8559 matches found
MAL-2026-15616 Malicious code in ndmxchdjxn2 (npm)
Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...
CVE-2026-80525 ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipcconfigdata buffer for copier widgets is built once during ipcprepare called from sofpcmsetupconnectedwidgets and cached for reuse. For host copiers...
CVE-2026-19226
The Royal Addons for Elementor WordPress plugin, in versions prior to 1.7.1066 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the lack of validation for certain widget settings—specifically the Image Accordion Widget Effect Settings —before they are outputted inside an H...
CVE-2026-19226 Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
PT-2026-81954
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-32593: Improper Neutralization of Special Elements used in an SQL Command
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions key, allowing an authenticated backend...
CVE-2026-19226: Improper Neutralization of Input During Web Page Generation
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
WordPress MetForm plugin <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'mfformid' Widget Setting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Metform versions = 4.1.8...
Atlassian Confluence Server - Path Traversal
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 the fixed version for 6.6.x, from version 6.7.0 before 6.12.3 the fixed version for 6.12.x, from version 6.13.0 before 6.13.3 the fixed version for 6.13.x, and from version 6.14.0 before 6.14.2 the fixed version for...
EUVD-2026-65175
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...
CVE-2026-78268
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...
CVE-2026-78268 WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...
CVE-2026-78268 WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...
CVE-2026-78268
CVE-2026-78268 affects the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) in versions ≤ 1.2.0 . The vulnerability allows unauthenticated sensitive data exposure through the plugin's Chat Button, Phone Call, Telegram, and Email contact features, with no user interaction r...
PT-2026-81061
Name of the Vulnerable Software and Affected Versions SiteLeads versions prior to 1.2.1 Description Unauthenticated sensitive data exposure exists in the Lead Generation Contact Widget & AI Chatbot, affecting the Chat Button, Phone Call, Telegram, and Email features. Recommendations Update to a...
Malicious code in @opap/player-kyc-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...
MAL-2026-14387 Malicious code in @opap/player-kyc-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...
WordPress Royal Elementor Addons plugin < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder vulnerability
Admin+ Remote Code Execution via Widget Builder vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Royal Elementor Addons versions 1.7.1066...
