Malicious code in eleventy-mini-css-extract-plugin-cordelia-middleware (npm)

Source: amazon-inspector b24286624def132ef9c376a35c74006cabf3598f7c1a32d194a5a9b4fdd37621 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in element-ui-winston-html-webpack-plugin-npm (npm)

Source: amazon-inspector 533d17b064934bf10be2328e4f60324b7af8f0958bb35f3d23e89346174c51ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in element-ui-html-webpack-plugin-impulse-odin (npm)

Source: amazon-inspector 4a5363694bac4371cfc54011da12618a13ca07cb0b648c0243aacb32b1f569d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in elektra-css-minimizer-webpack-plugin-janus-semantic-ui (npm)

Source: amazon-inspector a1a9b4d6033268f22c357f0c99449f28ca5695e9b6fc710c26ac26c5e3c0ed97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in electron-prettier-plugin-markdown-framework-telesto (npm)

The package electron-prettier-plugin-markdown-framework-telesto was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in electron-builder-optimize-css-assets-webpack-plugin-betelgeuse-css-loader (npm)

Source: amazon-inspector 8b7777d64a1343f42e8f80d8f8f3cde9e71dd74d38f9850534c9214756d79df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in elara-prettier-plugin-markdown-figures-await (npm)

Source: amazon-inspector d4287722d3e59d155f6cc47ce25f67e37f2fcc76a23ef7370d24188884c827b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in elara-mini-css-extract-plugin-lynx-grus (npm)

Source: amazon-inspector 0366b7f17be78889c22880bd1190e5627d5bd6527dfbdc5052a910a723993563 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-5399

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-15889

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

bokcolmaps (>=0.1.0, <=0.2.1), bokodapviewer (>=0.1.0, <=0.1.1) +8 more potentially affected by CVE-2026-82397 via tornado (4.4.2)

tornado PYPI version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - bokcolmaps =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.8.4, =0.1.7, =0.0.1, =0.0.14 Source cves: CVE-2026-82397 Source advisory: OSV:PYSEC-2026-3928...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-84305 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-84305 Source advisory: OSV:PYSEC-2026-3923...

ctesiphon (>=0.1.0, <=0.1.17), framefox (>=0.0.11, <=1.1.0) +2 more potentially affected by CVE-2026-55558 via aiosmtplib (4.0.0)

aiosmtplib PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - ctesiphon =0.1.0, =0.0.11, =0.0.2, =0.0.4, =0.0.6 Source cves: CVE-2026-55558 Source advisory: OSV:PYSEC-2026-3805...

utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins

SummaryThe fix for CVE-2026-44661 commit 5b16e43 added the ensuresecureurl / issecureurl helpers and wired them into the three HTTP-family plugins, but it did not reach the GraphQL or WebSocket plugins. The GraphQL plugin utcp-gql still uses the startswith prefix check that the fix explicitly...

PYSEC-2026-3822 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

PYSEC-2026-3820 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

PYSEC-2026-3825 django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

django CMS: Structure endpoint bypasses page-view permission

SummaryThe structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff user...

frony-document-processor (0.3.0), vllm-plugin-meralion2 (>=0.1.2.post2.dev1, <=0.1.2.post2) +1 more potentially affected by CVE-2026-9856 via transformers (4.50.1)

transformers PYPI version 4.50.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - frony-document-processor 0.3.0 - vllm-plugin-meralion2 =0.1.2.post2.dev1, =1.0.0rc1, =1.0.0rc2 Source cves: CVE-2026-9856 Source...