PT-2026-71023

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...

Malicious Package

Overview svelte-vim-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in svelte-vim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c572d78a3be9d0fc30b6124c044c329fec518da18bb9e1ca3c22d7f18195e3 No a static rule matches or traced behavior indicative of exfiltration, install-time remote code execution, silent relay, credential distribution,...

MAL-2026-13769 Malicious code in svelte-vim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c572d78a3be9d0fc30b6124c044c329fec518da18bb9e1ca3c22d7f18195e3 No a static rule matches or traced behavior indicative of exfiltration, install-time remote code execution, silent relay, credential distribution,...

Malicious Package

Overview kit-vim-map is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

MAL-2026-13740 Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Taylsec in WordPress Plugin WP Directory Kit versions = 1.5.4...

Security Bulletin: Vulnerability in p11-kit affects IBM Netezza Appliance

Summary The p11-kit package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-2100 Vulnerability Details CVEID:CVE-2026-2100 DESCRIPTION: A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the CDeriveKey...

WordPress Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor plugin <= 3.0.7 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.7...

WordPress Ultimate Post Kit Addons for Elementor plugin <= 4.2.0 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Post Kit versions = 4.2.0...

[SECURITY] Fedora 43 Update: p11-kit-0.26.5-1.fc43

p11-kit provides a way to load and enumerate PKCS11 modules, as well as a standard configuration setup for installing PKCS11 modules in such a way that they're discoverable...

MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

Fedora 43 : p11-kit (2026-e281fdcb69)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e281fdcb69 advisory. rpc: guard against overflow when decoding nested attributes CVE-2026-18938 Only affects 32 bit systems Tenable has extracted the preceding description block...

Malicious code in svelte-kit-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...

MAL-2026-13726 Malicious code in svelte-kit-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...

Malicious code in kit-map-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786d48d847985123d42405ec9cab1475f236ca39fb9d84534c83db29834fbd58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13724 Malicious code in kit-map-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786d48d847985123d42405ec9cab1475f236ca39fb9d84534c83db29834fbd58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview godot-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview kit-map-streak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...