Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

MAL-2026-16323 Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

CVE-2026-59830: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action...

CVE-2026-94028

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

EUVD-2026-83742

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94028

Mealie (mealie-recipes) versions up to 3.25.1 contain a server-side request forgery (SSRF) vulnerability in the Recipe Action Trigger component, specifically in the payload.model_dump function within mealie/routes/households/controller_group_recipe_actions.py. A remote attacker with low privilege...

CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

EUVD-2026-83672

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability. The root cause is a lack of authorization checks and failure to validate the identifier of the object being removed within an AJAX action . Because this action is accessible to unauthenticated...

EUVD-2026-83669

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...

CVE-2026-94028: Server-Side Request Forgery (SSRF)

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-85017: Deserialization of Untrusted Data

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. ...

CVE-2026-87839: Improper Access Control

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-16557

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user Subscriber+ to disclose the page-builder content of arbitrary non-public draft, pending, private...

EUVD-2026-83498

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user Subscriber+ to disclose the page-builder content of arbitrary non-public draft, pending, private...

CVE-2026-16557

The Nimble Page Builder WordPress plugin, in versions up to and including 3.3.8 , contains an authorization bypass vulnerability. The flaw exists because the plugin fails to perform an authorization check when returning page-builder content via an authenticated AJAX action (specifically identifie...

CVE-2026-16557: Exposure of Sensitive Information to an Unauthorized Actor

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user Subscriber+ to disclose the page-builder content of arbitrary non-public draft, pending, private...