4276 matches found
MAL-2026-12967 Malicious code in bnpl-blocks-independent-bnpl-product-grid (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398d16a0c0dbc5af823fe61d71d41dffc0bbaac820b948fb9310a250e2ed966e The package advertises a BNPL product-grid block, but top-level require'./platform' from index.js triggers platform.js, which on load selects a...
CVE-2026-71292
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
Malicious code in streak-grid-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7 The package advertises itself as dependency-free calendar/streak math primitives, but the main entry index.mjs, resolved via package.json exports "."...
MAL-2026-12807 Malicious code in streak-grid-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7 The package advertises itself as dependency-free calendar/streak math primitives, but the main entry index.mjs, resolved via package.json exports "."...
CVE-2026-71292 Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
CVE-2026-71292
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
CVE-2026-71292
CVE-2026-71292 affects Subrion CMS. The admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, accepts a sort parameter by falling back to the attacker-controlled GET value when the key isn’t in the per-controller $_gridSorting whitelist. The value is then ...
CVE-2026-71292 Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
EUVD-2026-53377
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the dir ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied sort GET parameter whenever the requested key is not present in the per-controller...
CVE-2026-71292 Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
WordPress Netroics Blog Posts Grid plugin <= 1.0 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by saitamang, syad, yunaranyancat in WordPress Plugin Netroics Blog Posts Grid versions = 1.0...
PT-2026-68164
Name of the Vulnerable Software and Affected Versions Subrion CMS affected versions not specified Description The admin grid sorting helper gridGetSorting in includes/classes/ia.base.controller.admin.php fails to properly validate the sort GET parameter. While the function attempts to whitelist t...
CVE-2026-71292: Improper Neutralization of Special Elements used in an SQL Command
Subrion CMS's admin grid sorting helper, gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the ASC/DESC request parameter via inarray, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist...
Malware in @qlik/react-native-simple-grid
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in @qlik/react-native-simple-grid (npm)
npm/@qlik/react-native-simple-grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malware in @servicetitan/grid
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2026-11872 Malicious code in @servicetitan/grid (npm)
npm/@servicetitan/grid is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...
CLSA-2026-1780534256 TuxCare security update for ag-grid-community (2 CVEs)
TuxCare rebuilt ag-grid-community to address 2 CVEs. Fixed in 28.2.0-tuxcare.1...