1899418 matches found
CVE-2026-15446
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
EUVD-2026-62342
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts
When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...
Malicious code in easydsbots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688 package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated obfuscator.io: rotat...
MAL-2026-14265 Malicious code in easydsbots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688 package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated obfuscator.io: rotat...
MAL-2026-14268 Malicious code in no-for-of-loops (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5 package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops...
Malicious code in no-for-of-loops (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5 package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops...
Malicious code in novel-suduko (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...
MAL-2026-14269 Malicious code in novel-suduko (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...
Malicious code in de-morgan (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f package.json declares both a dependencies and devDependencies entry for de-morgan pointing at http://pack.nppacks.com/npm/de-morgan, a non-npm-regist...
MAL-2026-14264 Malicious code in de-morgan (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f package.json declares both a dependencies and devDependencies entry for de-morgan pointing at http://pack.nppacks.com/npm/de-morgan, a non-npm-regist...
CVE-2026-16979
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...
CVE-2026-16979
The SmartCrawl WordPress plugin (versions before 3.16.3) lacks capability checks on two AJAX actions, letting any Subscriber read private/draft post titles by ID and enumerate stored post-meta key names. CISA SSVC assesses partial technical impact with no known exploitation. No in-the-wild exploi...
CVE-2026-16979 SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...
CVE-2026-16979 SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...
EUVD-2026-62274
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...
CVE-2026-55708
A flaw in Unbound's unbound-control utility can omit default-protected zones when initializing local data for a view. This allows queries for protected local names to bypass intended policies and leak to the public DNS, potentially exposing sensitive network information. Mitigation Do not run...