Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

MAL-2026-14481 Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

Improper Authorization

keycloak-services is vulnerable to an improper authorization. The vulnerability is due to insufficient permission checks when a restricted administrator lists users assigned to a role, which allows an attacker with limited administrative privileges to exploit the role-users endpoint and access...

MAL-2026-14475 Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

PHPUnit-GoScan

🛡️ PHPUnit Go Scanner CVE-2017-9841 Ein schneller, in Go geschriebener Multithread-Scanner zur Erkennung exponierter und verwundbarer eval-stdin.php-Endpunkte in PHPUnit CVE-2017-9841. Unterstützt das Scannen mehrerer Domains mit paralleler Ausführung und automatischer Protokollerkennung. 🖼...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65276

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-76063

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wfp_featured_video_url parameter in all versions up to and including 1.8.1 . The root cause is insufficient input sanitization and output escaping. The REST endpoint used ...

CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-76063 FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfpfeaturedvideourl' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65272

The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpresscreatepage AJAX action. The LPAdminAjax::createpage handler only checks the editpages capability and a wprest nonce both availabl...

CVE-2026-72699

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72699 Grav Login Plugin before 3.9.1 Email Enumeration via Registration

The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...

CVE-2026-72699

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration . The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email already belongs to an existing account, while allowing registration to pr...

CVE-2026-10630 WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

PT-2026-81993

genieacs-mcp exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled Host and Origin headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request,...

PT-2026-81857

Name of the Vulnerable Software and Affected Versions tongweb version 7.0.24 Description An issue in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code by sending a crafted request to the 'console/heimdall' endpoint. Recommendations At the moment,...

PT-2026-81247

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

PT-2026-82001

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...