PT-2026-78271

Name of the Vulnerable Software and Affected Versions Dinatur WordPress plugin versions prior to 1.19 Description Unauthenticated users can perform SQL injection attacks because user input is not sanitized or escaped before being used in a SQL query. Additionally, a handler allows unauthenticated...

PT-2026-78290

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

CVE-2026-65403

CVE-2026-65403 is a remote code execution vulnerability in the Microsoft Windows IKE (Internet Key Exchange) extension, affecting Windows Server and Windows 10/11 with IKE enabled. The vulnerability is exploitable via specially crafted VPN packets , requiring no authentication. It has been added ...

PT-2026-78474

Four critical CVEs were added to CISA’s KEV catalog today, confirming active exploitation across macOS, SharePoint, vCenter, and Windows IKE. These are not theoretical—expect scanning and payload delivery within hours if not already underway. Technical Breakdown: - CVE-2026-65400 CVSS 9.8: Improp...

PT-2026-78370

Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...

Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...

MAL-2026-14176 Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...

Malicious code in @library-dev-team/data-sanitizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec70432fa5463156a41cb4031ccdd89aa76b724eaac0c6e8e61949cb18403d02 The package's main entrypoint runs an unconditional IIFE at require time that reads .env from the current working directory and extracts values label...

MAL-2026-14160 Malicious code in @library-dev-team/data-sanitizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec70432fa5463156a41cb4031ccdd89aa76b724eaac0c6e8e61949cb18403d02 The package's main entrypoint runs an unconditional IIFE at require time that reads .env from the current working directory and extracts values label...

MAL-2026-14136 Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

MAL-2026-14132 Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

SUSE-SU-2026:23244-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command...

SUSE-SU-2026:23241-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command...

SUSE-SU-2026:23194-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command...

SUSE-SU-2026:23193-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command...

hosts v3.16.107

!IMPORTANT Cloning this repository can take a long time! You probably just want to start with the latest version, not its whole history since 2018. Therefore you probably want to use git clone --depth 1 ... to save significant time. !NOTE With the exception of issues and PRs regarding changes to...