CVE-2026-8903

The CVE concerns the WordPress plugin “Two-factor authentication (formerly IP Vault)” up to version 2.1. It is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in ipv_save_changes. This allows unauthenticated attackers to modify the plugin’s firewall and two-f...

Malicious code in fitri-lodeh64-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e3d9f79ab3946e2d8aa33a6fd4f1760e861328b4dd2ab8333d69f57af8ade05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...