CVE-2026-32593

Winter CMS (Laravel-based PHP CMS) versions up to 1.2.12 are vulnerable to SQL injection in the backend Filter widget (Backend\Widgets\Filter) when the numberrange scope type is configured with a conditions key. Filter values are interpolated into the conditions statement without parameter bindin...

CVE-2026-80525

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipcconfigdata buffer for copier widgets is built once during ipcprepare called from sofpcmsetupconnectedwidgets and cached for reuse. For host copiers...

Malicious code in m3fdfocdoewn (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

Malicious code in ndmfguyhoxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15609 Malicious code in mn2adskhweox (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15616 Malicious code in ndmxchdjxn2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-15611 Malicious code in mn4xcouzvhus (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

CVE-2026-80525 ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipcconfigdata buffer for copier widgets is built once during ipcprepare called from sofpcmsetupconnectedwidgets and cached for reuse. For host copiers...

CVE-2026-19226

The Royal Addons for Elementor WordPress plugin, in versions prior to 1.7.1066 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the lack of validation for certain widget settings—specifically the Image Accordion Widget Effect Settings —before they are outputted inside an H...

CVE-2026-19226 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-32593: Improper Neutralization of Special Elements used in an SQL Command

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...

CVE-2026-19226: Improper Neutralization of Input During Web Page Generation

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-81954

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress MetForm plugin <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'mfformid' Widget Setting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Metform versions = 4.1.8...

EUVD-2026-65175

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2026-78268

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2026-78268 WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2026-78268 WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

CVE-2026-78268

CVE-2026-78268 affects the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) in versions ≤ 1.2.0 . The vulnerability allows unauthenticated sensitive data exposure through the plugin's Chat Button, Phone Call, Telegram, and Email contact features, with no user interaction r...

Malicious Package

Overview @opap/player-kyc-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...