MAL-2026-16088 Malicious code in pumpswap-sdk-v1 (npm)

[email protected] presents crypto helpers for the PumpSwap SDK, but validateinput base64-encodes its argument and POSTs it to https://pumpswap-sdk.maingoal.xyz/v1/check through checkvalidator in dist/index.js, and randomBytessize forwards the hex output of crypto.randomBytes to the same host...

CVE-2026-13359

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-13359 Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-13359

The Contact Form to DB by BestWebSoft WordPress plugin (versions up to and including 1.7.5 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the cntctfrm_contact_dropdown parameter, caused by insufficient input sanitization and output escaping. An attacker can inject a payload by...

CVE-2026-13359 Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-87451

A flaw was found in Google Chrome. This information leak vulnerability in the Downloads component allows a remote attacker, who has already compromised the browser's renderer process, to obtain sensitive cross-origin data. This can be achieved by enticing a user to visit a specially crafted HTML...

Malicious code in @haimiya/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb1fac619ba416b14b747307762d4e4cf1cfc41f00a244c8e472af5f689deb0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16068 Malicious code in @versacode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fb56d60eb9a1df8a4b6dc87789234366b8431047ca01dbce807af874778ffa8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16067 Malicious code in @vallensofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02adc12975b9798883d78640d5cab1a73420818d23fbd192ebb76a384f056d54 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16066 Malicious code in @haimiya/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb1fac619ba416b14b747307762d4e4cf1cfc41f00a244c8e472af5f689deb0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @vallensofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02adc12975b9798883d78640d5cab1a73420818d23fbd192ebb76a384f056d54 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malware in @vallensofficial/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @haimiya/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @versacode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fb56d60eb9a1df8a4b6dc87789234366b8431047ca01dbce807af874778ffa8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-87472

A flaw was found in chromium-browser. Improper input validation in the Federated Credential Management FedCM component of Google Chrome allows a remote attacker, who has already compromised the renderer process, to spoof user interface UI elements. This can be achieved by providing a specially...

CVE-2026-87537

A flaw was found in Google Chrome's Extensions. A remote attacker, who has already compromised the browser's renderer process, could exploit a missing authorization vulnerability. This allows the attacker to execute arbitrary code outside of the browser's security sandbox by sending specially...

CVE-2026-87606

A flaw was found in Google Chrome's SiteIsolation feature. A remote attacker, after compromising the renderer process, could exploit missing authorization to bypass site isolation by using a specially crafted HTML page. This could allow the attacker to access data or functionality that should be...

CVE-2026-87639

A flaw was found in WebPackaging in Google Chrome. A remote attacker, after compromising the renderer process, could exploit a use-after-free vulnerability by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security...

CVE-2026-87582

A flaw was found in Google Chrome's DataTransfer component. This confused deputy vulnerability allows a remote attacker, who has already compromised the renderer process, to potentially execute arbitrary code outside the browser's security sandbox. This exploitation occurs through a specially...

CVE-2026-87487

A flaw was found in the FileSystem component of Chromium. This missing authorization vulnerability could allow a remote attacker, who has already compromised the renderer process and leveraged social engineering, to potentially execute arbitrary code outside of the sandbox. This exploitation is...