PT-2026-68588

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 1.45.3 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to...

PT-2026-68589

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update GiveWP to version 4.16.6 or...

PT-2026-68504

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.13.2 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

PT-2026-68579

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.80 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendation...

PT-2026-68743

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description A TENANT ADMIN can store javascript: URLs within the tenant links configuration, specifically in the website, imprint, and privacyStatement variables. These values are returned to the...

PT-2026-68515

Name of the Vulnerable Software and Affected Versions FiboSearch versions prior to 1.33.1 Description The shop manager component contains a Cross Site Scripting XSS flaw, which occurs when an application includes untrusted data in a web page without proper validation or escaping, allowing an...

PT-2026-68509

Name of the Vulnerable Software and Affected Versions Forminator versions prior to 1.57.0 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

OpenAI’s Browser Could Be Hijacked to Spam Your WhatsApp Contacts

Researchers at security firm Zenity found more than a dozen flaws in AI browsers—and managed to get OpenAI’s Atlas to make an unauthorized Amazon purchase...

Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

MAL-2026-13380 Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

Malicious Package

Overview tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, ther...

CVE-2026-70436

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to...

DRUPAL-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

MAL-2026-13373 Malicious code in solana-sniper-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1140920c05a1ce00ca8d35295fb927d1bbb2ca9fe2f8e7ab9f63f9391ca6476b During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in solana-sniper-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1140920c05a1ce00ca8d35295fb927d1bbb2ca9fe2f8e7ab9f63f9391ca6476b During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13361 Malicious code in defi-sdk-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b292686db581afeaaa7d53e2281a90d7d470fc71ab9e7d6156c49e2e99a44a30 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in defi-sdk-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b292686db581afeaaa7d53e2281a90d7d470fc71ab9e7d6156c49e2e99a44a30 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...