MAL-2026-12561 Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

MAL-2026-12666 Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

Malicious code in @zahlen/checkout-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45fa3b05e748470cdc08e19b2e86efb8a34c85f155e5972c1b0c0598c150a0bd The package's fesm2022 ESM entry declared as module in package.json and executed on import of the library ends with a trailing evalatob'...' payload...

Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

MAL-2026-12351 Malicious code in checkout-common-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0e9681cb5e7a197ca8d77ba29e20a4709fa0ff476f2ffb02f935785c6633e0 On require, index.js loads ext.js which selects a platform-specific payload URL from a rotating list of Cloudflare Workers subdomains hosts assembled...

Malicious code in @zahlen/checkout-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097440ff1155e4d840568cf0fc8502c00d43249340f0f301167a859fd34c9fe8 The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation \uXXXX to hide imports of...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

CVE-2026-16143

Vulnerability: CVE-2026-16143 affects VikRentItems Flexible Rental Management System

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-16143 VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

MAL-2026-12063 Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

EUVD-2026-42658

Ghost: Paid gift memberships obtainable at minimal cost via the donations feature...

CVE-2026-14848

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

CVE-2026-14848 Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

Amazon Linux 2023 : python3-dulwich (ALAS2023-2026-2026)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2026 advisory. Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py. CVE-2026-38974 Arbitrary file write leading to remote code execution when cloning or...

GHSA-3F7W-8RR8-F37F GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

Target: gitpython-developers/GitPython Tested: HEAD 07e80555 2026-07-25, latest release 3.1.55, git version 2.50.1 Reported instances: 2 exploitable, from a sweep of 14 unguarded call sites Summary GitPython blocks dangerous git options through Git.checkunsafeoptions, gated per method by an...