CVE-2025-6508 User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

CVE-2026-0637

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

EUVD-2026-53820

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

CVE-2026-0637

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

CVE-2026-0637

The CVE pertains to WS02 products where an Event Publisher output adapter configured with irrelevant properties logs those properties without proper validation or sanitization. This can expose sensitive data (e.g., user credentials) to anyone with access to the wso2carbon logs, enabling unauthori...

MAL-2026-13306 Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g...

Malicious code in dolyame-boxy-independent-bnpl-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b31579fb9a360c4781524c5edd9d0e7b84440e7ccd073e09d54afc10678764cf On require of this package, index.js loads compat.js which unconditionally downloads an OS-specific binary from Cloudflare Workers hosts assembled at...

MAL-2026-13320 Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

MAL-2026-12764 Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

MAL-2026-12477 Malicious code in tcb-web-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69 On require'tcb-web-images', index.js loads helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads ...

Malicious code in invest-module-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3f53c4d50d2dedd530c65015b26a902950e6e2bbef3cda3560a661d4aad178 On require'invest-module-cookie', index.js loads adapter.js which selects an OS-specific asset path, downloads an opaque binary from one of three...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...

CVE-2026-16273

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-16273

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

EUVD-2026-51944

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-16273 Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta

The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the...

CVE-2026-16273

CVE-2026-16273 affects the Narrative Publisher WordPress plugin (

CVE-2026-13729

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...

EUVD-2026-51703

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...

WordPress Podlove Podcast Publisher plugin < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion vulnerability

Podcast Contributor/Group/Role Creation and Deletion vulnerability discovered by Ryan Fabella in WordPress Plugin Podlove Podcast Publisher versions 4.5.3...