CVE-2026-75589 Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...

Malicious code in nodealpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...

MAL-2026-14270 Malicious code in nodealpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...

MAL-2026-14271 Malicious code in nodeberlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...

Malicious code in nodeberlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-72400

A flaw was found in the Linux kernel's Segment Routing over IPv6 SEG6 component. Insufficient validation of the Segment Routing Header SRH length before reading its fixed fields can lead to an out-of-bounds read. A local attacker, by crafting a malicious BPF Berkeley Packet Filter program, could...

MAL-2026-14272 Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

Malicious code in rand-txs-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9 The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload...

MAL-2026-14273 Malicious code in rand-txs-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9 The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload...

Malicious code in karma-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379b8e968c18bc5df2f2e00ad56f6c1c139bc97d4a8b19e6d1a917398ad72e58 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, platform, arch, Node.js version, package name,...

MAL-2026-14267 Malicious code in karma-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379b8e968c18bc5df2f2e00ad56f6c1c139bc97d4a8b19e6d1a917398ad72e58 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, platform, arch, Node.js version, package name,...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-62342

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...

Malicious code in easydsbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688 package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated obfuscator.io: rotat...