WP Extended < 3.0.0 - Stored Cross-Site Scripting

The Ultimate WordPress Toolkit - WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

Malicious code in dxrs-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33 Package is an openly-advertised DDoS/booter toolkit L4/L7 flood methods, SSH brute force, C2 panel builder with keywords such as "ddos attack script"...

Malicious code in dxr-dos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an...

CVE-2026-71880

GBIF Integrated Publishing Toolkit (versions before 3.3.4) has a server-side template injection vulnerability in its template engine. Remote authenticated attackers with low privileges can inject untrusted input into templates, achieving high confidentiality and integrity impact (CVSS 7.6) by rea...

CVE-2026-71880 Server-side template injection in Integrated Publishing Toolkit

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879

GBIF Integrated Publishing Toolkit versions before 3.3.4 leave initial setup functionality unauthenticated until first reboot, allowing remote authenticated attackers to bypass authentication and gain administrative control. CVSS 4.0 scores it 9.1 CRITICAL (network, low complexity, no privileges ...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878

GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 leaves initial setup functionality exposed after setup completion, enabling remote authenticated attackers to bypass authentication and gain administrative control; CVSS 4.0 scores this CRITICAL (9.2), with a fix available in version 3...

Important: Red Hat Security Advisory: Migration Toolkit for Applications

A new version of Migration Toolkit for Applications MTA is now available. Migration Toolkit for Applications MTA accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both...

PT-2026-77248

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-74842

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

EUVD-2026-60078

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

CVE-2026-74842

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

CVE-2026-74842 Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery

A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function downloadimage of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument imageurl results in server-side request forgery. Th...

MAL-2026-14055 Malicious code in harmony-app-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...