CVE-2026-62990

The Shopper Headless e-commerce Admin Panel is vulnerable to stored Cross-Site Scripting (XSS) in versions 2.0.0 to 2.10.1 and 3.0.0-beta.1/beta.2. Authenticated back-office staff with content-upload permissions (e.g., edit_products or add_brands) can upload executable media, such as SVG or HTML ...

CVE-2026-62990 Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant...

EUVD-2026-68888

Sulu: Media move/update authorization bypass IDOR...

EUVD-2025-205789

Malicious code in rt-text-media-collection npm...

MAL-2025-192975 Malicious code in rt-text-media-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 761afaf4df6aa1b7badedc5757ada134cb041af11dad1257171abae2be3a4589 The package rt-text-media-collection was found to contain malicious code. Source: ghsa-malware...

Malware in rt-text-media-collection

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

U.S. Dept Of Defense: CSRF Attack leads to delete album at ████████

The report describes a CSRF vulnerability in the DoD asset ███████, specifically in the feature to create albums for a media collection. The vulnerability allows an attacker to delete a victim's album without the victim's consent, as the delete request is based on GET and lacks CSRF verification...

XSS Injection in Media Collection Title was possible

Impact A logged in admin user was possible to add a script injection XSS in the collection title which was executed. Workarounds Manual patching the js files. For more information If you have any questions or comments about this advisory:' - Email us at [email protected]...

Department of Homeland Security to Collect Social Media of Immigrants and Citizens

New rules give the DHS permission to collect "social media handles, aliases, associated identifiable information, and search results" as part of people's immigration file. The Federal Register has the details, which seems to also include US citizens that communicate with immigrants. This is part ...