Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

CVE-2026-106438

A flaw was found in the MongoDB C Driver. This vulnerability allows an attacker to compromise data integrity by causing an application to store or process incorrect numeric values. Due to a calculation error during Decimal128 string parsing, the driver accepts certain over-precision numbers with...

CVE-2026-106434

A flaw was found in MongoDB libmongocrypt. When processing an unrecognized encrypted payload during explicit decryption, the library returns the data unchanged instead of generating a decryption error. An attacker capable of modifying stored encrypted fields, such as a compromised database server...

Security Bulletin: Security vulnerability in Java affects IBM Robotic Process Automation

Summary A security vulnerability in Java affects IBM Robotic Process Automation. Java is used by IBM Robotic Process Automation as part of its deployment. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS...

CVE-2026-92414

A flaw was found in jackrabbit-webdav. The WebDAV Web Distributed Authoring and Versioning server attaches a cached authenticated session when request header tokens—such as lock, transaction, or subscription identifiers—match, without verifying user credentials. An unauthenticated remote attacker...

Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. JavaScript is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fix...

CVE-2026-105877

Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0...

CVE-2026-105872

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5...

CVE-2026-104392

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-103220

The Affinity by Canva application before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document tha...

CVE-2026-103220

The Affinity by Canva application, in versions prior to 3.3.1 (October 2026 release), is vulnerable to an out-of-bounds block-array read. The root cause is inadequate bounds checking when parsing raster image data within Affinity document files, which can lead to an out-of-bounds read and the der...

CVE-2026-103220

The Affinity by Canva application before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document tha...

CVE-2026-86851

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...

CVE-2026-85348

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link...

CVE-2026-62036

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31...

CVE-2026-105872

The Product Configurator for WooCommerce WordPress plugin (versions

CVE-2026-105877 WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0...

CVE-2026-105872 WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5...

CVE-2026-105877

The QA Analytics plugin for WordPress (versions

EUVD-2026-95772

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5...