OWL Carousel Slider - Cross-Site Scripting

OWL Carousel Slider WordPress plugin v2.2 contains a reflected cross-site scripting caused by unsanitized parameter output in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craft malicious URL. id: CVE-2024-13627 info:...

CVE-2026-65555: Uncanny Owl Uncanny Toolkit for LearnDash: Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit…

Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2...

OdTM

OWASP Ontology-driven threat modelling OdTM framework Ontology-driven Threat Modelling OdTM framework is a set of means for implementation of an ontological approach into automatic threat modelling of computer systems. It is an OWASP Incubator Project. The ontological approach, provided by the Od...

CVE-2026-99198

A flaw was found in the Linux kernel's Actions Semi Owl Ethernet driver. When initializing or probing the network device with network traffic shaping enabled, the driver attempts to access network device operations before they are assigned. A local user capable of attaching or probing the device...

PT-2026-128191

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owl emac probe calls owl emac phy init, which connects the PHY, before netdev-netdev ops is assigned. phy attach direct - phy link topo add phy reads dev-netdev ops...

Malicious code in influential-gold-owl (npm)

Source: amazon-inspector 5ad2b907e7638c4cc960232fe1ba9d5b4991ef9f2e74f63b98debd0b8ef7f6b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hissing-ivory-owl (npm)

Source: amazon-inspector 79d6707c122ad21bfe8a77590278fed7483dedf9a77567eb7555ae2536fe4a4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in evolutionary-beige-owl (npm)

Source: amazon-inspector 8d5e48972d96ed25c00f6d2160d9dbda71c1c211617388949b22114b8da3fb2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in equal-scarlet-owl (npm)

Source: amazon-inspector 865337e196bb57a9e9e0c1ee0c5f582418cbb2f57153141c708f9c6bb874d09b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-85675

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85675

OWL 's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without scheme, host, or IP filtering , allowing attackers to inject malicious URLs via prompt injection and cause the server to...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

EUVD-2026-71131

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

Malicious code in current-lime-owl (npm)

Source: amazon-inspector 105535008099d234fc5a7a2e4aba4de479b82d6f6c0f03e0767b8b8f9dce6ce7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in complex-gray-owl (npm)

Source: amazon-inspector d8baf98bab76852457f1d78269a39f08f1dd4201542b66482c2e2d47d934fb60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

PT-2026-85568

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract document content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal...

date-a-scientist (>=0.1.0, <=0.1.19), exposeq (>=4.0.7, <=4.1.2) +4 more potentially affected by CVE-2024-12366 via pandasai (>=2.3.0, <=2.4.2)

pandasai PYPI version =2.3.0, =0.1.0, =4.0.7, =0.0.9, =0.0.13, =0.0.32 Source cves: CVE-2024-12366 Source advisory: OSV:PYSEC-2026-448...

CVE-2026-6255

Summary: CVE-2026-6255 affects the WordPress plugin Simple Owl Shortcodes, with a Stored Cross-Site Scripting vulnerability via the num attribute of the owls_wrapper shortcode in all versions up to and including 2.1.1. The issue stems from insufficient input sanitization and output escaping on us...