EUVD-2026-53970

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65523

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65523 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65523

CVE-2026-65523 affects the WordPress plugin Formidable Forms Signature Online Contract Automation (versions

CVE-2026-65523: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

MAL-2026-13034 Malicious code in boxy-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01882c522b96942398bba4079e225224c0672793444cb1a8ce700d3441848ee5 On require of boxy-contract, index.js loads init.js which selects a platform-specific endpoint and downloads a binary over HTTPS from...

Malicious code in boxy-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01882c522b96942398bba4079e225224c0672793444cb1a8ce700d3441848ee5 On require of boxy-contract, index.js loads init.js which selects a platform-specific endpoint and downloads a binary over HTTPS from...

Malicious code in boxy-expander-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f5856de3b0385535e80e5ef85627ecb7a087132c82c5d5457b35b62b9eaf72 On require of this package, index.js loads./runtime.js which assembles Cloudflare Workers hostnames via string-split.join'' fragments e.g...

MAL-2026-13043 Malicious code in boxy-expander-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f5856de3b0385535e80e5ef85627ecb7a087132c82c5d5457b35b62b9eaf72 On require of this package, index.js loads./runtime.js which assembles Cloudflare Workers hostnames via string-split.join'' fragments e.g...

Malicious code in contract-contract-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3758ab87194c554acffc80e8cd2caf8fa8890e92854115edab08615877f22b5f On require of the package, platform.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

MAL-2026-12665 Malicious code in contract-contract-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3758ab87194c554acffc80e8cd2caf8fa8890e92854115edab08615877f22b5f On require of the package, platform.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

MAL-2026-12332 Malicious code in @zahlen/checkout-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45fa3b05e748470cdc08e19b2e86efb8a34c85f155e5972c1b0c0598c150a0bd The package's fesm2022 ESM entry declared as module in package.json and executed on import of the library ends with a trailing evalatob'...' payload...

Malicious code in @zahlen/checkout-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45fa3b05e748470cdc08e19b2e86efb8a34c85f155e5972c1b0c0598c150a0bd The package's fesm2022 ESM entry declared as module in package.json and executed on import of the library ends with a trailing evalatob'...' payload...

POC-keyv-and-cacheable-npm-Package

ChainDrop npm Supply Chain Attack — PoC Scanner & Exploit...

Landmark Deal Would Officially Add Laser Weapons to US Army Arsenal

Facing a growing drone threat, the Pentagon is poised to sign a first-of-its-kind contract for “Enduring High Energy Lasers”—and make directed energy weapons an official part of the Army’s kit...

Exploit for Path Traversal in Publiccms

--- CVE-2026-1111 – Smart Contract Cross‑Function Reentrancy...

CLSA-2026-1785489136 Fix CVE(s): CVE-2026-11386, CVE-2026-12391, CVE-2026-9494

SECURITY UPDATE: Pro bearer token exposed via apt-helper command line - Write APT credentials to a temporary 0600 auth file and pass a credential-free URL to apt-helper, instead of embedding the token in the download-file URL argument where it leaked to local users via /proc//cmdline. Source...

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview...

SUSE CVE-2026-46403

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

EUVD-2026-49931

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at...