MAL-2026-14484 Malicious code in react-remove-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties...

Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

MAL-2026-14486 Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

Malicious code in vite-plugin-images-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388 This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the...

MAL-2026-14482 Malicious code in vite-plugin-images-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388 This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the...

Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

MAL-2026-14481 Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

Improper Authorization

keycloak-services is vulnerable to an improper authorization. The vulnerability is due to insufficient permission checks when a restricted administrator lists users assigned to a role, which allows an attacker with limited administrative privileges to exploit the role-users endpoint and access...

MAL-2026-14475 Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

PHPUnit-GoScan

🛡️ PHPUnit Go Scanner CVE-2017-9841 Ein schneller, in Go geschriebener Multithread-Scanner zur Erkennung exponierter und verwundbarer eval-stdin.php-Endpunkte in PHPUnit CVE-2017-9841. Unterstützt das Scannen mehrerer Domains mit paralleler Ausführung und automatischer Protokollerkennung. 🖼...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65276

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...

CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65272

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-72699

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...