MAL-2026-13789 Malicious code in bmgki3g6fh3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9212dc22bc5983b7b163b7851e76596bda812485709581a8dd61475630db4450 The package contains a single file, index.html, declared as main. The page renders a spoofed Cloudflare 'Just a moment...' / Turnstile 'security...

Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

MAL-2026-13778 Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

CVE-2026-67284

Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud 2.0.3 - Authenticated users could perform various file-related operations read, delete, overwrite, re-assign permissions on files owned by other users...

CVE-2026-19588

A flaw was found in rlottie, an open-source library for animating vector graphics. This vulnerability involves an integer overflow that can lead to a buffer overflow. A remote attacker could exploit this by tricking a user into interacting with specially crafted input, potentially causing the...

ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching

A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...

CVE-2026-19559

A flaw was found in Google Chrome. This use-after-free vulnerability in the HTML component allows a remote attacker to execute arbitrary code within the browser's sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page...

CVE-2026-19558

A flaw was found in Google Chrome Extensions. This use-after-free vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox. Exploitation occurs when a user is convinced to install a specially crafted malicious extension...

CVE-2026-19556

A flaw was found in chromium-browser. This use-after-free vulnerability in the V8 JavaScript engine allows a remote attacker to execute arbitrary code within the browser's sandbox. Exploitation occurs when a user visits a specially crafted HTML page, leading to a compromise of the affected system...

CVE-2026-67282

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model...

CVE-2025-41771

CVE-2025-41771 details an SQL injection vulnerability exploitable by an authenticated user with low privileges via an endpoint in the controller’s web interface. The flaw affects a SQLite database used solely for storing notification messages, so the impact is limited to the system’s notification...

CVE-2025-41770 Unauthenticated Denial of Service

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted...

CVE-2025-41770

Technical details regarding CVE-2025-41770 are not publicly provided in the supplied documents. No affected products, versions, root cause, or remediation are specified here. Monitor for updates from official advisories and connected sources.

CVE-2025-41770

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted...

CVE-2026-19426

The CVE concerns a POS System by FitSoft with a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access and operate the system. Affected details from connected sources confirm the issue exists and yields high impact: CVSS v3.1 base score 8.2 (Network, LOW attack ...

CVE-2026-16051

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute...

BELL-CVE-2026-68428

Bulletin has no description...

EUVD-2026-57092

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...