Malicious code in tailwindcss-form-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac index.js exposes getPlugin, which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the credits fiel...

MAL-2026-12275 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8 The package's index.js unconditionally requires./loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints...

Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...

MAL-2026-12245 Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...

Malicious code in beaver-ui-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...

MAL-2026-12146 Malicious code in beaver-ui-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...

MAL-2026-12172 Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

CVE-2026-70376

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...

CVE-2026-6147

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-54416

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2026-9198 CVSS score: 9.8 - A code injection...

CVE-2026-14553

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

EUVD-2026-53196

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...

CVE-2026-70376

Pluck CMS has a CSRF risk in the admin panel due to relying solely on Referer-based checks (requestedByTheSameDomain()) with no per-request anti-CSRF token. If Referer/Host is missing, the code treats the request as same-origin, enabling a cross-site attacker page to request forged admin actions....

EUVD-2026-53192

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

CVE-2026-54416 Pluck CMS: Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

CVE-2026-54416

CVE-2026-54416 – Pluck CMS : Affected product is Pluck CMS

CVE-2026-61484

Apache Lucy is affected by CVE-2026-61484 due to a Deserialization of Untrusted Data vulnerability. The advisory states this affects Lucy: all versions and, because the project is retired, there will be no fix released; users should consider alternatives or restrict access to trusted users. The C...

CVE-2026-61484 Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the...