MAL-2026-331 Malicious code in cyrpto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88df3de403df4549d6cae9b1d508f683da4ed91d472a6020a40a3dbd6d5930fc The package cyrpto was found to contain malicious code. Source: ghsa-malware 1e003c50bdddfa1368c5ed0e356acfab8b21a0d410f1d181471b88221a590cd9 Any...

Malicious code in tailwin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c6f42d8ac771f7de2a89b36d91afb6db0c0445c7c3b9c4c094cf74b1448343d The package tailwin was found to contain malicious code. Source: ghsa-malware 25f1e8ebfcada6d9b8288179365d666ecc4679a549f815f6715e35fc614e03e2 Any...

MAL-2026-334 Malicious code in viem-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73dca89de6152d63a64cab3a25d8444853cfdd2502260ea1d2b33f055d4adaec The package viem-js was found to contain malicious code. Source: ghsa-malware 7b2687f596cd8f76eec0d498e10a1f632b4ae06acd052210c214ee332feddb9d Any...

MAL-2026-332 Malicious code in tailwin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c6f42d8ac771f7de2a89b36d91afb6db0c0445c7c3b9c4c094cf74b1448343d The package tailwin was found to contain malicious code. Source: ghsa-malware 25f1e8ebfcada6d9b8288179365d666ecc4679a549f815f6715e35fc614e03e2 Any...

Malicious code in tronweb-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d60b4098130965b3c2a5c2db0b1ce1c0f4cbde94f9719e9f12b3b90c982478f The package tronweb-tool was found to contain malicious code. Source: ghsa-malware 6592f1600a6d596ff1db03a849560d8a3ccd1643ad249a7bb5a46bac048e2748 A...

MAL-2026-333 Malicious code in tronweb-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d60b4098130965b3c2a5c2db0b1ce1c0f4cbde94f9719e9f12b3b90c982478f The package tronweb-tool was found to contain malicious code. Source: ghsa-malware 6592f1600a6d596ff1db03a849560d8a3ccd1643ad249a7bb5a46bac048e2748 A...

Malicious code in @daffadeveloper/signal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae0087b0a9b601b66eed90dbf41396601a483159b3e74933ad6ed63e6a06e3d1 The package @daffadeveloper/signal-node was found to contain malicious code. Source: ghsa-malware...

CVE-2025-12825

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getcf7formdata' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings...

CVE-2025-12825

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getcf7formdata' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings...

CVE-2025-12825 User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getcf7formdata' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings...

CVE-2025-12825

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getcf7formdata' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings...

CVE-2025-12825

CVE-2025-12825 affects the WordPress plugin User Registration Using Contact Form 7. The issue is a missing capability check in get_cf7_form_data across all versions up to and including 2.5, enabling unauthorized data access (including Facebook app secrets) by unauthenticated users. Connected sour...

CVE-2025-12825 User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getcf7formdata' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings...

EUVD-2026-3149

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getcf7formdata' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings...

PT-2026-3347

The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get cf7 form data' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form...

GHSA-CC8M-98FM-RC9G Skipper is vulnerable to arbitrary code execution through lua filters

Impact Arbitrary code execution through lua filters. The default skipper configuration before v0.23 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration...

Crawl4AI Has Local File Inclusion in Docker API via file:// URLs

A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /executejs, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem. Attack Vector: json POST /executejs "url": "file:///etc/passwd", "scripts":...

CVE-2026-23742

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The...

CVE-2026-23742 Skipper arbitrary code execution through lua filters

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The...

CVE-2026-23742 Skipper arbitrary code execution through lua filters

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The...