access. This vulnerability belongs to the same flaw class as CVE-2026-25879, but the previous fix did not cover the neo4j module. This vulnerability affects all Langroid users who have not updated to 0.65.5. An attacker only needs to induce the target application to process controlled prompt input to exploit the vulnerability, potentially resulting in data exfiltration, data destruction, or full server compromise.

Remediation: Immediately upgrade Langroid to version 0.65.5 or later to obtain the official fixsion 0.65.5 or later to obtain the official fix; Disable unnecessary APOC or dbms.security procedures on the Neo4j server to reduce the attack surface; Implement strict input validation and output filtering mechanisms to prevent prompt injection attacks

CVE-2026-55615

[Package Poisoning] cookie-parser-js@1.4.9 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 8392158ac64e9bbe8a6526a30c03c521

[Package Poisoning] vite-pwa-config@1.1.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 9d87f21c1487a0d86587b899cdc0cf8e

[Package Poisoning] fury_frontend-andes-ui@99.9.5 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 93acd3510c40ef5484add9ebd4be457f

[Package Poisoning] guest-app-ui@99.0.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 672ba9506983bc169cd6227e51f47e89

[Package Poisoning] fastify-addone@5.1.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 79f2cac3e3e826401eae5271b03302c5

[Package Poisoning] polipoli-pak@1.0.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 36a03f6da83c61286291ada600feae35

[Package Poisoning] px8my@1.0.32 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: ca7bc8dabe496f72fc1d60b7f2cce508

[Package Poisoning] theta-sdk-js@1.2.16 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: dea37d8bdb0dfbbda4984f8c0634aa6f

[Package Poisoning] notifier-funcs@1.3.4 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 56c250ee524b8ea05450359a7d0384aa

[Package Poisoning] notify-utilities@1.3.5 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: b646c45207d704fa7124be116cada4be

[Package Poisoning] rollup-packages-polyfill-core@0.13.7 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 75c9b657561195b21d361d5de6ae370c

[Package Poisoning] sidecar-mcp@1.0.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: f2ea7533dd34943be0b94a8513a4e8bc

[Package Poisoning] type-atob@3.3.7 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: e4a4e01d07fd9f1278c1b7f2904d1d91

[Package Poisoning] auth-next-gen@1.7.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 8d25a920582b47f7f2650112220f9c12

[Package Poisoning] google-caja-bower@1000.80.20 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 2679f102ec9cc25ffa1e26636b8a6d29

[Package Poisoning] jscrambler@8.16.0 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: 0d33aa6debfa0314edce54f609a29b6e

[Package Poisoning] tinymask-js@1.0.2 (npm)

This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.

MD5: d74ded908646790fac7cb210734ce280