219 matches found
blackout-public
ZoomInfo GTM Studio: Pre-Consent Tracking Documentation "You can block the researcher. You can't block the evidence." What Happened On November 25, 2025, ZoomInfo CEO Henry Schuck posted a product demo of GTM Studio on LinkedIn — their AI-powered platform that "identifies person-level website...
CVE-2026-55826
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...
EUVD-2026-108976
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...
CVE-2026-55826
The GTM Server Side plugin by stape.io for WordPress is vulnerable to an information disclosure flaw in versions 2.0.0 through 2.1.47 . An unauthenticated attacker can manipulate the gtm_server_side_order_id cookie to trigger the rendering of another customer's full order data, including personal...
CVE-2026-55826 Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...
PT-2026-122111
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — includin...
Malicious Package
Overview @tvg-mar/promos-gtm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malware in @tvg-mar/promos-gtm
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious Package
Overview @tvg-mar/promos-gtm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...
Malicious code in @tvg-mar/promos-gtm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...
Malicious Package
Overview @tvg-mar/promos-gtm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview latam-xp-analytics-plugin-gtm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +1 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (1.0.0)
langgraph-checkpoint-postgres PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =1.2.13 Source cves: CVE-2026-71433 Source advisory...
gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +1 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (1.0.0)
langgraph-checkpoint-postgres PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =1.2.13 Source cves: CVE-2026-71433 Source advisory...
Malicious code in gtm-mcp-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...
MAL-2026-11464 Malicious code in gtm-mcp-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...
CVE-2026-16597
The GTM4WP – A Google Tag Manager GTM plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-16597: Improper Neutralization of Input During Web Page Generation
The GTM4WP – A Google Tag Manager GTM plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for...
gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +2 more potentially affected by CVE-2026-48775 via langgraph-checkpoint (1.0.12)
langgraph-checkpoint PYPI version 1.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =0.3.0, =0.3.5 Source cves: CVE-2026-48775 Source advisory:...