MAL-2025-22780 Malicious code in hugo-draco-mini-css-extract-plugin-paleoanthropology (npm)

The package hugo-draco-mini-css-extract-plugin-paleoanthropology was found to contain malicious code...

MAL-2025-17796 Malicious code in css-minimizer-webpack-plugin-nightwatch-callback-rimraf (npm)

The package css-minimizer-webpack-plugin-nightwatch-callback-rimraf was found to contain malicious code...

MAL-2025-29539 Malicious code in postcss-loader-dotenv-safe-mini-css-extract-plugin-supervisor (npm)

The package postcss-loader-dotenv-safe-mini-css-extract-plugin-supervisor was found to contain malicious code...

MAL-2025-29535 Malicious code in postcss-css-prefixer (npm)

The package postcss-css-prefixer was found to contain malicious code...

MAL-2025-34119 Malicious code in style-loader-nextjs-css-loader-gemini (npm)

The package style-loader-nextjs-css-loader-gemini was found to contain malicious code...

Malicious code in koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics (npm)

The package koa-uglify-js-css-minimizer-webpack-plugin-tectonophysics was found to contain malicious code...

MAL-2025-16555 Malicious code in carina-wasat-css-minimizer-webpack-plugin-paleoclimatology (npm)

The package carina-wasat-css-minimizer-webpack-plugin-paleoclimatology was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2020-26973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This...

WordPress HT Mega plugin path traversal vulnerability

WordPress HT Mega plugin is an Elementor page builder plugin designed for WordPress, offering over 100 custom widgets, 360+ preset modules, and a variety of templates for blogs, sliders, collapsible menus, and other page elements. A path traversal vulnerability exists in the WordPress HT Mega...

Linux Distros Unpatched Vulnerability : CVE-2022-31744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy...

Linux Distros Unpatched Vulnerability : CVE-2021-23996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could...

CVE-2025-8151

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'saveblockcss' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any director...

CVE-2025-8151

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'saveblockcss' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any director...

CVE-2025-8151 HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'saveblockcss' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any director...

CVE-2025-8151

CVE-2025-8151 (HT Mega – Absolute Addons For Elementor) is a path traversal vulnerability in the WordPress plugin HT Mega up to version 2.9.1. The flaw resides in the save_block_css function and can be exploited by an authenticated user with Author+ privileges to create and delete CSS files in an...

PT-2025-31505 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: HT Mega – Absolute Addons For Elementor plugin for WordPress versions prior to 2.9.2 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is susceptible to a path traversal issue. This allows authenticated attackers...

Malicious code in shopify-css-import (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02612f811f0437cad89ff886ab8950df3e8e2a8ecc3c285747a833e50420ee7b Any computer that has this package installed or running should be considered...

MAL-2025-6124 Malicious code in shopify-css-import (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02612f811f0437cad89ff886ab8950df3e8e2a8ecc3c285747a833e50420ee7b Any computer that has this package installed or running should be considered...

📄 SugarCRM 14.0.0 Code Injection / SSRF / File Read

SugarCRM versions 14.0.0 and below suffer from a LESS code injection vulnerability. User input passed through GET parameters to the /css/preview REST API endpoint is not properly sanitized before parsing it as LESS code. This can be exploited by remote, unauthenticated attackers to inject and...

MAL-2025-5683 Malicious code in css-keylogger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d7d5c0eac76577da5186e985efd72018e773d9ada891e44852188b9e5cd8632 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...