CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-72400

A flaw was found in the Linux kernel's Segment Routing over IPv6 SEG6 component. Insufficient validation of the Segment Routing Header SRH length before reading its fixed fields can lead to an out-of-bounds read. A local attacker, by crafting a malicious BPF Berkeley Packet Filter program, could...

MAL-2026-14272 Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

MAL-2026-14273 Malicious code in rand-txs-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9 The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload...

Malicious code in rand-txs-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383599a80e18acfe3bbf819e2c1cc5ec27a4663b2da9e18c7755000857196dc9 The package advertises itself as a random-transaction generator but its exported getTransactions API triggers execution of a hidden code payload...

Malicious code in karma-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379b8e968c18bc5df2f2e00ad56f6c1c139bc97d4a8b19e6d1a917398ad72e58 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, platform, arch, Node.js version, package name,...

MAL-2026-14267 Malicious code in karma-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379b8e968c18bc5df2f2e00ad56f6c1c139bc97d4a8b19e6d1a917398ad72e58 On npm install, the package's postinstall lifecycle script collects host identifiers os.hostname, platform, arch, Node.js version, package name,...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-62342

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...

Malicious code in easydsbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688 package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated obfuscator.io: rotat...

MAL-2026-14265 Malicious code in easydsbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688 package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated obfuscator.io: rotat...

MAL-2026-14268 Malicious code in no-for-of-loops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5 package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops...

Malicious code in no-for-of-loops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5 package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops...

MAL-2026-14269 Malicious code in novel-suduko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...

Malicious code in novel-suduko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21725a395742c4e3e10cd14a3c787d7a01d5cea63feec2515310f471d497f8ad The package's postinstall lifecycle script chmods and executes the bundled binary native/hint-linux-amd64 via spawnSyncBIN, , stdio: 'inherit' on eve...