Malicious code in @servicetitan/marketing-integration-widgets (npm)

npm/@servicetitan/marketing-integration-widgets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

PYSEC-2026-3606 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

SummaryPenelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such a...

CVE-2026-14194 Path Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Path Traversal. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14194

Technical details about CVE-2026-14194 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2026-16547

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-16547 REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-16547

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-15958 Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

PT-2026-67664

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by TurboNexic in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.14...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

EUVD-2026-51945

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID...

CVE-2026-16285

The CVE-2026-16285 affects the WooCommerce Product Attachment WordPress plugin (prior to version 2.3.3). The root cause is a missing authorization check when streaming media library files, enabling unauthenticated users to download any attachment by enumerating its numeric ID. Impact is stated as...

CVE-2026-16285 WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID...

CVE-2026-16285

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID...

CVE-2026-16292 Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest...