Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, an...

MAL-2026-12737 Malicious code in devplatform-react-micro-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475 [email protected] is a lure package whose main entry auto-loads adapter.js on require. adapter.js selects a platform-specific...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

MAL-2026-10627 Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

Malicious code in @tarojs/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b4e6cd0fe6bd16c6fb2bd04e6542a2a3052182d8815a08b124df56f2d9fde2 On npm install, the package's postinstall script performs a reachability GET to https://taro.jd.com/ and, on success, invokes the package's own...

OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

Summary In sandboxed runs, native prompt image auto-load did not honor tools.fs.workspaceOnly=true. This optional hardening setting is not enabled by default. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths for example /agent/secret.png and load...

CVE-2026-25129

PsySH (PHP) is affected by a CWD-based configuration poisoning vulnerability. Prior to versions 0.11.23 and 0.12.19, PsySH auto-loads and executes a .psysh.php file from the current working directory at startup. If an attacker can write to a directory that a victim later uses as the CWD, they can...

EUVD-2025-7983

Malicious code in bioql PyPI...

CVE-2025-30529

Cross-Site Request Forgery CSRF vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through = 1.5.14...

CVE-2025-30529

Cross-Site Request Forgery CSRF vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through = 1.5.14...

CVE-2025-30529

CVE-2025-30529 describes a Cross-Site Request Forgery (CSRF) in the WordPress plugin “Auto Load Next Post” (WordPress Infinite Scroll) affecting versions from unknown up to 1.5.14. CVSS v3.1 base score is 4.3 (Medium). Connected documents show no public exploit details or patch status; monitor fo...

CVE-2025-30529 WordPress Auto Load Next Post plugin <= 1.5.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through = 1.5.14...

CVE-2025-30529 WordPress Auto Load Next Post plugin <= 1.5.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through = 1.5.14...

WordPress Auto Load Next Post plugin <= 1.5.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Auto Load Next Post versions = 1.5.14...

PT-2025-12582

Name of the Vulnerable Software and Affected Versions Sébastien Dumont Auto Load Next Post versions 1.5.14 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations For versions 1.5.14 and earlier, update to a...

CVE-2025-30529: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through = 1.5.14...

WordPress plugin “Auto Load Next Post” vulnerable to Cross-Site Request Forgery attacks

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in...

CVE-2022-0617

A NULL pointer dereference was found in the Linux kernel’s UDF file system functionality in the way the user triggers the udffilewriteiter function for a malicious UDF image. This flaw allows a local user to crash the system. Mitigation As the UDF module udf.ho will be auto-loaded when required,...

CVE-2019-19543

A flaw was found in the Linux kernel’s infrared serial module. An attacker could use this flaw to corrupt memory and possibly escalate privileges. Mitigation As the module will be auto-loaded when the relevant hardware is required, its use can be disabled by preventing the module from loading wit...