MAL-2026-17429 Malicious code in ai-workshop-radio-lambda (npm)

ai-workshop-radio-lambda is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username,...

CVE-2026-97600

A flaw was found in the Linux kernel's CC2520 radio driver. During device removal, an interrupt handler can queue background work after the driver's private data has been released, resulting in a use-after-free condition. A local user with privileges to disconnect or unbind the device could explo...

CVE-2026-100850 AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl. A user with the station Media permission can create or update a playlist with source=remoteurl and...

CVE-2026-100850: Server-Side Request Forgery (SSRF)

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl. A user with the station Media permission can create or update a playlist with source=remoteurl and...

SUSE CVE-2026-90381

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

Malicious Package

Overview radio-player-theme is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-16347 Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

WordPress Tz Weekly Radio Schedule plugin <= 1.8.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Tz Weekly Radio Schedule versions = 1.8.1...

WordPress Tz Weekly Radio Schedule plugin <= 1.8.1 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Tz Weekly Radio Schedule versions = 1.8.1...

CVE-2026-87775

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87774

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87775 Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87775

The Tz Weekly Radio Schedule WordPress plugin (versions

EUVD-2026-82673

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87775 Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87774

The Tz Weekly Radio Schedule WordPress plugin (versions through 1.8.1 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to sanitize and escape a parameter before using it to construct a SQL query within an AJAX action accessible to unauthenticated users. An...

CVE-2026-87774 Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87774 Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

EUVD-2026-82672

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...