Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

MAL-2026-17520 Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

OESA-2026-4169 gdal security update

Geospatial Data Abstraction Library GDAL/OGR is a cross platform C++ translator library for raster and vector geospatial data formats. As a library, it presents a single abstract data model to the calling application for all supported formats. It also comes with a variety of useful commandline...

OESA-2026-4170 gdal security update

Geospatial Data Abstraction Library GDAL/OGR is a cross platform C++ translator library for raster and vector geospatial data formats. As a library, it presents a single abstract data model to the calling application for all supported formats. It also comes with a variety of useful commandline...

@digital-realty/grid (1.2.4-IXUAT-11104.552907), @vaadin/hilla-react-crud (>=24.10.0, <=24.10.8) +4 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.10.0, <=24.10.4)

@vaadin/component-base NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@hilla/react-components (>=2.0.0, <=2.4.0-alpha2), @hilla/react-crud (>=2.3.0-beta1, <=2.5.8) +7 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=24.0.0, <=24.9.17)

@vaadin/charts NPM version =24.0.0, =2.0.0, =2.3.0-beta1, =2.3.0-alpha1, =24.0.0, =24.4.0-alpha10, =24.4.0-alpha12, =24.4.0-alpha10, =24.0.0-rc3, =24.10.0-alpha1 - hilla-admin-react 1.0.0 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

PT-2026-103055

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt bb css image grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...

CVE-2022-28108

Selenium Chrome RCE Exploit Extended This repository contains a modified version of a Metasploit module that exploits a Remote Code Execution vulnerability in older versions of Selenium Server Grid. Please read this README carefully before using this code. Acknowledgment of Original Code: This...

CVE-2026-92713

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-89406

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

EUVD-2026-86602

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

EUVD-2026-86592

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-92713 Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

PT-2026-98392

Name of the Vulnerable Software and Affected Versions Modula Image Gallery – Photo Grid & Video Gallery versions prior to 3.0.3 Description Insufficient file path validation in the upload image function allows authenticated attackers with author-level access or higher to delete arbitrary files on...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability

Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Modula Image Gallery versions = 3.0.1...

CVE-2026-84151

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

WordPress The Post Grid plugin < 7.9.5 - Contributor+ Stored HTML/iframe Injection vulnerability

Contributor+ Stored HTML/iframe Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin The Post Grid versions 7.9.5...

CVE-2026-84151 The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

EUVD-2026-85800

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...