Malicious code in ecto (npm)

npm/ecto version 5.0.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

Malicious code in cacheable (npm)

npm/cacheable version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

Malicious code in cacheable-request (npm)

npm/cacheable-request version 13.0.20 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases throug...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

EUVD-2026-52590

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-15958

The CVE concerns the Easy Integration for Dropbox WordPress plugin prior to version 2.2.0. The issue is an authorization failure: several file-management AJAX actions are accessible to unauthenticated users, enabling them to list, download, and upload arbitrary files across the connected Dropbox ...

MiracleLinux 9 : kernel-5.14.0-687.19.1.el9_8 (AXSA:2026-1437:58)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1437:58 advisory. kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation CVE-2026-31488 kernel: ipv6: icmp: clear skb2-cb in...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

CVE-2026-15260

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...

CVE-2026-16564 Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace,...

CVE-2026-16564

The CVE-2026-16564 entry concerns the Dokan plugin (WordPress) prior to 5.0.9. The REST endpoint that handles bulk order-status changes does not verify order ownership, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders be...

EUVD-2026-52173

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...

Authorization Bypass

@better-auth/stripe is vulnerable to Authorization Bypass. The vulnerability is due to inconsistent organization ID validation between the middleware and request handler, allowing authenticated users to perform unauthorized subscription actions and access billing information for other organizatio...

PT-2026-67069

The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs...

CVE-2026-16256

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...

CVE-2026-16256

The CVE-2026-16256 entry concerns the POUCO Import Users WordPress plugin (

EUVD-2026-51938

The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new...

CVE-2026-67343

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67329

@better-auth/stripe versions = 1.4.11 and = 1.7.0-beta.0 and 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the...

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...