CVE-2026-126697

The Quick Page/Post Redirect WordPress plugin (versions before 5.2.4 ) was distributed with a hidden update mechanism that bypassed WordPress.org to fetch updates from a private server. This allowed an attacker to push a backdoored build (version 5.2.3) that injected a the_content filter. The bac...

EUVD-2026-125869

The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 updates from its author's own server instead of WordPress.org, which was used to push a backdoored build to...

Malicious code in react-remove-properties (npm)

Source: amazon-inspector ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties — a plain-HTTP, non-npm-registry, unpinned URL. On npm...

PT-2025-33: Security restriction bypass in macOS Shortcuts

The vulnerability was identified in macOS Shortcuts, versions to macOS Sequoia 15.5. The discovered vulnerability allows an attacker to bypass security restrictions and execute arbitrary code delivered via an FTP or SMB server. Vulnerability status: Confirmed by vendor Date of vulnerability...