Loading story…
Researchers disclosed multiple severe flaws in Pling-based Linux software marketplaces and the Electron-based PlingStore client that could enable account takeover, malicious software distribution, and remote code execution. A stored, wormable XSS issue in Pling-powered web stores could let attackers hijack user sessions, alter listings, and upload trojanized packages, creating a potential software supply-chain compromise that propagates across marketplace content.
The native PlingStore application was also found vulnerable to drive-by RCE because its local ocs-manager WebSocket service accepted commands from any website without origin validation or authentication while the app was running, undermining the browser same-origin policy protections normally relied on to isolate web content. The researcher said Pling/OpenDesktop did not respond to repeated disclosure attempts before public release, while related issues in KDE Discover (CVE-2021-28117) and GNOME Shell Extensions were reportedly fixed more quickly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2021-06-22, Positive Security publicly disclosed severe unpatched vulnerabilities in Pling-based Linux software marketplaces and the native PlingStore application after repeated attempts to reach Pling/OpenDesktop failed. The disclosed issues included a stored wormable XSS that could enable account hijacking and supply-chain attacks, and a drive-by RCE path via the Electron app's local WebSocket service.
The article reports that GNOME Shell Extensions had an XSS issue and that GNOME remediated it within 24 hours of disclosure.
The Positive Security article states that KDE Discover had a separate URI-handling code execution vulnerability, tracked as CVE-2021-28117, and that KDE fixed it quickly after disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a class of **one-click remote code execution** flaws in desktop applications that passed user-controlled URLs to the operating system without tightly restricting URI schemes or destinations. The issue affected multiple widely used clients, including **Nextcloud, Telegram Desktop, VLC, OpenOffice, LibreOffice, Mumble, Wireshark**, and several Bitcoin-derived wallets, where a single click on a crafted link could trigger unsafe URI handlers, auto-mount remote shares, or launch attacker-controlled content depending on the operating system and desktop environment. The researchers said exploitation was shaped by platform behavior, and warned that application-level fixes alone were not enough without changes in operating systems and frameworks such as **Qt**. A related case showed how the same pattern led to practical exploitation in **Keybase** on Windows, where specially formatted chat links could display benign text while pointing to arbitrary URI targets. In that scenario, attacker-controlled payment-request content using **Lumens (`XLM`)** could be turned into clickable links that executed local or SMB-hosted programs when clicked, creating a viable one-click RCE path. Vendors responded with a mix of mitigations, including restricting allowed schemes, adding warnings, changing URL-opening behavior, removing separate display fields, and forcing non-`HTTP(S)` links to be prefixed safely, although some products were still awaiting fixes at the time of disclosure.
Jul 24, 2026
Newly published CVEs detail severe application-layer vulnerabilities in three widely used web platforms. **Shopizer 3.2.5** is affected by `CVE-2026-36767`, a critical path traversal flaw in the `/content/images/add` endpoint that lets an unauthenticated attacker send a crafted POST request and write arbitrary files to any writable path. **JeeSite 5.15.1** is affected by `CVE-2026-36760`, where the `fileMd5` parameter in `/a/file/upload` can be abused during chunked uploads to traverse directories and write arbitrary files with whitelisted suffixes to attacker-chosen filesystem locations; exploitation requires authenticated access with file upload permissions. A separate high-severity issue, `CVE-2026-36340`, affects **Krayin CRM 2.1.5** and allows remote code execution through the compose email function. The flaw was classified as `CWE-94` and has been fixed in **Krayin CRM 2.1.6**. The Shopizer and JeeSite bugs were both classified as `CWE-22` and carry high-impact CVSS ratings reflecting serious risk to confidentiality and integrity, with Shopizer also exposing availability. Public references for all three issues were added alongside their CVE records, including linked GitHub documentation and issue reports describing the vulnerabilities.
Jun 29, 2026
Several **high-severity vulnerability disclosures** were published across widely used developer and infrastructure components, with impacts ranging from **remote code execution (RCE)** to **account takeover** and **arbitrary host file writes**. In *Gogs* (self-hosted Git service), three CVEs were reported: **CVE-2025-64111** (CVSS 9.3) enables RCE by bypassing checks in `UpdateRepoFile` to modify `.git/config` via the API (described as an insufficient fix for an earlier issue); **CVE-2025-64175** (CVSS 7.7) allows a **cross-account 2FA recovery-code bypass** in versions `0.13.3` and earlier if an attacker already has a victim’s username/password; and **CVE-2026-24135** (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating `old_title`. Separately, *Jinjava* (HubSpot CMS template engine) disclosed **CVE-2026-25526** (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing `ForTag` iteration behavior (Bean ELResolver restriction bypass) and `ObjectMapper`-based JSON deserialization to instantiate disallowed classes. A critical Kubernetes storage issue was also disclosed in *Kubernetes Local Path Provisioner*: **CVE-2025-62878** (CVSS 10.0) allows directory traversal via the `parameters.pathPattern` setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., `/etc`) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread **exposure of Git metadata** on the public internet—approximately **4.96 million** IPs with accessible `.git` directories and **250,000+** exposing `.git/config` files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for *Ivanti Endpoint Manager Mobile (EPMM)* involving **CVE-2026-1281** and **CVE-2026-1340**, where attackers were observed dropping `/mifs/403.jsp` and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.
Jun 29, 2026