CVE-2026-4020

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permissioncallback that unconditionally returns true, allowing any...

VulnCheck KEV: CVE-2026-4020

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permissioncallback that unconditionally returns true, allowing any...

CVE-2026-4606

GV Edge Recording Manager ERM v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. During installation, ERM creates a Windows service that runs under the LocalSystem account. When the ERM application is...

MAL-2026-2228 Malicious code in @zecho/baileys-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e4d4b2c49e19b5e36babb83f8095290c3bd09ad9fb4065ccf3769bb9be4c53d The package @zecho/baileys-mod was found to contain malicious code. Source: ghsa-malware...

Malicious code in jito-validator-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5744d7d3aef03ec852963ebeca1a6357db3aa7bc925bae6e85f173692fc12eb0 The package jito-validator-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2225 Malicious code in neanderthal-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c122a6fe5778bb430f198abe8838eb5d20ce083dca9ee1fdda16354222d1636 The package neanderthal-validator was found to contain malicious code. Source: ghsa-malware...

Malicious code in @universeorg/dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e1bca28be318e644a718c57c724dac6b6b480889b772e317cda8bb23512515c The package @universeorg/dotenv was found to contain malicious code. Source: ghsa-malware...

Malicious code in @shennmine/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117bf59d9266fc8bf77b63821d64778d3d9c7c57cd93c2c95a8b1718e879f14c The package @shennmine/baileys was found to contain malicious code. Source: ghsa-malware...

CVE-2026-32968

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the commb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383...

CVE-2026-32968

CVE-2026-32968 describes an unauthenticated RCE in the MB CONNECT LINE MBCONNECT24 family (mymbCONNECT24 and mbCONNECT24) up to version 2.5.0. The vulnerability arises from improper neutralisation of special elements used in an OS command, allowing a remote attacker to execute code and potentiall...

WAGO GmbH & Co. KG Industrial Managed Switches

SUMMARY A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function. 2. IMPACT This could lead to a full System compromise of the affected devices. 3. REMEDIATION Please update your devices to the...

CVE-2026-4606

GV Edge Recording Manager ERM v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. During installation, ERM creates a Windows service that runs under the LocalSystem account. When the ERM application is...

EUVD-2026-14346

GV Edge Recording Manager ERM v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. During installation, ERM creates a Windows service that runs under the LocalSystem account. When the ERM application is...

PT-2026-27108

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383...

Malicious code in @emilgroup/public-api-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd16e6bb382d147e1c65b35af9d28a9c8b96c40f440b3a45b14e160a77beb1ba The package @emilgroup/public-api-sdk-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2059 Malicious code in @emilgroup/setting-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd7001495cf0c7d9cbe60f2b406b90b4fc34d7a8fc8477c45780cefddf26e28b The package @emilgroup/setting-sdk-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2040 Malicious code in @emilgroup/changelog-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eeeaacce965f54999e4e8fc1a9db77251e1c3956c24672ffe63e1285c46e737d The package @emilgroup/changelog-sdk-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in @opengov/ppf-backend-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8323ddb6e5666c3c6e638547538eda9089f97e0e3605f39b2a561d9a436d8fd4 The package @opengov/ppf-backend-types was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2047 Malicious code in @emilgroup/docxtemplater-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d196d74e7824e876dfcb2ce1d7a1930ef7009f348a1678012c7813f4786080d The package @emilgroup/docxtemplater-util was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2041 Malicious code in @emilgroup/claim-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a86e7c53acc9840bac58a8ff7aca0a0d40a03ab2a8ac73dd55d0314373528800 The package @emilgroup/claim-sdk was found to contain malicious code. Source: ghsa-malware...