Loading story…
Bluspark Global, a New York-based shipping technology provider, remediated multiple critical security weaknesses in its Bluvoyix shipping and supply-chain platform after a researcher found the system was effectively exposed to the public internet and could have enabled unauthorized access to sensitive customer data. The issues risked exposing decades of shipment records for hundreds of large companies that use the platform across sectors such as retail, grocery, and manufacturing, and could have allowed remote interaction with Bluvoyix’s shipping software.
Security researcher Eaton Zveare reported finding five flaws, including the use of plaintext passwords and an unauthenticated API that could allow retrieval of user account records (including administrator credentials) and creation of new administrative accounts without authentication. Reporting indicated that disclosure was complicated by the lack of a clear security contact or bug reporting channel; Bluspark said the issues have been resolved and it plans to implement a formal bug disclosure program.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
In its response through counsel, Bluspark said there was no indication that customers were affected or that the reported vulnerabilities had been maliciously exploited. This statement accompanied the company's remediation of the issues.
By mid-January 2026, Bluspark said it had resolved the reported vulnerabilities in its Bluvoyix platform, which had risked unauthorized access to customer data and shipping systems. The company also said it planned to introduce a formal vulnerability disclosure or bug reporting program.
Before publication, TechCrunch contacted Bluspark and demonstrated the seriousness of the issue by including part of a password in an email. Bluspark then responded through outside counsel and began addressing the reported vulnerabilities.
After finding the vulnerabilities, Zveare was unable to find clear security disclosure channels at Bluspark and escalated the matter by involving the Maritime Hacking Village and TechCrunch to reach the company. This disclosure effort occurred before Bluspark began remediation.
In October 2025, security researcher Eaton Zveare identified multiple vulnerabilities in Bluspark Global's Bluvoyix shipping platform, including an unauthenticated API, plaintext credential exposure, and paths to administrative access. The flaws could have exposed sensitive customer data, shipment records, and allowed unauthorized creation of admin accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026
Blinko, an AI-powered card note-taking project, patched two high-severity vulnerabilities in version `1.8.4` after GitHub security advisories disclosed that earlier releases were vulnerable to both arbitrary file read and remote code execution. The first issue, tracked as `CVE-2026-23482`, affects the `/api/file/temp` endpoint, which failed to enforce permission checks and did not block path traversal, allowing unauthorized attackers to read arbitrary files from the server. Where scheduled backups were enabled, exposed backup files could reveal all user notes and user tokens. A second flaw, `CVE-2026-23882`, allowed OS command injection in Blinko's MCP server creation workflow. In versions before `1.8.4`, the connection-testing function accepted arbitrary commands and arguments and executed them, creating an admin-level remote code execution path mapped to `CWE-78`. The combined disclosures show that unpatched Blinko instances faced risks to confidentiality, integrity, and availability, with fixes released through the project's `1.8.4` update and associated code commits.
Jun 29, 2026