WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File

Hummingbird Performance WordPress plugin = 3.18.0 contains a sensitive information exposure caused by improper handling in the 'request' function, letting unauthenticated attackers extract sensitive data including Cloudflare API credentials, exploit requires no authentication. id: CVE-2025-14437...

Astro Cloudflare Adapter - Server Side Request Forgery

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

CVE-2026-11325

The CVE-2026-11325 entry concerns Cloudflare’s cloudflare/pages-action, an archived repository deprecated since 2024. A remote code execution vulnerability was reported in src/index.ts that could be reachable via certain GitHub Actions workflow configurations, potentially exposing workflow secret...

EUVD-2026-57178

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

CVE-2026-11325

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

CVE-2026-11325 cloudflare/pages-action is deprecated — migration required by September 18th, 2026

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

PT-2026-71049

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...

Malicious code in upshift-config (npm)

upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have it is a first-ever publish. Its body is byte-identical to augustdigital-s...

MAL-2026-13777 Malicious code in upshift-finance (npm)

upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...

Malicious code in augustdigital-sdk (npm)

augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist

N-able has released a fresh round of hotfixes for N‑central as part of its investigation into ongoing exploitation of a recently disclosed security flaw in the Remote Monitoring and Management RMM product. "We are proactively expanding protections in response to ongoing monitoring of threat actor...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

CVE-2026-15239

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

CVE-2026-15239 Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solv...

CVE-2026-15239

CVE-2026-15239 affects the Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (pre-1.42.0). The vulnerability arises because the Turnstile validation cache isn’t bound to the single-use challenge token, instead tying to an attacker-controlled reusable request value, enabling unauthenticate...

Malicious code in llm-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7 On npm install, postinstall.js unconditionally runs runSetup which wires the package into the installer's AI tooling and stands up long-lived...

MAL-2026-13370 Malicious code in llm-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cc7f305d00b175d42babae0198faea6951f846bcdeda2e3d6754fd9ceba2d7 On npm install, postinstall.js unconditionally runs runSetup which wires the package into the installer's AI tooling and stands up long-lived...