Broadcom discloses 91 Spring CVEs affecting 209,569 tracked components

🕵️ RESEARCH & DEEP DIVES

• Trojanized npm Packages Deliver RedC2 4.0 Linux Backdoor
  Trojanized npm packages are delivering the RedC2 4.0 Linux backdoor.

  • npm users of calendar and streak utility packages are affected.
  • The packages contain the RedC2 4.0 Linux implant.
  • When loaded, the module locates its bundled binary and marks it executable.
  • The binary launches as a detached background process.
    📎 Coverage: thehackernews.com · 👁 via The Hacker News

• Broadcom discloses 91 Spring CVEs affecting 209,569 tracked components
  Broadcom disclosed 91 CVEs across Spring projects.

  • Spring Framework users and applications using Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor, Spring AMQP, or Spring Batch are affected.
  • The disclosure covers insecure deserialization, code execution, sensitive-information exposure, SSRF, path traversal, denial of service, and authorization flaws.
  • CVE-2026-59285 is a critical Spring for GraphQL deserialization flaw rated CVSS 9.2.
  • Exploitation may occur when applications use Jackson 2.x, expose paginated GraphQL fields, and contain abuse-prone classes; AI-assisted scanning is accelerating vulnerability discovery.
    📄 Source: spring.io · 📎 Coverage: sonatype.com · 👁 via securityboulevard.com (discovered)

🔓 CVEs & KEV

• CVE-2026-77810 — CVSS 9.4 — Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connect...

• CVE-2026-67359 — CVSS 8.7 — Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3....

• CVE-2026-74252 — CVSS 8.6 — Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1...

• CVE-2026-54682 — CVSS 8.2 — DiscordChatExporter: Stored XSS in HTML export when markdown formatting is di...

• CVE-2026-54071 — CVSS 7.8 — BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldo...

• CVE-2026-27462 — CVSS 7.5 — Combodo iTop: User enumeration via password resetCombodo iTop is a web based ...

• CVE-2026-30866 — CVSS 7.5 — Combodo iTop: Insecured access to uploaded images via sniffed urlCombodo iTop...

• CVE-2026-67361 — CVSS 6.9 — Joomla Extension - j2commerce.com - Unauthenticated file upload with missing ...

• CVE-2026-67360 — CVSS 6.3 — Joomla Extension - j2commerce.com - Cross-customer order replication in J2Sto...

• CVE-2026-53762 — CVSS 6.2 — VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-de...