CVE-2026-110214

Snowy version 3.6.5 contains a hard-coded HMAC key vulnerability (CWE-321) involving the published FILE_DOWNLOAD_SIGN_SECRET constant. This flaw allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint. By computing HMAC-SHA256 signatures for guessed file ...

CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

CVE-2026-110214: Use of Hard-coded Cryptographic Key

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

EUVD-2025-210233

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

CVE-2025-69161

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

CVE-2025-69161 WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

CVE-2025-69161 WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

CVE-2025-69161

CVE-2025-69161 applies to the WordPress Snowy theme up to version 1.13, with unauthenticated Local File Inclusion. The record lists a CVSSv3.1 base score of 8.1 (HIGH) and an attack vector of NETWORK with high complexity, no privileges, and no user interaction required. The vulnerability is docum...

CVE-2025-69161: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Snowy versions = 1.13...

Malicious Package

Overview elf-stats-snowy-toolkit-186 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

EUVD-2025-202913

Malicious code in elf-stats-snowy-toolkit-186 npm...

MAL-2025-192447 Malicious code in elf-stats-snowy-toolkit-186 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e42a7ca12612653aaf7b01c778d65725cf59436f0da1a2e2c1ef371bd5296a23 The package elf-stats-snowy-toolkit-186 was found to contain malicious code. Source: ghsa-malware...

Malicious code in elf-stats-snowy-toolkit-186 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e42a7ca12612653aaf7b01c778d65725cf59436f0da1a2e2c1ef371bd5296a23 The package elf-stats-snowy-toolkit-186 was found to contain malicious code. Source: ghsa-malware...

Malicious code in elf-stats-snowy-northstar-860 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 060b69056cb70a9b63f02519787bc1ab10049d2dd86aef53a7e777a2176ec8ac The package elf-stats-snowy-northstar-860 was found to contain malicious code...

MAL-2025-192276 Malicious code in elf-stats-snowy-northstar-860 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 060b69056cb70a9b63f02519787bc1ab10049d2dd86aef53a7e777a2176ec8ac The package elf-stats-snowy-northstar-860 was found to contain malicious code...

EUVD-2025-201115

Malicious code in elf-stats-snowy-northstar-860 npm...

Malicious code in elf-stats-snowy-bow-730 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 948b1d8fdd34a0cc048e0cf9fdc66fd2a7fbff73e85ffa6e7780909f6f2d1b47 The package elf-stats-snowy-bow-730 was found to contain malicious code...

EUVD-2025-201062

Malicious code in elf-stats-snowy-bow-730 npm...

MAL-2025-192232 Malicious code in elf-stats-snowy-bow-730 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 948b1d8fdd34a0cc048e0cf9fdc66fd2a7fbff73e85ffa6e7780909f6f2d1b47 The package elf-stats-snowy-bow-730 was found to contain malicious code...